# Annual Compliance Review: [Adviser legal name], [Review period]

> Report of the annual review that an SEC-registered investment adviser
> must perform of the adequacy of its compliance policies and procedures
> and the effectiveness of their implementation, under SEC Rule
> 206(4)-7(b) under the Investment Advisers Act of 1940 (17 CFR
> 275.206(4)-7, text as restored by 89 FR 91252, 2024-11-19). Records of
> the review are kept under Rule 204-2(a)(17)(ii). The report follows a
> risk-based method: inventory the risks, test the controls, rate the
> findings, assign remediation and report to senior management. The
> example firm, Kestrel Bay Capital, is fictional. Replace every
> `[bracketed]` value and every row marked *Example*. Obtain the rule for
> the normative text. This is a document format, not legal, compliance
> or investment advice.

<!--
Guidance: How to use this template
- Rule 206(4)-7 has three parts: (a) written policies and procedures
  reasonably designed to prevent violations of the Advisers Act and its
  rules, (b) a review no less than annually of their adequacy and the
  effectiveness of their implementation, and (c) a Chief Compliance
  Officer (CCO) who administers them. This template is the record of (b).
- Rule history to state correctly: an August 2023 amendment had required
  every adviser to document the annual review in writing. The Fifth
  Circuit vacated the Private Fund Adviser Rules package, including that
  amendment, effective 2024-06-05, and the SEC removed the text from the
  CFR on 2024-11-19 (89 FR 91252). A written report is still the only
  practical way to evidence the review, and Rule 204-2(a)(17)(ii)
  requires keeping any records that document it.
- Fill section 2 (business and regulatory changes) and section 3 (risk
  inventory) before planning tests. The tests in section 4 should follow
  the risks, not last year's checklist.
- Use the code of ethics testing in section 4 together with the Code of
  Ethics (`compliance/investment-adviser-code-of-ethics`) and the
  reports in Personal Trading Report (`compliance/personal-trading-report`).
- Common pitfall: a review that only confirms policies exist. Examiners
  look for evidence that the CCO tested whether staff actually followed
  them, with samples, exceptions and follow-up.
-->

## Document control

<!-- Guidance: The report is privileged or confidential depending on how counsel is involved; decide before drafting. Keep each year's report for at least five years under Rule 204-2(e)(1). -->

| Field | Value |
|---|---|
| Document ID | [ACR-2026] |
| Firm | [Kestrel Bay Capital LLC] *(Example)* |
| SEC file number and CRD number | [801-XXXXX], [CRD XXXXXX] |
| Review period | [2025-10-01 to 2026-09-30] *(Example)* |
| Fieldwork dates | YYYY-MM-DD to YYYY-MM-DD |
| Reviewer | [Chief Compliance Officer / external compliance consultant] |
| Version | [1.0] |
| Status | [Draft / Management response / Final / Superseded] |
| Owner | [@chief-compliance-officer] |
| Approvers/reviewers | [@managing-partner], [@general-counsel], [fund boards where applicable] |
| Last updated | YYYY-MM-DD |
| Classification | [Confidential] |
| Retention | Five years from end of fiscal year of last entry, first two years in an appropriate office (Rule 204-2(e)(1)) |
| Prior review | [ACR-2025, issued YYYY-MM-DD] |

### Approvals

| Role | Name | Decision | Date |
|---|---|---|---|
| Chief Compliance Officer | [@name] | [Issued] | YYYY-MM-DD |
| Managing Partner (senior management) | [@name] | [Accepted, management responses agreed] | YYYY-MM-DD |
| General Counsel | [@name] | [Reviewed] | YYYY-MM-DD |
| Board of registered funds advised (Rule 38a-1 report, where applicable) | [@name] | [Received] | YYYY-MM-DD |

### Revision history

| Version | Date | Author | Change |
|---|---|---|---|
| 0.1 | YYYY-MM-DD | [@author] | Draft findings for management response |
| 1.0 | YYYY-MM-DD | [@author] | Final report issued |

## Contents

- [1. Scope, period and method](#1-scope-period-and-method)
- [2. Business and regulatory changes](#2-business-and-regulatory-changes)
- [3. Compliance risk inventory](#3-compliance-risk-inventory)
- [4. Testing by area](#4-testing-by-area)
- [5. Findings and ratings](#5-findings-and-ratings)
- [6. Remediation plan](#6-remediation-plan)
- [7. Policy and procedure amendments](#7-policy-and-procedure-amendments)
- [8. Follow-up of prior findings](#8-follow-up-of-prior-findings)
- [9. Conclusion and report to senior management](#9-conclusion-and-report-to-senior-management)
- [10. Evidence index](#10-evidence-index)
- [Glossary and references](#glossary-and-references)
- [Standard and licence note](#standard-and-licence-note)

