What the Data Says About Compliance Governance Risk

Convergence’s analysis of 7,106 investment manager groups found that 22 percent have one person serving as both CEO and CCO. That arrangement may be practical at formation. It becomes a governance risk as complexity grows, and complexity always grows. The SEC knows this. Examiners look for it. Allocators and auditors are starting to measure it. Convergence has been tracking it across the full market for years.

The Finding

In Convergence's analysis of 7,106 investment manager groups, 1,563 have one person serving simultaneously as Chief Executive Officer and Chief Compliance Officer. That is 22 percent of the population, and it represents one of the more consequential governance arrangements in the investment management industry, not because it is rare but because it is common enough to be treated as unremarkable.

The CEO role carries responsibility for strategy, capital allocation, investor relationships, business development, and organizational leadership. The CCO role carries responsibility for compliance program design and oversight, regulatory filing accuracy, examination readiness, and the ongoing monitoring of a regulatory environment that has added material new obligations every year for the past decade. Both functions are full-time jobs at a firm of any meaningful complexity. At 22 percent of manager groups, they are the same job, held by the same person.

Convergence tracks this arrangement across the full population of SEC-registered investment advisers because it is visible in Form ADV disclosures and because it is a governance signal that scales in risk as the firm around it grows.

Why This Arrangement Exists and When It Makes Sense

The combined CEO and CCO role is not a governance failure at formation. It is a practical response to the resource constraints of an early-stage investment management firm. Compliance obligations at launch are manageable, regulatory filings are straightforward, and a capable founder with compliance awareness can hold both functions without creating material risk. Many firms begin this way and begin it reasonably.

The problem is not the arrangement. It is the assumption that the arrangement does not require revisiting as the firm around it changes.

A firm that has added fund strategies, taken on institutional capital, expanded geographically, or crossed meaningful AUM thresholds is a materially different compliance environment than the one the combined role was designed for. The regulatory obligations that were manageable at $50 million in AUM under a single strategy are not the same obligations that exist at $300 million across multiple strategies and investor types. The governance structure, however, often remains exactly the same. That is where the risk accumulates, quietly, until it does not.

When It Stops Making Sense

Complexity accumulates across decisions that each seem manageable in isolation: a second fund strategy, a new investor type, a geographic expansion, an additional regulatory regime. None of these individually overwhelms a combined CEO and CCO. Collectively, over time, they produce a compliance obligation profile that the original governance structure was not built to handle.

Convergence analysis provides a practical financial benchmark for when separation becomes defensible. An investment adviser with $250 million or more in AUM generating approximately $5 million in management fees at a 2 percent fee rate has the cash flow to support a dedicated CCO with an all-in compensation package of approximately $250,000. At that threshold, the cost of separation is recoverable but the cost of a compliance failure at that scale is not.

The filing data supports this tipping point argument from a different angle. For example, Convergence found a 3,669-filing increase in H1 2016 compared to H1 2015 across the full adviser population, with 29 percent of private fund advisers filing more than once in the first half of the year alone. Firms filing at above-average frequency relative to their peers are most likely correcting prior errors or responding to material changes in their business. A combined CEO and CCO absorbing that correction load on top of an executive function is a firm whose governance structure has already been outpaced by its compliance reality, whether or not it has recognized that yet.

What the Filing Data Shows

The 22 percent finding does not exist in isolation. Convergence's filing data from the same period builds a compliance pressure map that explains why the governance arrangement matters as much as it does.

Filing volume across all advisers increased by 3,669 filings in the first half of 2016 compared to the first half of 2015. Of nearly 7,000 private fund advisers, 29 percent had already filed more than once in the first six months of the year. Advisers filing at above-peer frequency are correcting prior errors, responding to material business changes, or managing regulatory obligations that exceed their original filing capacity. In all three cases, the compliance function is under pressure.

Regulatory regime disclosures tell the same story from a different angle. In 2016 the number of regulatory regimes disclosed by advisers experienced a net increase of 350, indicating that the compliance obligation landscape is expanding across the population, not contracting.

