If you’ve ever been audited by the Securities and Exchange Commission, you know it can be nerve-racking. But it’s no reason for panic, says one consultant.

In fact, said Jason Vinsonhaler of RIA in a Box, there are several things an RIA firm can do to actually make the audit a positive experience.

In an interview with Financial Advisor, Vinsonhaler, the software and consulting firm’s director of compliance, said preparation is key and should be on RIA advisors’ minds long before the notice about an impending audit is received from the SEC.

All RIA firms undergo the agency’s periodic reviews of their practices, policies and procedures. A firm can expect to undergo an audit about once every eight years now, whereas it used to be every 13 years.

“There is a push to audit those firms that have not been audited in the past and to review operations of firms that have extra risk factors, such as having custody of funds,” Vinsonhaler said.

It’s critical for the firms to have all their documents in order. “If you try to prepare for an audit after you receive the notice from the SEC, you are too late,” he said.

That means executives must gather in one place items such as their firm’s organization chart, client information, employee trade records and advertising materials. When it comes time for the audit, the firm’s CEO or chief investment officer should be ready to present an overview, explaining what the RIA does and how it does it.

The firm’s senior management, chief compliance officer and compliance staff should be available and prepared to answer detailed questions. They must establish a game plan and, during the initial SEC interview, be ready to answer any questions the agency has about the process.

The SEC audit team might be at the firm as long as five days in some cases. A firm getting audited should alert its staff that the audit is taking place and tell staffers to keep records of what they provide to the examiners. The firm should also be prepared to give the examiners a tour of the offices and staff should expect to be interviewed, RIA in a Box said.

There will also be an exit interview, which gives a firm the opportunity to identify and discuss potential deficiencies. If the exit interview isn’t on the agenda, the RIA firm should ask for one anyway so it can get a better understanding of the next steps.

If there are problems, the SEC has up to six months to send a firm a deficiency letter, and the RIA is required to respond within 30 days. The letter will detail any problems that have to be resolved, and how much time the firm has to solve them. Among the common problems are a firm’s failure to follow its own policies and procedures, errors in billing practices or errors in calculating fees.

Getting a deficiency letter is also no reason to be overly worried, Vinsonhaler said. In 70% to 80% of the reviews, some deficiency is found, he added, and if corrections are made in a timely manner, there is no reason to worry.

“The real problem is if the firm does not respond to the deficiency letter or does not fix the problem,” he said. “Then it becomes a major concern.”

RIA in a Box has a risk factor analysis tool that helps firms assess potential problems ahead of time and use the assessment in their own annual reviews.

“The SEC is not trying to trap firms,” Vinsonhaler said. “There is no ‘gotcha’ element in the review. The audit process is always a little intimidating, but it can be used as an opportunity to improve.”