The exam results described in the risk alert give insight into the attributes of the most successful outsourced relationships.

CCO consultants that had frequent and personal interactions with firm leaders, as opposed to maintaining an arm's-length relationship via electronic communications and pre-determined check lists, had a better understanding of firms' operations and risks, the SEC found.

SEC also noted fewer inconsistencies between compliance policies and actual business practices when outsourced CCOs were regularly present with firms.

The alert doesn't name names, as is the SEC's policy, but it did say "certain" outsourced CCOs that infrequently visited firms and conducted only limited on-site reviews held limited prominence in the advisory firms.

That resulted in limited authority, which often showed up in sloppy compliance procedures in key areas, like fee and conflict of interest disclosure requirements.

Some CCOs appeared to have insufficient resources, or too many clients for whom to provide effective oversight.

Compliance audits where most effective when CCOs were able to independently obtain firms' records, the exams found. In some cases, the SEC documented advisors that maintained control over the records that outsourced CCOs reviewed. That selective access affected the accuracy of firms' annual reviews, the SEC said.

In the worst cases, the SEC's examiners found that some CCOs couldn't accurately articulate firms' compliance risks, and in some cases had little grasp as to whether polices had been put in place to mitigate identified risks.

In other cases advisors described risks to the SEC's examiners that were fundamentally different from the ones their outsourced CCO described.

Some standardized checklists, which the SEC said can be useful but should not be over relied on, were generic, and produced inconsistent information about a firm's practices.

The SEC recommends that firms with outsourced CCOs review business practices in light of the risks the OCIE noted in the exams.