Against that backdrop, violation rates were essentially static. 39 regulatory violations and 4 civil violations in H1 2016, compared to 38 advisers disclosing new violations in H1 2015. Rising complexity, rising filing volume, expanding regime exposure, and flat violation rates describe a population working harder to stay compliant, not one that has solved the problem. For the 22 percent of manager groups running that effort through a single executive, the margin for error is narrowing whether the numbers show it yet or not.

What the SEC Marketing Rule Sweep Confirmed

In 2023 the SEC conducted a sweep examination focused on compliance with the Marketing Rule, assessing whether firms had adequate policies, procedures, and oversight infrastructure in place to implement and monitor the new requirements. The findings were instructive not just for what they revealed about Marketing Rule compliance specifically but for what they confirmed about compliance governance more broadly.

The firms that struggled were not, in the main, firms that lacked awareness of the rule. They were firms that lacked the compliance infrastructure to implement it consistently, monitor it continuously, and document it adequately for examination. A combined CEO and CCO is not a compliance infrastructure. It is a compliance dependency on one person's bandwidth, and bandwidth is exactly what the Marketing Rule sweep tested.

Convergence's governance data had been pointing at this structural vulnerability for years before the sweep confirmed it. Firms with concentrated compliance accountability, one person holding the CCO function alongside a full executive role, are carrying a governance arrangement that was not designed for the compliance environment the SEC is now examining against.

The SEC Marketing Rule sweep post covers the specific findings and what they mean for firms in the current examination cycle. The governance argument made here is the structural context for those findings.

convergence-inc.webflow.io/insights/sec-sweep-into-marketing-rule-violations---charges-against-nine-investment-advisers

What the Market Looks Like From the Outside

For allocators conducting due diligence, a combined CEO and CCO role is a governance signal that appears in Form ADV before the first meeting. It does not automatically disqualify a manager but it raises a specific question: has the firm's compliance infrastructure kept pace with its investment complexity. A manager with a combined role, expanding AUM, multiple fund strategies, and above-average filing frequency is showing a pattern that warrants a deeper look at compliance program adequacy before capital is committed.

For auditors and accounting firms, governance structure is a client acceptance and audit risk input that most firms are not yet screening for systematically. A prospective audit client whose CCO is also the CEO is a firm where compliance oversight and executive decision-making are concentrated in the same person. That concentration affects the independence, consistency, and documentation quality of the compliance function, all of which have direct implications for audit risk and engagement scope.

For regulators and examiners, the 22 percent figure is a market baseline that frames the examination population. A firm in this category is not automatically deficient but it is operating a governance arrangement the SEC has consistently identified as a compliance program adequacy concern. When examiners probe firms in this category, they are looking at whether the combined executive has the capacity, the documentation, and the organizational support to run a compliance program that meets the standard the rule requires, not the standard that one person's bandwidth allows.

The Governance Decision

Every firm carrying a combined CEO and CCO arrangement should be able to answer three questions with confidence.

Has our compliance obligation profile changed materially since we last evaluated this arrangement? AUM growth, new fund strategies, additional regulatory regimes, expanded investor types, and increased filing volume are all indicators that the compliance environment has changed. If the governance structure has not changed alongside it, the gap between obligation and capacity is widening whether or not it is visible yet.
Does our current CCO capacity match the complexity of what we are being asked to manage? This is not a question about competence. It is a question about bandwidth. A capable executive holding two demanding roles simultaneously is still holding two demanding roles simultaneously. The question is whether the compliance function is receiving the attention it requires or the attention that remains after everything else.
Would an examiner, allocator, or auditor reviewing our compliance governance structure today reach a favorable conclusion? This is the external lens that internal review rarely applies. The SEC, an allocator's due diligence team, and an audit firm's client acceptance process are all asking versions of this question. If the answer is uncertain, the governance decision has already been made by default. The only remaining question is whether the firm makes it deliberately or waits for someone else to make it for them.

22 percent of investment manager groups have one person holding both the CEO and CCO role. Find out where your governance structure stands against the full market. Request a complimentary non-investment risk benchmark.