## 1. Scope, period and method

<!-- Guidance: State what was reviewed, who did it, which entities and strategies are in scope and how tests were chosen. Questions to answer: are all advisory businesses covered, including sub-advised and model-delivery relationships? Were interim reviews done during the year? -->

This report covers the review of the compliance programme of [Kestrel
Bay Capital LLC] (the "Firm") for the period [2025-10-01 to
2026-09-30]. The Firm manages [separately managed accounts, four
private funds (Global Opportunities, Global Credit, Growth Partners II
and Growth Partners III) and one registered closed-end fund it advises,
Kestrel Bay Income Fund] *(Example)*, with regulatory assets under
management of [USD 2,480 million] *(Example)* as of [2025-12-31, the
date used in the last annual Form ADV amendment]. The EU affiliate,
Kestrel Bay Capital Europe, is a separately authorised firm with its
own compliance function; this review covers it only where staff,
systems or procedures are shared with the Firm. The review covers the compliance
manual, the code of ethics, and every policy adopted under Rule
206(4)-7(a), and how they were applied during the period.

The review was performed by [the CCO with two compliance analysts and
an external consultant for cybersecurity testing]. People who perform a
control did not test their own work; where the CCO performs a control
(for example, approving marketing material), the test was performed by
[the external consultant].

The method has five steps:

1. Identify changes in the business and in regulation during the period
   (section 2).
2. Update the compliance risk inventory and rate each risk for
   likelihood and impact before controls (section 3).
3. Select tests for each area, with sample sizes scaled to the residual
   risk, and run them on period data (section 4).
4. Rate each finding, agree remediation with owners and amend policies
   where the design is inadequate (sections 5 to 7).
5. Follow up prior findings and report the conclusion to senior
   management (sections 8 and 9).

```mermaid
gantt
  title Annual review timeline (Example)
  dateFormat YYYY-MM-DD
  section Planning
  Changes and risk inventory     :a1, 2026-09-01, 14d
  Test plan approved              :a2, after a1, 3d
  section Fieldwork
  Testing by area                 :b1, 2026-09-18, 28d
  Exceptions confirmed with owners:b2, after b1, 7d
  section Reporting
  Draft report and responses      :c1, after b2, 7d
  Final report to senior management :milestone, c2, 2026-10-30, 0d
```

Sample sizes used in this review *(Example)*:

| Residual risk | Minimum sample per test | Population basis |
|---|---|---|
| High | 25 items or the full population if smaller | Period population |
| Medium | 15 items | Period population |
| Low | 5 items or a walkthrough | Period population |

These sample sizes are the Firm's own convention, not a regulatory
requirement. Increase them where a test finds exceptions.

## 2. Business and regulatory changes

<!-- Guidance: List every change that could make a policy out of date. Questions to answer: new strategies, products, clients, vendors, systems, offices or key staff? Which new rules took effect in the period, and which are coming? Label proposals as proposals. Facts below are as of 2026-10; check sec.gov and the Federal Register for current status. -->

### 2.1 Business changes

| Change ID | Change | Date | Policies affected | Addressed |
|---|---|---|---|---|
| BCH-001 *(Example)* | Launch of private credit fund, Kestrel Bay Global Credit Fund LP (disclosed in the brochure of 2026-03-27 as MC-2026-004) | 2026-02-01 | Valuation, allocation, custody, marketing | Yes: valuation policy amended 2026-01-20 |
| BCH-002 *(Example)* | New order management system | 2026-05-15 | Trading, books and records, code of ethics surveillance | Partly: see finding FND-004 |
| BCH-003 *(Example)* | Shared trading desk with the existing EU affiliate Kestrel Bay Capital Europe: its traders and analysts gain access to the Firm's order management system | 2026-07-01 | Code of ethics Annex B and access person register, conflicts, intra-group services agreement | Yes |
| BCH-004 *(Example)* | Departure of head of trading | 2026-08-31 | Best execution committee membership | Yes |

