How RIAs Fail Their Third-Party Vendor Risk Reviews

Last spring, a managing partner at a South Florida RIA got the letter every registered firm eventually receives: a standard SEC examination notification with a document request list due in 10 business days. He called me on day three.

The list included a request for his firm's cybersecurity policies, his incident response plan, and the item that stopped him cold: a written inventory of third-party service providers with access to client data.

He had 14 vendors touching client information: his portfolio management platform, two custodian portals, a CRM, a tax preparation tool, document storage, a cloud backup service, a secure email system, and the IT firm managing his office infrastructure. He had no written inventory, no security questionnaires on file, and service agreements from 2018 that said nothing about data handling. His exam wasn't a disaster, but he walked out with a deficiency letter on vendor oversight that took four months to remediate.

The SEC flagged third-party vendor oversight as a key examination focus in its 2024 and 2025 priorities letters. Rule 206(4)-9, the SEC's cybersecurity rule for investment advisers, puts vendor risk near the top of the examination checklist, and most firms with fewer than 25 employees arrive underprepared in the same three ways.

Key Takeaways

• Rule 206(4)-9 requires investment advisers to document their third-party vendor risk management process in writing. Having a process isn't enough without a paper record.
• SEC examiners often request a vendor inventory on day one of an exam; firms without one delay the exam and draw more scrutiny.
• A vendor that can't produce a current SOC 2 Type II report or equivalent attestation can't be included in your compliance documentation without compensating controls on your end.
• Firms with fewer than 25 employees face the same vendor risk documentation requirements as large advisers.
• Your custodian's security program covers their systems, not the portfolio tools, CRM, or tax software you've connected to them.

What the SEC's Vendor Risk Rule Requires of Advisers

The language in Rule 206(4)-9

Rule 206(4)-9 requires registered investment advisers to adopt and implement written policies and procedures reasonably designed to address cybersecurity risks. The rule specifically names service providers as a risk area: firms must have policies covering risks associated with service providers that receive, maintain, transmit, or process client information.

That's a broader category than most advisers expect. It includes your outsourced compliance consultant if they can access your files, your document shredding company if they handle physical client records, and any contractor with remote access to your systems. The test isn't what they're paid to do. It's whether they touch client data in any form.

The rule also requires an annual review of your cybersecurity policies and procedures. That review must be documented. An examiner who asks for your last vendor risk review wants a dated record of what you looked at, what you found, and what changed. A conversation you remember having at an all-hands meeting doesn't satisfy that requirement.

What SEC examiners request on day one

Based on SEC examination letters from 2024 and early 2025, examiners typically request: a list of all service providers with access to client data, copies of your written vendor risk policies, evidence of due diligence conducted before and after onboarding vendors, and copies of any security-related provisions in your service agreements. Some examination teams have also asked for the questionnaires firms sent to vendors and the responses they received.

Firms that can't produce these documents on the first request don't fail the exam automatically, but they do extend it. Examiners move to a more thorough review when documentation is thin, which means more time, more questions, and more exposure.

Actionable tip: Before your next exam, pull a list of every vendor that touches client data and confirm you have a dated SOC 2 Type II report on file for each one. Set a calendar reminder to refresh those reports annually.

The Three Vendor Risk Gaps SEC Examiners Find Most Often

No written vendor inventory

The most common gap is also the most basic: no documented list of which vendors have access to client data. Advisers often know their vendors by memory but haven't written the list down, assigned risk tiers, or noted what each vendor can access and under what conditions.

Without a written inventory, you can't conduct a meaningful annual review, you can't demonstrate due diligence to an examiner, and you have no baseline for catching it when an employee adds a new tool that should have gone through vendor review first. A spreadsheet with vendor name, data access type, last review date, and SOC 2 status covers the basics for most small firms.

No annual review documentation

Many firms conduct informal annual reviews but don't document them. An undocumented review gives you no protection in an examination. If your compliance calendar shows a vendor review in March, your examiner will ask for the record. "We talked about it" is not a record.

