How to Keep Compliance Evidence With Published Content

Why Separated Records Slow Down an Examination

A registered investment adviser (RIA) can design a content workflow so that every published piece carries its own evidence. The approval record, the supporting sources, and the publication details sit in one folder with the content itself. The reason is practical. When a regulator asks about a piece, one folder answers the question.

Consider a hypothetical RIA that publishes a whitepaper on portfolio construction. The final PDF sits in a folder called "Published Materials." The approval record sits in another system called "Approval Records." The performance data sits in a third place.

An examiner from the Securities and Exchange Commission (SEC) asks for proof that the whitepaper was reviewed. The compliance officer searches three places. She then has to explain how the files connect. The examiner has to take her word for the links.

The SEC marketing rule requires RIAs to keep copies of advertisements they disseminate. It also requires records that support performance information, testimonials, endorsements, and third-party ratings. The rule does not say these records must share a folder. Keeping them together is a design choice. It makes each answer faster to find and easier to show.

The Core Structure: One Dossier per Asset

A usable workflow treats each published piece as a dossier. The dossier holds four things:

1. The final published version.
2. The approval record: who reviewed it, on what date, and what they approved.
3. The substantiation: performance data, research, and sources behind each claim.
4. The metadata: publication date, channels, and version number.

All four live in the same location. The marketing rule's own language points the same way. It describes review forms that are attached to the marketing piece, with copies of approvals kept by the firm. Attachment is the idea. The form belongs with the asset.

A Worked Example: A Retirement Income Podcast

Take a hypothetical RIA that publishes a weekly podcast on retirement income planning. The firm is an invented illustration, not a client of ours.

The Current State

The marketing director uploads each transcript to a content platform. The Chief Compliance Officer (CCO) approves it by email. The finance team checks any figures in a separate spreadsheet. The transcript and its approval live in different places.

The Redesigned State

Before publication, the firm builds one "Episode Dossier" per episode. It is a folder on a shared drive. It holds four items.

• The asset: the episode transcript, saved as a portable document format (PDF) file.
• The approval sign-off: a one-page form completed by the CCO.
• The substantiation: a subfolder of source documents. If the episode says women live longer than men, the folder holds the actuarial table or Centers for Disease Control and Prevention (CDC) data behind it. If the episode mentions a fee, the current fee schedule is attached.
• The metadata: a one-page index with the publication date, the channels used, the version number, and any disclaimer language.

During an examination, the compliance officer hands over one folder per episode. The examiner can see what was published, who approved it, which facts were checked, and when it went live. Nothing has to be reconstructed.

Designing the Storage Structure

A fixed folder structure lets both people and search software find records. One workable layout looks like this:

• Published Content
  • 2024 Podcast Series
    • Episode 001 Dossier
      • transcript.pdf
      • approval_form.pdf
      • substantiation
      • life_expectancy_source.pdf

• • • • fee_schedule.pdf
      • metadata.txt
    • Episode 002 Dossier
      • transcript.pdf
      • approval_form.pdf
      • substantiation
      • metadata.txt
  • 2024 Blog Posts
    • Each post follows the same dossier layout
  • 2024 Case Studies
    • Each case study follows the same dossier layout

Each content type gets a folder for each year. Each piece gets one dossier. Every dossier uses the same file names, so a reviewer knows where to look.

Tools such as Box, SharePoint, and Google Workspace can hold this structure. Consistency matters more than the tool. If one approval form is called "approval.pdf" and another is called "cco_signoff_final2.docx," a search will miss one of them.

The One-Page Approval Form

The approval form is short. A one-page form shows what was actually reviewed and what was not. A fifty-question checklist tends to hide that.