### 2.2 Regulatory changes and status

| Reg ID | Item | Status as of 2026-10 | Effect on the Firm |
|---|---|---|---|
| REG-001 | Regulation S-P amendments (2024): incident response programme, customer notification within 30 days of becoming aware of a breach of sensitive information, service provider oversight | Compliance dates 2025-12-03 (larger entities) and 2026-06-03 (smaller entities) | [Programme adopted; tested in area A10] |
| REG-002 | Marketing Rule 206(4)-1 staff FAQs (2025-03-19, extracted performance and portfolio characteristics) and Division of Examinations risk alert (2025-12-16, testimonials, endorsements, third-party ratings) | Guidance in effect; further staff FAQs posted 2026-01-15 (use of model fees; persons subject to SRO final orders) | [Marketing procedures updated; tested in area A6] |
| REG-003 | Form PF amendments (2024) | Compliance date extended from 2026-10-01 to 2027-07-01 (91 FR 56593, 2026-09-03). A further SEC and CFTC Form PF proposal (91 FR 22232, 2026-04-24) is a proposal only | [Applies to private fund reporting; project planned] |
| REG-004 | FinCEN rule applying AML programme requirements to investment advisers | Effective date 2028-01-01 (FinCEN final rule delaying the date, 91 FR 36, 2026-01-02). FinCEN AML/CFT programme reform proposal (91 FR 18704, 2026-04-10) is a proposal only | [Readiness assessment in area A13] |
| REG-005 | Investment Company Act names rule amendments (Rule 35d-1) | Compliance dates reported as 2026-06-11 (larger fund groups) and 2026-12-11 (smaller); confirm on sec.gov | [Applies to Kestrel Bay Income Fund, the registered fund the Firm advises] |
| REG-006 | Withdrawal of 14 SEC proposals on 2025-06-12, including the safeguarding (custody) proposal and the predictive data analytics proposal | Withdrawn; the current custody rule 206(4)-2 continues to apply | [No change to custody procedures] |
| REG-007 | Proposal to amend the performance-based compensation rule 205-3 (91 FR 63676, 2026-10-06) | Proposal only; comment period open | [Monitor; no action] |
| REG-008 | SEC order adjusting the Rule 205-3 qualified client tests for inflation (91 FR 23520, 2026-05-01) | Final; effective 2026-06-29: USD 1,400,000 under management (was 1,100,000) or net worth above USD 2,700,000 (was 2,200,000), for contracts entered on or after that date | [Subscription documents and investor eligibility checks for the private funds updated 2026-06-15; tested in A4, T-A4-03] |

Record any state, non-US or self-regulatory changes that also apply, such
as rules for the EU affiliate under MiFID II as currently in force.

## 3. Compliance risk inventory

<!-- Guidance: A risk inventory explains why tests were chosen. Rate inherent risk from the Firm's business, then judge the control environment and the residual risk. Keep the scale simple and reuse it every year so trends are visible. Generic methods are in Risk Methodology (`compliance/risk-methodology`); the Firm's enterprise risks are in Risk Register (`compliance/risk-register`). -->

Scale *(Example)*: likelihood and impact each 1 (low) to 3 (high);
inherent score is likelihood multiplied by impact, from 1 to 9. Scores
of 6 or 9 are high, 3 or 4 medium, 1 or 2 low. Control strength is
strong, adequate or weak, and residual risk is the inherent rating
lowered one level for a strong control environment, unchanged for
adequate and raised one level (to a maximum of high) for weak.

| Risk ID | Area | Risk | L | I | Inherent | Controls | Residual |
|---|---|---|---|---|---|---|---|
| RSK-001 *(Example)* | Allocation | New private credit fund and SMAs compete for the same deals; unfair allocation | 3 | 3 | 9 High | Allocation policy, committee minutes | High (controls adequate, new process) |
| RSK-002 *(Example)* | Valuation | Level 3 private credit marks are stale or biased | 2 | 3 | 6 High | Independent valuation committee, third-party review | Medium (strong) |
| RSK-003 *(Example)* | Marketing | Performance shown without required net figures or with unsupported testimonials | 2 | 2 | 4 Medium | Pre-use review | Medium (adequate) |
| RSK-004 *(Example)* | Code of ethics | Front running by access persons after system change | 2 | 3 | 6 High | Pre-clearance, broker feeds | High (feeds incomplete, see FND-004) |
| RSK-005 *(Example)* | Privacy and cyber | Breach of client data; late customer notice | 2 | 3 | 6 High | Incident response programme | Medium (strong) |
| RSK-006 *(Example)* | Custody | Client assets at an unqualified custodian; missed audit delivery | 1 | 3 | 3 Medium | Annual audit approach for funds | Low (strong) |
| RSK-007 *(Example)* | Fees | Billing errors on SMAs; performance fees charged to investors who are not qualified clients | 2 | 2 | 4 Medium | Automated billing, quarterly sample, subscription eligibility check | Medium (adequate) |

Check the arithmetic: RSK-001 is 3 x 3 = 9; RSK-003 is 2 x 2 = 4;
RSK-006 is 1 x 3 = 3. Each residual follows the rule above.