The review doesn't have to be a formal audit. For most small RIA vendors, it means confirming the vendor's current SOC 2 or equivalent report is on file, checking whether the vendor experienced any reported incidents in the past year, and noting whether anything in your service agreement needs updating. That's 20 minutes per vendor if your documentation is current going in.

Service agreements with no security requirements

Most small RIA service agreements predate the SEC's cybersecurity rule and say nothing meaningful about data security, breach notification timelines, or the vendor's obligation to maintain documented controls. An agreement that says "vendor will use reasonable efforts to protect client data" is not a security agreement.

What the agreement should include: a requirement that the vendor maintain written security policies, a breach notification timeline of 72 hours or less to align with the SEC's own 30-day reporting requirement, a right-to-audit clause, and a commitment to maintain SOC 2 or equivalent on an annual basis.

Actionable tip: When any vendor agreement comes up for renewal, add a data security addendum before you sign. Most major portfolio management and CRM vendors have standard addenda they'll provide on request.

How to Build a Vendor Inventory That Holds Up

Start with the vendors that matter most

You don't need to build a 50-row spreadsheet on day one. Start with the vendors where a breach would put the most client data at risk. For most small RIAs, those three are: your portfolio management platform, your CRM, and your document management system. Together, they likely account for 80 percent of your client data exposure. Getting their SOC 2 reports on file and service agreements updated gives you most of the protection before you move on to the rest of the list.

What to collect for each vendor

For every vendor in your inventory, you need four things: a current SOC 2 Type II report dated within the last 12 months, a signed service agreement with data security language, a completed vendor questionnaire for vendors without SOC 2, and a dated record of your last review. Some vendors, particularly smaller software companies, won't have SOC 2. For those, see the next section.

The custodian question

A common misconception is that your custodian's security program covers your firm by extension. It doesn't. Your custodian secures their own systems and the data they hold directly. The CRM you connect to their API, the portfolio tool that pulls data via export, and the tax software that imports account statements are your vendors, not theirs. Your custodian relationship doesn't substitute for vendor risk documentation on the tools you control.

If you're using a compliance management service, confirm that vendor risk documentation is explicitly in scope. Many compliance consultants focus on SEC-required policies and annual reviews without building out the full vendor inventory their clients need.

Ready to see where your vendor risk documentation stands? Schedule a free assessment with our team. We'll walk through your current vendor list, flag the documentation gaps, and show you exactly what your exam package needs to look like.

When Your Vendor Can't Prove Their Security

What to do when there's no SOC 2

Not every vendor has a SOC 2 Type II report. Smaller software tools, regional service providers, and newer platforms often haven't gone through the SOC 2 process, which typically costs between $30,000 and $80,000 and takes 6 to 12 months for first-time certification. If you're using a vendor without SOC 2, ask for alternative attestations before you decide what to do.

Alternative attestations worth requesting from your cybersecurity vendor review: a completed security questionnaire (the CSA CAIQ is a recognized standard), results from a recent third-party penetration test, a copy of their written information security policy, and confirmation of their cyber insurance coverage. A vendor who can't produce any of these should be flagged before you renew the agreement.

Document compensating controls when the vendor falls short

When a vendor can't meet the standard, document what you've done to reduce risk on your end. That might mean limiting the vendor's data access to what they need for their function, requiring multi-factor authentication on every account tied to that vendor, or routing all data transfers through encrypted channels. The documentation doesn't have to be long - it has to be specific and dated.

Actionable tip: Send a short security questionnaire to every vendor without SOC 2 during your annual review. Ten questions covering encryption practices, backup procedures, and incident notification is enough to show SEC examiners you conducted due diligence.

The Written Policies SEC Examiners Want to See

Your vendor risk management policy

Every RIA should have a standalone vendor risk management policy (or a clearly defined section within their broader cybersecurity policy) that covers: which types of vendors require review before onboarding, what documentation is required for each risk tier, how often reviews happen and who is responsible, and how gaps get escalated. The SEC's examination teams have noted that policies which are vague on vendor risk draw follow-up questions. A policy with specific timeframes and named responsibilities closes those questions before they're asked.