A template can list these fields, each on its own line:

• Asset title: [title of the piece]
• Asset type: [podcast, article, webinar, graphic, or other]
• Date created: [date]
• Submitted by: [name and role of the marketing owner]
• Reviewer: [reviewer's name and title]
• Date reviewed: [date]
• Claims reviewed: [each factual or performance claim, one per line]
• Source for each claim: [document name, date accessed, and where it is stored in the dossier]
• Concerns or changes requested: [notes, or "none"]
• Decision: [approved, approved with changes, or not approved]
• Sign-off: [signature or digital sign-off]

A reviewer can complete this in a few minutes for a short piece. It records which claims were reviewed and from which sources. If an examiner asks what evidence supported a claim, the answer is a named file in the same folder.

Where Substantiation Lives

Substantiation is the piece most often stored apart from the content. The marketing rule expects a firm to hold documentation that supports its claims, and a firm's own policies usually say who must supply it.

Keeping substantiation with the asset means the source folder is part of the dossier. Suppose an episode says a diversified portfolio has shown lower volatility over 20 years. The source folder for that claim holds:

• The data source, such as a research report or academic paper.
• The date the data was accessed.

• The specific figures cited.
• Any limits or caveats stated in the original source.

This is the specific artifact: the PDF, the screenshot, or the calculation. A link to a general database does not do the same job, because the page behind the link can change.

Performance figures need an extra step. Many firms route them through the accounting team. In that setup, accounting approves the numbers before use and keeps its own records. The dossier then holds both the figures and accounting's sign-off. If the firm reports under the Global Investment Performance Standards (GIPS), the dossier notes that as well.

Retention and Accessibility

The books-and-records rule sets a minimum retention period of five years for these records. It also expects them to be easy to access. How a firm applies that is a question for its compliance counsel. A workflow can still be built to make access simple.

In practice, easy access tends to mean four things:

• The dossier is not moved to cold storage where retrieval is slow.
• A new compliance officer can find a 2021 piece without a walkthrough.
• Metadata is written in plain language, not codes.
• Search works, through folder names, tags, or both.

Folders named by year and quarter, such as "2024_Q3," are easy to browse. Folders named by an internal approval sequence number are not.

The retention clock is generally counted from the last time an item was disseminated. A piece that stays on a website keeps its record live. Many firms track this in a calendar or spreadsheet so that nothing is deleted by accident.

Who Owns Each Step

A workflow works only when each step has an owner.

• Marketing owner: creates the piece and checks it against the marketing rule's general prohibitions, such as untrue statements and unsupported claims. Uploads the draft and sources to the dossier. Requests review.
• CCO: reviews the content against its substantiation within a set window, such as three business days. Completes the approval form and confirms the supporting files are present and labeled. Approves the piece or returns it with changes.
• Finance or accounting: for pieces that cite performance or fees, checks the figures against source records. Adds a sign-off to the form or to a separate page in the dossier.
• Publisher: posts the final asset on the agreed date. Updates the metadata file with the actual date and channels.

Each step needs a deadline. A request for review "as soon as possible" has no date to measure against. A written window makes a stalled piece easy to see.

Scaling Across Asset Types

An RIA often publishes in many formats: blog posts, podcasts, social posts, webinars, videos, and case studies. The same dossier structure fits all of them.

What changes is the depth of review. Higher-risk content gets more review steps. Examples include performance advertising, testimonials, and case studies built on real client situations. A short social post that links to an approved piece carries less risk than a whitepaper with historical returns.

A one-page content approval matrix can record these rules. It sits at the top of the Published Content folder. A firm might set it up like this:

• Blog post with performance data: full dossier with CCO and accounting approval.
• Podcast episode with general commentary: full dossier with CCO approval.
• Social post linking to approved content: minimal dossier. The form notes the link and states that no new claims were added.
• Video with a client testimonial: full dossier, plus a CCO check that required testimonial disclosures are present.

New team members read the matrix first. It tells them which dossier they are building.

What the Workflow Gives an Examiner

When an examiner asks about the firm's marketing, the firm can offer folders organized by year and type. Each folder holds self-contained dossiers. Questions about what was approved, by whom, and on what basis can be answered from the file itself.

This does not remove the need for review, and it does not predict how any examination will go. It changes where the evidence is kept. The evidence is created when the content is approved, and it stays with the content from then on.