7 Questions to Ask Before Your 2027 Compliance Planning Begins

A practical framework for investment firms to assess risk, strengthen controls, and establish compliance priorities for the year ahead.

As investment firms prepare for 2027, compliance planning should involve more than updating policies, reviewing examination priorities, or carrying forward initiatives from the previous year. It is an opportunity to evaluate whether the compliance program is operating as intended, where weaknesses may exist, and which improvements will have the greatest impact on risk management and operational effectiveness.

Effective investment compliance planning begins with an understanding of how policies, systems, controls, and people work together. A firm may have comprehensive documentation and sophisticated monitoring technology, yet still face exposure when responsibilities are unclear, systems are poorly configured, or exceptions are not consistently resolved.

For Chief Compliance Officers (CCOs), Chief Operating Officers (COOs), and investment operations leaders, the challenge is determining where to focus limited resources while maintaining effective oversight of increasingly complex investment activities.

That challenge is particularly relevant heading into 2027.

The U.S. Securities and Exchange Commission (SEC) continues to emphasize the effectiveness of investment advisers’ compliance programs, including how firms implement policies, identify conflicts, test controls, and address deficiencies. Its September 2026 Risk Alert on annual compliance reviews reinforces the importance of evaluating not only whether compliance policies exist, but whether they are adequate and effectively implemented.

Before establishing budgets, technology initiatives, or compliance priorities for 2027, investment firms should consider seven foundational questions.

1. Where Did Our Compliance Program Experience the Most Friction in 2026?

One of the most valuable inputs into next year’s compliance strategy is evidence from the current year’s operations.

Compliance teams routinely collect information through trade monitoring, exception reviews, surveillance alerts, testing, internal assessments, and audit findings. However, that information does not always translate into meaningful changes to the compliance program.

An effective planning process begins by examining where compliance activities were most difficult to execute consistently.

Consider:

Which compliance exceptions occurred repeatedly, and what were their underlying causes?
Where did monitoring or approval processes require significant manual intervention?
Were certain controls frequently overridden, adjusted, or bypassed?
Which findings remained unresolved longer than expected?
Did compliance teams experience recurring data quality, system integration, or reporting challenges?

These questions help distinguish isolated incidents from structural weaknesses.

For example, repeated pre-trade compliance alerts may initially appear to reflect portfolio manager behavior. Further investigation might reveal outdated security classifications, inconsistent account restrictions, or rule configurations that no longer reflect current investment mandates.

Addressing the underlying issue may reduce unnecessary alerts while improving the reliability of monitoring.

The planning priority: Identify recurring friction, document root causes, and distinguish issues requiring policy changes from those requiring improvements to technology, data, processes, or accountability.

A compliance program should become more effective as it learns from operational experience. The annual planning process provides an opportunity to turn those lessons into measurable improvements.

2. Are Our Compliance Controls Still Aligned With How the Business Actually Operates?

Investment firms evolve continuously.

New investment strategies, products, client mandates, trading arrangements, service providers, and technology platforms can introduce risks that existing compliance controls were not originally designed to address.

The challenge is that compliance documentation and operational systems do not always evolve at the same pace.

A policy may be updated to reflect a new investment restriction, while the corresponding rule in the order management system (OMS) remains unchanged. A new account structure may introduce monitoring requirements that have not been fully incorporated into existing workflows.

These disconnects can create exposure even when individual teams believe they are following established procedures.

Under SEC Rule 206(4)-7, SEC-registered investment advisers must adopt and implement written policies and procedures reasonably designed to prevent violations of the Advisers Act and its rules, and review their adequacy and implementation effectiveness at least annually.

For 2027 planning, firms should assess whether their controls remain appropriate for their actual operating environment.

Areas worth evaluating

Investment strategies and mandates: Have new products, strategies, or client restrictions introduced additional monitoring requirements?

Trading and portfolio management: Do pre-trade and post-trade controls accurately reflect current investment activities?

Technology configuration: Are compliance rules consistently implemented across relevant systems, portfolios, and accounts?

Business relationships: Have changes involving custodians, brokers, administrators, or other service providers affected compliance responsibilities?

Policies and procedures: Do documented requirements accurately describe how controls operate in practice?

This assessment should involve compliance, investment operations, technology, and relevant business stakeholders.

Each group may have visibility into different aspects of the same control.

The planning priority: Establish a clear connection between business activities, applicable requirements, documented policies, and operational controls.