How to rate control strength. Rate the control environment for each
risk on evidence, not on the existence of a policy. A control is
strong when it is automated or preventive, has run for at least a full
review cycle without exceptions, has a named owner and an independent
check, and was retested this year. It is adequate when it is designed
to address the risk but relies on manual steps, is new (as with the
allocation committee for private credit), or produced minor exceptions
that were corrected. It is weak when a test found it missing or not
operating, when it depends on one person with no back-up, or when a
business change (a new system, product or office) has not yet been
reflected in it. Record the evidence for each rating in the risk
inventory working file (EVD-001), so that next year's reviewer can see
why the rating moved.

Two errors are common. The first is rating likelihood from the Firm's
own history only: a risk that has not crystallised at the Firm may
still be likely given the strategy, the number of transactions or the
enforcement record in the industry. The second is lowering residual
risk for controls that were not tested in the period. If a control was
not tested, carry it at adequate at most and schedule a test.

## 4. Testing by area

<!-- Guidance: One row per test with the population, the sample, what was compared and the result. Keep the test IDs stable across years so trends can be followed. The areas follow the topics the SEC has said compliance policies should address in the 2003 adopting release of Rule 206(4)-7, plus areas added by later rules. -->

| Area | Topic | Residual risk | Tests run |
|---|---|---|---|
| A1 | Portfolio management: suitability, mandate restrictions, investment guidelines | Medium | T-A1-01, T-A1-02 |
| A2 | Trading, best execution and soft dollars | Medium | T-A2-01, T-A2-02 |
| A3 | Trade allocation and aggregation | High | T-A3-01, T-A3-02 |
| A4 | Valuation of client holdings, fee calculations and performance fee eligibility | Medium | T-A4-01 to T-A4-03 |
| A5 | Custody and safeguarding of client assets | Low | T-A5-01 |
| A6 | Marketing and performance advertising | Medium | T-A6-01, T-A6-02 |
| A7 | Code of ethics and personal trading | High | T-A7-01 to T-A7-04 |
| A8 | Disclosures: Form ADV, brochure delivery, Form CRS where applicable | Medium | T-A8-01, T-A8-02 |
| A9 | Books and records | Medium | T-A9-01 |
| A10 | Privacy, Regulation S-P and cybersecurity | Medium | T-A10-01, T-A10-02 |
| A11 | Proxy voting | Low | T-A11-01 |
| A12 | Business continuity and succession | Low | T-A12-01 |
| A13 | Anti-money laundering readiness (FinCEN rule effective 2028-01-01) | Medium | T-A13-01 |
| A14 | Political contributions (pay-to-play) | Low | T-A14-01 |
| A15 | Regulatory filings (Form ADV, Form PF, Form 13F, Schedule 13G) | Medium | T-A15-01 |

Test results:

| Test ID | Test | Population | Sample | Exceptions | Result | Finding |
|---|---|---|---|---|---|---|
| T-A1-01 *(Example)* | Post-trade guideline checks: breaches detected and resolved | 412 alerts | 25 | 0 | Effective | None |
| T-A2-01 *(Example)* | Best execution committee met quarterly with transaction cost analysis | 4 meetings | 4 | 0 | Effective | None |
| T-A3-01 *(Example)* | Private credit allocations followed the documented pro rata rule | 18 deals | 18 | 2 | Not effective | FND-001 |
| T-A4-01 *(Example)* | Level 3 marks approved by valuation committee with support | 64 positions per quarter | 25 | 0 | Effective | None |
| T-A4-02 *(Example)* | Management fee billing recomputed for SMAs | 1,140 invoices | 25 | 1 | Partly effective | FND-002 |
| T-A4-03 *(Example)* | Private fund investors admitted on or after 2026-06-29 met the new qualified client thresholds; earlier admissions met the thresholds then in force | 46 subscriptions | 15 | 0 | Effective | None |
| T-A5-01 *(Example)* | Fund audited financial statements delivered to investors within the required period (Global Credit Fund has not yet completed its first fiscal year) | 3 funds | 3 | 0 | Effective | None |
| T-A6-01 *(Example)* | Advertisements pre-approved and performance shown net of fees with required periods | 96 items | 25 | 3 | Partly effective | FND-003 |
| T-A7-01 *(Example)* | Initial and annual holdings reports on time and within 45-day data window | 38 access persons | 38 | 1 | Partly effective | FND-005 |
| T-A7-02 *(Example)* | Every personal trade had valid pre-clearance | 610 trades | 25 | 0 | Effective | None |
| T-A7-03 *(Example)* | Broker feeds cover every reported account after system migration | 71 accounts | 71 | 6 | Not effective | FND-004 |
| T-A7-04 *(Example)* | IPO and limited offering pre-approvals recorded with reasons | 3 approvals | 3 | 0 | Effective | None |
| T-A8-01 *(Example)* | Annual Form ADV amendment filed within 90 days of fiscal year end | 1 filing | 1 | 0 | Effective | None |
| T-A8-02 *(Example)* | Brochure or summary of material changes delivered to clients within 120 days of fiscal year end | 214 clients | 25 | 0 | Effective | None |
| T-A10-01 *(Example)* | Incident response tabletop exercise held and lessons tracked | 1 exercise | 1 | 0 | Effective | None |
| T-A10-02 *(Example)* | Service provider contracts include breach notice duties | 22 providers | 15 | 2 | Partly effective | FND-006 |
| T-A13-01 *(Example)* | AML readiness gap assessment completed and board informed | 1 assessment | 1 | 0 | Effective | None |
| T-A14-01 *(Example)* | Political contributions pre-cleared and logged | 5 contributions | 5 | 0 | Effective | None |