Contractual security requirements

Your service agreements are part of your vendor risk program, and examiners will ask to see them. For any agreement signed before 2024, it's worth adding a data security addendum before the next renewal. Your managed IT provider can help identify which agreements need updating and what language to include.

At minimum, your agreements with vendors that hold client data should require annual SOC 2 or equivalent reports, a breach notification window that gives you enough time to meet your own SEC reporting obligation, and a right-to-audit provision. Without a written notification requirement, a vendor has no contractual obligation to tell you quickly. If they take 45 days to report a breach involving your client data, you've already missed your 30-day reporting window to the SEC.

Annual review records

Your financial services compliance documentation isn't complete without dated records of your annual vendor reviews. Capture: the review date, which vendors were reviewed, whether their SOC 2 reports were current, any open issues from last year and their resolution, and sign-off from whoever conducted the review. Store these with your other SEC compliance files so you can produce them quickly when an exam notification arrives.

For a closer look at how data breach response connects to your vendor risk documentation, see our post on data breach response for financial advisors and CPA firms.

Actionable tip: Create a folder labeled "Vendor Risk - [Year]" at the start of each year. Drop your updated vendor inventory, each vendor's current SOC 2 report, completed questionnaires, and your annual review record into that folder. When an exam notification arrives, you can respond to the vendor risk section in under an hour.

Frequently Asked Questions

What counts as a covered vendor under the SEC cybersecurity rule?

Any service provider that receives, maintains, transmits, or processes client information is a covered vendor under Rule 206(4)-9. That includes technology vendors, outsourced compliance consultants, document management services, and any contractor with remote access to your systems. The line isn't about what they're paid to do - it's about whether they touch client data in any form.

Do I need to review every vendor annually or just the ones with client data access?

The SEC rule focuses on vendors that touch client data, so those are your priority. A reasonable approach is tiering: high-access vendors get a full annual review with updated SOC 2 reports; lower-access vendors get a lighter-touch review confirming there's been no reported incident and the service agreement is still current. Most small RIAs have five to fifteen vendors that qualify for the full review.

What happens if a vendor has a breach and we didn't have a written agreement requiring notification?

Without a written notification requirement, your vendor has no contractual obligation to tell you quickly. The SEC requires advisers to report significant cybersecurity incidents within 30 days. If your vendor takes 45 days to disclose a breach involving your client data, you've already missed your reporting window. Written notification language in your service agreement is the only way to protect yourself from that timing gap.

Does cyber insurance require vendor risk documentation too?

Yes, and requirements have tightened considerably since 2023. Most underwriters now ask for evidence of a vendor risk management process during renewal, and some require it as a coverage condition. Firms that show a written vendor inventory, annual reviews, and updated service agreements tend to get better rates. Those that can't often find third-party risk exclusions in their policies. Review your vendor documentation before the next renewal application. Our post on BEC fraud for financial advisors covers related coverage questions underwriters ask about email security.

How does FINRA's approach to vendor risk differ from the SEC's?

FINRA's cybersecurity guidance, primarily through Regulatory Notice 11-54 and subsequent examination findings, has consistently emphasized vendor oversight. The practical difference for most small broker-dealers: FINRA examiners have historically focused on vendor due diligence at onboarding, while SEC examiners under Rule 206(4)-9 place equal weight on ongoing monitoring and annual reviews. If you're dual-registered, you need both: initial due diligence at onboarding and documented annual reviews thereafter.

Build Vendor Risk Documentation Before the Letter Arrives

Most RIAs don't think about vendor risk documentation until an exam notification arrives. By then, you have 10 days to assemble a package that took your best-prepared competitors months to build. Our team works with financial advisers and CPA firms across South Florida on exactly this: written policies, vendor inventories, and service agreement language that satisfy both SEC examiners and cyber insurance underwriters.

Book a free assessment and let's look at your current vendor list together. You'll leave with a gap list and a clear set of next steps.