The goal is not simply to confirm that controls exist. It is to determine whether those controls remain appropriate, consistently implemented, and effective.

3. Can We Demonstrate That Our Compliance Controls Are Working?

There is an important distinction between having a compliance control and being able to demonstrate its effectiveness.

A monitoring system may generate alerts. A compliance officer may review exceptions. A policy may require periodic testing.

But can the firm produce evidence showing that those activities occurred consistently, were appropriately reviewed, and resulted in necessary corrective action?

This question becomes especially important during examinations, internal audits, and management reviews.

The SEC’s guidance on reviewing adviser compliance programs emphasizes risk assessments, testing, exception follow-up, and annual reviews.

For investment firms, evidence of effectiveness may include:

Documented testing methodologies and results.
Records of compliance rule configuration changes.
Exception investigations and resolution histories.
Approval and escalation documentation.
Evidence of periodic supervisory reviews.
Records of identified deficiencies and corrective actions.
Documentation demonstrating how findings influenced subsequent control improvements.

A common weakness is fragmented evidence.

Testing results may exist in spreadsheets, exception discussions in email, configuration changes in system logs, and remediation updates in project management tools.

Although the underlying activities may have occurred, reconstructing a complete history can become time-consuming and difficult.

Consider a trading restriction that was temporarily overridden.

A defensible record should help establish why the override was requested, who authorized it, whether appropriate conditions were applied, and how the resulting activity was monitored.

Without that information, the firm may struggle to demonstrate that its exception management process operated as intended.

The planning priority: Identify where compliance evidence is incomplete, fragmented, or difficult to retrieve, and establish consistent documentation and retention practices.

Effective compliance is not measured solely by the number of controls implemented. It also depends on whether those controls can be tested, evaluated, and supported with reliable evidence.

4. Is Our Compliance Technology Supporting Oversight or Creating Additional Risk?

Technology plays a central role in investment compliance.

Order management systems, compliance monitoring platforms, surveillance tools, reporting applications, and data integrations support the execution of critical controls.

However, technology does not automatically guarantee effective compliance.

A system can operate exactly as configured while producing results that do not reflect current policies or investment restrictions.

This creates an important planning consideration: Compliance technology should be evaluated as part of the firm’s control environment, not simply as operational infrastructure.

Questions to consider during a technology assessment

Are compliance rules accurate and current?

Rule configurations should reflect applicable requirements, client mandates, and approved investment restrictions.

Are system changes governed appropriately?

Updates to compliance rules, thresholds, security classifications, and monitoring logic should follow documented approval, testing, and implementation processes.

Are data inputs reliable?

Incomplete holdings, inconsistent security classifications, delayed transactions, or inaccurate reference data can undermine otherwise well-designed controls.

Are integrations operating effectively?

Information moving between portfolio management, trading, compliance, and reporting systems should be subject to appropriate reconciliation and validation.

Are manual workarounds becoming permanent processes?

Recurring spreadsheet-based reviews or manual adjustments may indicate that technology no longer adequately supports the firm’s needs.

These issues can become particularly significant when firms undertake OMS migrations, introduce new compliance applications, or expand existing platforms.

Technology changes should therefore be assessed for their impact on compliance controls, testing requirements, data dependencies, and operational continuity.

The emergence of artificial intelligence introduces additional considerations.

Where AI tools are used to support compliance research, monitoring, documentation, or analysis, firms should evaluate data access, output validation, human oversight, and accountability.

The planning priority: Develop a technology improvement roadmap based on compliance risk and control effectiveness rather than system functionality alone.

For some firms, the most valuable investment may be a new platform. For others, it may involve improving existing rule governance, integrations, testing, or data management.

The right decision depends on whether technology is helping the compliance program operate reliably and transparently.

5. Do We Have Clear Ownership and Accountability Across the Compliance Lifecycle?

Many compliance weaknesses originate not from a lack of policies or technology, but from uncertainty about responsibility.

A compliance requirement may involve multiple teams.

Legal interprets the requirement. Compliance establishes the policy. Technology configures the system. Investment operations manages workflows. Business stakeholders execute activities subject to the control.

Each team may complete its assigned task without anyone maintaining responsibility for the effectiveness of the control as a whole.

This creates gaps during implementation, testing, exception management, and change.

For 2027, investment firms should examine whether accountability is clearly defined throughout the compliance lifecycle.