### 4.1 Test design notes by area

Portfolio management (A1). Compare each account's holdings and trades
with its investment guidelines and client restrictions. Test whether
breaches found by the pre-trade or post-trade system were escalated,
corrected and, where a client lost money, made whole. Read a sample of
client files to confirm that the stated objectives are current.

Trading and allocation (A2, A3). Recompute allocations for aggregated
orders and for limited opportunities such as new issues and private
deals, and compare them with the documented rule. Look at whether
partial fills were shared pro rata, whether any account was favoured
repeatedly, and whether the best execution committee reviewed broker
quality, costs and any research paid for with client commissions.

Valuation and fees (A4). Trace a sample of hard-to-value positions to
the valuation committee minutes and the supporting evidence, and look
for stale prices that did not change for several periods. Recompute fees
from the advisory agreement, the asset base and the billing period, and
check that performance fees follow the agreement and the conditions of
Rule 205-3 where they apply.

Marketing (A6). Sample advertisements across channels, including web
pages, social media posts by staff and pitch books. Confirm pre-use
approval, the presence of net performance for the required periods,
support for every factual claim, and disclosures for testimonials,
endorsements and third-party ratings. Keep the records Rule 204-2
requires for performance and for advertisements.

Code of ethics (A7). Test the timeliness and completeness of reports,
the pre-clearance trail, coverage of broker feeds and the review of the
CCO's own trading by someone else. Compare personal trades with client
trades over a window around each trade.

Privacy and cybersecurity (A10). Confirm the incident response
programme required by the amended Regulation S-P exists, was tested and
covers service providers. Review access rights for leavers, multi-factor
authentication coverage and the results of any penetration test.

Custody (A5). Confirm the basis on which the Firm has custody (fee
deduction, general partner of the private funds) and that the audit
approach for each fund was followed: the auditor is registered with and
inspected by the PCAOB, audited statements reached every investor
within the deadline, and the Global Credit Fund has an audit engagement
for its first fiscal year. Trace a sample of standing letters of
authorisation to the custodian's records.

Disclosures (A8). Compare the brochure with Form ADV Part 1A and the
facts found in the other tests. Check that the 2026-03-27 brochure
disclosed the launch of the private credit fund, that the brochure
summary of the code of ethics matches the code, that every client in
the sample received the brochure or summary of material changes within
120 days, and that new clients received it before or at signing. Where
the Firm serves retail investors, repeat the check for Form CRS.

Books and records (A9). Select a sample of required records from Rule
204-2 (order memoranda, written communications, advertisements,
performance support, code of ethics records) and confirm each can be
produced promptly, in the stated format and from the stated system.
Test that the order management system migration kept complete history.

Proxy voting (A11). Reconcile a sample of votes cast with the policy
and with the proxy adviser's recommendations, review the conflict log
and confirm that the Firm checked the proxy adviser's capacity and
methodology during the year. Confirm that the registered fund's voting
record was filed on Form N-PX.

Business continuity (A12). Review the result of the last continuity
test, the succession plan for key persons (the departure of the head of
trading in BCH-004 is a live example) and whether vendors that are
critical to trading and valuation have tested their own plans.

Political contributions (A14). Compare the contribution log with a
search of public campaign finance databases for covered associates,
confirm that new hires disclosed past contributions with the correct
look-back, and confirm that no government entity client was billed
during a time-out period.

