A deficiency letter shows up after the SEC's Division of Examinations has finished examining your firm. It lists what the staff believes you're getting wrong and requires a written response.
Beyond simply fixing the shortcomings, the harder question in an SEC deficiency letter response is how much to say, how fast, and in what order — and the staff don't hand you a template for it.
First, understand what you have received
A deficiency letter is not an enforcement action. It's the examination staff setting out what they observed and giving you the chance to correct it. Most firms that receive one never hear anything further.
It isn't a suggestion either. Findings that go unaddressed — or that reappear at the next examination — are the pattern that gets a matter referred to the Division of Enforcement. The letter is the cheap moment to fix things. Everything after it costs more.
The letter will specify a deadline for your written reply. Thirty days is common, and that window closes faster than it reads.
Step one: sort the findings before you respond to any of them
Before drafting anything, it helps to split the findings into three groups, because each group gets written up differently.
- Factual disagreements. Sometimes the staff has misread a document or misunderstood a process. It happens, though less often than it feels like it should in the moment. If you disagree, you can say so — but only with documentation attached, and in measured language.
- Things you can fix immediately. A missing disclosure, an out-of-date policy, an incomplete log. Anything you can correct within days belongs in this group.
- Things that need a real program change. A supervisory process that doesn't work, a review that has never actually been performed, a records system that can't produce what was requested. These take longer and need a plan rather than a fix.
Step two: fix what you can before you write
This is where the response is won, and it's the easiest step to skip when the clock is running.
A response that says “we have updated the policy, effective 14 March, and it is attached” lands very differently from one that says “we intend to update the policy.” The first closes the finding. The second invites a follow-up question.
Work through the immediate-fix group and close out as much as possible inside the response window. Whatever can't be completed gets a dated plan instead.
Step three: write the response finding by finding
A narrative response is harder for the staff to work through than a structured one. Mirror the letter itself — take each finding in the order it was raised, and answer each one with the same four elements:
- What the finding was — restate it briefly, in the staff's own framing, so it is clear you have understood it.
- What you have done — the specific corrective action, with the date it was completed.
- What you will do — for anything not yet finished, the concrete step and the date it will be done by. A real date, not “in due course.”
- Who owns it — the person or role responsible for the change and for making sure it holds.
Attach the evidence — revised policies, the updated procedure, the corrected filing, the completed log. Assertions without documents are what generates a second round of questions.
Two notes on tone. Direct and unemotional works best; the staff are moving through a queue, and a defensive letter reads as a firm that hasn't accepted the finding. And it's worth under-promising. A commitment you miss is worse than a modest one you meet, because the next examination will check.
Step four: keep the whole thing
The letter, your response, the supporting documents, and the record of when each remediation step was completed all belong in your compliance files. Rule 204-2 under the Advisers Act sets out the books and records obligations, and this correspondence sits squarely within the material you're expected to retain.
More practically: the next examination will open by asking what came out of the last one. A firm that can produce a clean, dated remediation trail on request is in a very different position from one reconstructing events from memory.
The mistakes that cause the real damage
- Missing the deadline, or asking for an extension late. If you need more time, ask early and give a reason.
- Answering some findings and quietly skipping others. The staff will notice the gap.
- Fixing the specific instance but not the underlying process — the finding reappears next cycle, and a repeat finding is treated very differently from a first one.
- Handling it entirely inside compliance. Findings that touch supervision, marketing, or records usually need input from the functions that own them.
The underlying problem
Most deficiency findings aren't the result of anyone being careless. They accumulate because policies drift out of alignment with what the firm actually does, and nobody has the hours to notice until an examiner does it for them.
That gap — between the written program and the operating reality — is what we're building tools to close. If it's a problem you recognize at your own firm, we'd be glad to hear how you're handling it.