Key ownership questions

Who is responsible for interpreting a requirement and translating it into an operational control?
Who approves the configuration of compliance rules?
Who validates that controls function as intended before implementation?
Who investigates exceptions and determines whether escalation is necessary?
Who is responsible for maintaining documentation and evidence?
Who initiates reassessment when business activities or requirements change?

A practical approach is to establish a documented ownership model for material controls.

This may include a designated control owner, implementation responsibilities, testing expectations, escalation procedures, and approval authorities.

For example, a new client investment restriction may require coordination among portfolio management, compliance, operations, and technology.

Without clear ownership, the restriction could be documented in an investment management agreement but implemented inconsistently across accounts or systems.

With defined responsibilities, the firm can establish a repeatable process for interpretation, configuration, testing, approval, and ongoing monitoring.

The planning priority: Clarify ownership of critical controls and establish governance processes that remain effective across teams and organizational changes.

Accountability should extend beyond the initial implementation of a control. It should cover the control’s full operational lifecycle.

6. Are We Prioritizing the Right Compliance Risks for 2027?

Compliance resources are finite.

Firms must balance ongoing monitoring, annual reviews, examinations, remediation, technology initiatives, training, and changes to business activities.

An effective compliance strategy requires more than identifying everything that could be improved. It requires determining which initiatives deserve priority.

The SEC’s 2026 examination priorities highlighted core areas including fiduciary obligations, compliance program effectiveness, trading, portfolio management, valuation, disclosures, and custody, depending on the firm and examination scope.

These priorities provide useful context, but they should not replace a firm-specific assessment of risk.

A comprehensive planning process should consider several dimensions.

Business and investment risk

Have changes in investment strategies, portfolio complexity, client relationships, or operating structures created new compliance obligations?

Control effectiveness

Which existing controls have demonstrated weaknesses through testing, exceptions, or internal assessments?

Operational dependencies

Are critical compliance processes dependent on individuals, manual workflows, or systems that create continuity risks?

Examination readiness

Can the firm demonstrate that material risks have been identified, appropriate controls have been implemented, and identified deficiencies are being addressed?

Technology and change risk

Are upcoming migrations, integrations, automation initiatives, or AI deployments introducing additional governance requirements?

A risk-based prioritization framework can help translate these considerations into an actionable plan.

For example, an investment firm may identify three potential initiatives:

Reconfiguring outdated trading restrictions affecting multiple portfolios.
Automating a manual reporting process that consumes significant staff time.
Improving documentation for exception investigations.

All three may offer value.

However, the first may warrant immediate attention if inaccurate restrictions could permit prohibited transactions. The others may be prioritized according to their risk exposure, operational impact, and available resources.

The planning priority: Rank initiatives according to risk, control effectiveness, business impact, and implementation complexity.

A successful 2027 compliance plan should explain not only what the firm intends to improve, but why those improvements matter.

7. How Will We Measure Whether Our 2027 Compliance Plan Is Successful?

A compliance plan should establish more than a list of projects and deadlines.

It should define what meaningful improvement looks like.

Without clear measures of effectiveness, firms may complete planned initiatives without determining whether those efforts actually strengthened their compliance programs.

For example, implementing a new surveillance tool may be considered a successful technology project.

But did it improve the identification of relevant exceptions? Reduce unnecessary alerts? Strengthen escalation procedures? Improve the quality of compliance evidence?

Those outcomes are more informative than implementation alone.

Consider establishing measures across four areas

1. Control effectiveness

Track testing outcomes, recurring deficiencies, remediation completion, and the performance of material compliance controls.

2. Exception management

Evaluate exception volumes, root causes, investigation timelines, repeat occurrences, and escalation effectiveness.

3. Operational efficiency

Measure unnecessary manual interventions, reconciliation issues, workflow bottlenecks, and time required to retrieve compliance evidence.

4. Governance and accountability

Assess whether control ownership is documented, required reviews occur, changes are appropriately approved, and outstanding actions receive timely follow-up.

Metrics should be interpreted in context.

For example, an increase in reported exceptions does not necessarily indicate deteriorating compliance. It may reflect improved monitoring or more comprehensive detection.

Similarly, fewer alerts do not automatically mean lower risk if monitoring thresholds have been relaxed or data quality has declined.

The purpose of measurement is to support informed judgment, not simply to produce favorable statistics.

Firms should establish a manageable set of indicators that provide useful information about control performance and emerging risks.