Readiness areas (A13, A15). For rules with future dates, the test is
whether the Firm has a plan, an owner and a budget, not whether it
already complies. Record the gap assessment and the date by which each
gap will be closed.

For each test, keep the working paper with the population source, the
sample selection method, the items tested and the evidence seen. A
generic layout is in Control Testing Workpaper
(`compliance/control-testing-workpaper`).

## 5. Findings and ratings

<!-- Guidance: Write each finding as condition, criteria, cause, effect and recommendation. Separate design gaps (the policy does not address the risk) from operating gaps (the policy is right but was not followed). Common pitfall: rating everything medium; use the scale. -->

Rating scale *(Example)*:

| Rating | Meaning | Expected remediation |
|---|---|---|
| High | Actual or likely client harm, a probable rule violation, or a control absent for a high risk | Within 30 days; reported to senior management at once |
| Medium | Control weakness that could lead to a violation if not fixed | Within 90 days |
| Low | Documentation or efficiency improvement | Within 180 days |

| Finding ID | Area | Type | Condition | Criteria | Cause | Effect | Rating | Owner |
|---|---|---|---|---|---|---|---|---|
| FND-001 *(Example)* | A3 | Operating | 2 of 18 private credit deals allocated outside the pro rata rule without documented reasons | Allocation policy section 4 | Deal team used commitment size of a new SMA before account was funded | Possible unfair treatment of private fund investors | High | [@cio] |
| FND-002 *(Example)* | A4 | Operating | One SMA billed on gross instead of net assets | Advisory agreement fee basis | Manual override after account restructure | Overbilling of USD 1,850 *(Example)* | Medium | [@coo] |
| FND-003 *(Example)* | A6 | Operating | 3 of 25 advertisements lacked one of the required net performance periods | Rule 206(4)-1(d)(2) | Marketing used an older layout | Rule breach risk | Medium | [@head-of-marketing] |
| FND-004 *(Example)* | A7 | Design | 6 of 71 personal accounts not connected to broker feeds after system migration | Code of ethics section 5 | Migration plan omitted compliance feeds | Personal trades not surveilled | High | [@cco] |
| FND-005 *(Example)* | A7 | Operating | One annual holdings report submitted 6 days late | Rule 204A-1(b)(1)(ii)(B) and code section 5 | Reminder sent to old email address | Late report | Low | [@cco] |
| FND-006 *(Example)* | A10 | Design | 2 of 15 sampled provider contracts lack breach notice duties | Regulation S-P service provider oversight | Contracts signed before policy update | Notice to clients may be late | Medium | [@general-counsel] |

Summary by rating:

| Rating | Count | Finding IDs |
|---|---|---|
| High | 2 | FND-001, FND-004 |
| Medium | 3 | FND-002, FND-003, FND-006 |
| Low | 1 | FND-005 |
| Total | 6 | |

Arithmetic check: 2 + 3 + 1 = 6 findings, matching the six rows above.

## 6. Remediation plan

<!-- Guidance: Every finding gets an owner, an action and a date. Track closure with evidence; the CCO, not the owner, closes the item. Use Risk Treatment Plan (`compliance/risk-treatment-plan`) if the Firm tracks actions there. -->

Due dates follow the rating scale in section 5 and run from the date of
the final report (2026-10-30 in this example): High findings within 30
days (by 2026-11-29, so ACT-001 is due 2026-11-27 and ACT-004
2026-11-15), Medium within 90 days (by 2027-01-28) and Low within 180
days (by 2027-04-28). An owner who cannot meet the date asks the CCO
for an extension in writing before it passes, with a reason and an
interim control; the extension is reported to senior management with
the next progress update.

| Action ID | Finding | Action | Owner | Due | Status | Evidence of closure |
|---|---|---|---|---|---|---|
| ACT-001 *(Example)* | FND-001 | Re-run the two allocations; compensate affected fund if harmed; require committee sign-off for any departure from pro rata | [@cio] | 2026-11-27 | Open | Re-allocation analysis; committee minutes |
| ACT-002 *(Example)* | FND-002 | Refund USD 1,850 with interest; add a monthly report of manual billing overrides | [@coo] | 2026-12-15 | Open | Refund confirmation; override report |
| ACT-003 *(Example)* | FND-003 | Withdraw and replace the three items; update layout template; retrain marketing staff | [@head-of-marketing] | 2026-11-15 | In progress | New template; training record |
| ACT-004 *(Example)* | FND-004 | Connect the six accounts; obtain statements for the gap period and review trades retroactively | [@cco] | 2026-11-15 | In progress | Feed list; retroactive review memo |
| ACT-005 *(Example)* | FND-005 | Correct HR data feed for compliance reminders | [@cco] | 2027-01-31 | Open | System change ticket |
| ACT-006 *(Example)* | FND-006 | Amend the two contracts or obtain side letters | [@general-counsel] | 2027-01-15 | Open | Signed amendments |

## 7. Policy and procedure amendments

<!-- Guidance: List every policy change the review leads to, including changes made during the year. A design finding should normally result in an amendment. -->

Each amendment goes through the same approval route as the original
policy, is communicated to the staff it affects with a short summary of
what changed, and is reflected in training. Where a policy change also
changes what clients are told, for example the allocation policy for
private credit, check whether the brochure needs an other-than-annual
amendment. Update the evidence index with the approved version.

| Policy | Section | Change | Reason | Approved | Effective |
|---|---|---|---|---|---|
| Allocation policy *(Example)* | 4 | Departures from pro rata require written committee approval before trade | FND-001 | YYYY-MM-DD | YYYY-MM-DD |
| Code of ethics *(Example)* | 5 | Compliance must confirm feed coverage before any system migration goes live | FND-004 | YYYY-MM-DD | YYYY-MM-DD |
| Vendor management *(Example)* | 3 | Standard breach notice clause for providers handling client information | FND-006, REG-001 | YYYY-MM-DD | YYYY-MM-DD |
| Code of ethics Annex B *(Example)* | Annex B and section 1 | EU affiliate traders and analysts with access to the shared order management system added to the access person register; Annex B mapping applied to them | BCH-003 | YYYY-MM-DD | 2026-07-01 |

## 8. Follow-up of prior findings

<!-- Guidance: Show what happened to last year's findings. A repeat finding is more serious than a new one and should be rated at least one level higher. -->

| Prior finding | Description | Prior rating | Status | Repeat in this period | Comment |
|---|---|---|---|---|---|
| FND-2025-002 *(Example)* | Late quarterly transaction reports | Low | Closed 2026-01-15 | No | Reminder automation effective |
| FND-2025-004 *(Example)* | Testimonials without required disclosures | Medium | Closed 2026-03-31 | Partly (FND-003 is a related layout issue) | Watch in next review |
| FND-2025-005 *(Example)* | Business continuity plan not tested | Medium | Closed 2026-05-20 | No | Test held 2026-05-12 |

## 9. Conclusion and report to senior management

<!-- Guidance: Give a clear conclusion on adequacy (design) and effectiveness (operation). Avoid unqualified assurance; state what the conclusion rests on. Where the Firm advises registered funds, the fund CCO's annual report to the fund board under Investment Company Act Rule 38a-1 may draw on this review. -->

Based on the tests in section 4 and the follow-up in section 8, the CCO
concludes that the Firm's policies and procedures were [reasonably
designed, except for the allocation process for private credit and the
code of ethics surveillance after the system migration] *(Example)*,
and were [effectively implemented, except for the findings listed in
section 5] during the review period. The two high-rated findings were
reported to the Managing Partner on [YYYY-MM-DD] and remediation is
tracked in section 6.

This conclusion rests on sample testing and is not a guarantee that no
violation occurred. The review did not include [areas excluded and
why]. The CCO will report progress on open actions to senior management
[monthly] until closure, and the next annual review will retest areas
A3, A6 and A7 with larger samples.

Key messages for senior management *(Example)*:

1. Allocation of scarce private credit deals is the highest risk this
   year; the new committee approval step should be in place before the
   next fund closing.
2. System migrations need a compliance sign-off; the order management
   change created a gap in personal trading surveillance.
3. Regulatory workload is rising: Form PF changes by 2027-07-01 and the
   AML programme rule by 2028-01-01 need budget in the next plan.

## 10. Evidence index

<!-- Guidance: Rule 204-2(a)(17)(ii) requires keeping any records documenting the annual review. Index every working paper so an examiner can trace each conclusion to evidence. -->

| Evidence ID | Description | Test or finding | Location | Retention until |
|---|---|---|---|---|
| EVD-001 *(Example)* | Risk inventory working file | Section 3 | [Compliance drive path] | YYYY-MM-DD |
| EVD-002 *(Example)* | Allocation sample and recomputation | T-A3-01, FND-001 | [Path] | YYYY-MM-DD |
| EVD-003 *(Example)* | Billing recomputation | T-A4-02, FND-002 | [Path] | YYYY-MM-DD |
| EVD-004 *(Example)* | Advertisement review sample | T-A6-01, FND-003 | [Path] | YYYY-MM-DD |
| EVD-005 *(Example)* | Broker feed coverage reconciliation | T-A7-03, FND-004 | [Path] | YYYY-MM-DD |
| EVD-006 *(Example)* | Senior management meeting minutes with report presentation | Section 9 | [Path] | YYYY-MM-DD |