The planning priority: Define measurable objectives, assign accountability, and establish periodic reviews to evaluate progress throughout 2027.

Compliance planning becomes more valuable when it supports continuous improvement rather than a once-a-year exercise.

Turning These Seven Questions Into an Actionable 2027 Compliance Plan

Answering these questions is only the beginning.

The next step is translating the findings into a coordinated program of improvements.

A practical approach involves four stages.

Stage 1: Assess the current environment

Review compliance testing, exception trends, audit findings, business changes, technology dependencies, and outstanding remediation activities.

Identify material weaknesses and recurring operational challenges.

Stage 2: Establish priorities

Evaluate potential initiatives according to risk exposure, business impact, dependencies, and available resources.

Distinguish immediate corrective actions from longer-term improvements.

Stage 3: Assign ownership and define outcomes

For each initiative, establish a responsible owner, expected deliverables, implementation milestones, testing requirements, and measures of success.

Ensure that compliance, operations, technology, and relevant business teams understand their responsibilities.

Stage 4: Monitor progress and adjust

Review implementation progress periodically, reassess emerging risks, and update priorities when circumstances change.

This approach helps ensure that compliance planning remains connected to operational reality.

It also creates a clearer record of how the firm identifies risks, makes decisions, allocates resources, and evaluates the effectiveness of improvements.

Frequently Asked Questions About 2027 Investment Compliance Planning

When should investment firms begin planning for 2027 compliance priorities?

Investment firms should begin assessing their compliance priorities before finalizing annual budgets and technology roadmaps. The final quarter of 2026 provides an opportunity to evaluate testing results, outstanding deficiencies, operational changes, and anticipated business initiatives. Planning should continue throughout 2027 as risks and circumstances evolve.

What should be included in an annual investment compliance plan?

An annual investment compliance plan should address material compliance risks, control testing, remediation activities, policy and procedure reviews, technology dependencies, training, ownership, and monitoring expectations. The scope should reflect the firm’s investment activities, applicable requirements, and operating model.

How do SEC examination priorities affect compliance planning?

SEC examination priorities provide insight into areas of supervisory interest, but they are not an exhaustive list of examination topics. Investment advisers should consider those priorities alongside their own risk assessments, compliance history, investment strategies, client relationships, and operational circumstances.

How can investment firms evaluate compliance program effectiveness?

Firms can evaluate effectiveness through documented testing, exception analysis, risk assessments, supervisory reviews, remediation tracking, and evidence demonstrating that controls operate as intended. The assessment should examine both the adequacy of policies and the effectiveness of their implementation.

What role should technology play in a 2027 compliance strategy?

Compliance technology should support reliable monitoring, consistent control execution, accurate data, traceable decisions, and efficient reporting. Firms should evaluate whether their existing systems remain appropriate and whether improvements to configuration, integration, testing, or governance would strengthen oversight.

Building a More Effective Compliance Program for 2027

The strongest compliance plans do not begin with a list of new initiatives.

They begin with a clear understanding of how the existing program operates, where risks are concentrated, and what needs to improve.

For investment firms, this requires looking beyond written policies to examine the relationship between requirements, technology, data, processes, and accountability.

It also requires recognizing that compliance effectiveness is not static.

As investment strategies, business structures, and operating models evolve, the controls supporting them must be evaluated and adapted.

By asking these seven questions before 2027 planning begins, firms can establish priorities grounded in operational evidence, direct resources toward meaningful risks, and build stronger foundations for ongoing oversight.

The objective is not simply to enter the new year with an updated compliance plan.

It is to enter 2027 with a clearer understanding of how the compliance program performs and a practical strategy for making it more effective.

How TillieStar Can Help

Developing an effective compliance strategy requires connecting regulatory requirements, investment activities, technology systems, and operational processes.

TillieStar specializes in helping investment organizations strengthen the systems and processes that support compliance oversight.

Whether your firm is evaluating existing controls, improving compliance rule governance, assessing technology effectiveness, preparing for a system transition, or addressing operational weaknesses, TillieStar brings investment compliance expertise to complex implementation and governance challenges.

Our approach emphasizes practical solutions that help firms improve control reliability, clarify accountability, and maintain defensible compliance processes.

Preparing your investment compliance program for 2027?

Contact TillieStar to discuss how your firm can assess its current environment, identify opportunities for improvement, and establish a more effective compliance technology and operations strategy.

Email: sales@tilliestar.com

Phone: (617) 865-3550