Traceability: every risk in section 3 has at least one test in section 4
or an explained reason for no test; every exception has a finding;
every finding has an action; every action has evidence of closure.

| Risk ID | Test IDs | Finding IDs | Action IDs |
|---|---|---|---|
| RSK-001 *(Example)* | T-A3-01, T-A3-02 | FND-001 | ACT-001 |
| RSK-002 *(Example)* | T-A4-01 | None | None |
| RSK-003 *(Example)* | T-A6-01, T-A6-02 | FND-003 | ACT-003 |
| RSK-004 *(Example)* | T-A7-01 to T-A7-04 | FND-004, FND-005 | ACT-004, ACT-005 |
| RSK-005 *(Example)* | T-A10-01, T-A10-02 | FND-006 | ACT-006 |
| RSK-006 *(Example)* | T-A5-01 | None | None |
| RSK-007 *(Example)* | T-A4-02, T-A4-03 | FND-002 | ACT-002 |

## Glossary and references

<!-- Guidance: Define terms the board and senior management may not use daily. -->

| Term | Meaning |
|---|---|
| Adequacy | Whether a policy, as written, addresses the risk it targets (design) |
| Effectiveness | Whether the policy was applied as written during the period (operation) |
| CCO | Chief Compliance Officer designated under Rule 206(4)-7(c) |
| Inherent risk | Risk before considering the Firm's controls |
| Residual risk | Risk remaining after controls |
| Finding | A condition where practice or design falls short of the criteria |
| Access person | Person covered by personal reporting under Rule 204A-1 |
| Regulatory assets under management | Assets reported in Form ADV Part 1A Item 5.F |

References (check the current official versions):

- SEC Rule 206(4)-7, 17 CFR 275.206(4)-7 (compliance procedures and practices), eCFR; adopting release IA-2204 (2003).
- Technical amendments reflecting the vacatur of the Private Fund Adviser Rules, 89 FR 91252 (2024-11-19).
- SEC Rule 204-2, 17 CFR 275.204-2, paragraphs (a)(17) and (e)(1).
- SEC Rule 204A-1 (code of ethics), Rule 206(4)-1 (marketing), Rule 206(4)-2 (custody), Rule 206(4)-5 (political contributions), Rule 206(4)-6 (proxy voting).
- Investment Company Act Rule 38a-1 (fund compliance programmes).
- Regulation S-P amendments (2024), compliance dates 2025-12-03 and 2026-06-03.
- SEC, Investment Adviser Performance-Based Compensation Modernization, proposed rule, 91 FR 63676 (2026-10-06).
- FinCEN final rule delaying the investment adviser AML programme effective date to 2028-01-01, 91 FR 36 (2026-01-02); FinCEN AML/CFT programme reform proposal, 91 FR 18704 (2026-04-10), proposal only.
- SEC order adjusting the Rule 205-3 dollar amount tests, 91 FR 23520 (2026-05-01), effective 2026-06-29.
- Form PF compliance date extension, 91 FR 56593 (2026-09-03).
- SEC Division of Investment Management, Marketing Compliance FAQs (updated 2025-03-19 and 2026-01-15).
- Related templates: Code of Ethics (`compliance/investment-adviser-code-of-ethics`), Form ADV Part 2A Brochure (`compliance/form-adv-part-2a-brochure`), Proxy Voting Policy (`compliance/proxy-voting-policy`), Best Execution Policy (`compliance/best-execution-policy`), Marketing Review Checklist (`compliance/marketing-review-checklist`), Valuation Policy (`compliance/valuation-policy`).

## Standard and licence note

Based on SEC Rules 206(4)-7 and 204-2 under the Investment Advisers Act
of 1940 as published in the electronic Code of Federal Regulations and
the Federal Register (US federal works, public domain). Rule numbers
and Federal Register citations are given and requirements are described
in original wording; no regulatory text is reproduced. Dates of later
rules and proposals are stated as of 2026-10 and some were confirmed
only through secondary sources, as marked. Kestrel Bay Capital and every
example row are fictional. Check the current rule texts, SEC staff
guidance and the Federal Register before use. This is a document
format, not legal, compliance or investment advice. Template licence:
MIT.