Operational Due Diligence: What Investors Are Really Looking for Today

As Seen in Manhattan Alternative Investment Network

Question 1:

How has operational due diligence evolved over the last decade?

Operational due diligence has evolved significantly over the last decade. What was once primarily a review of accounting records, fund administration, and compliance has become a much broader assessment of how a manager operates and protects investor capital.

Investors still focus on traditional areas such as valuation policies, financial reporting, compliance, and internal controls. However, there is now much greater scrutiny around cybersecurity, business continuity planning, governance, succession planning, and oversight of third-party service providers.

At the institutional level, investors increasingly view operational risk as investment risk. As a result, they want to understand not only how a manager generates returns, but also whether the organization has the infrastructure, controls, and processes necessary to support long-term growth and protect investor assets.

Question 2:

What are the most common weaknesses investors identify during operational due diligence reviews?

The most common issues are typically not investment related. More often, investors identify gaps in operational aspects of the business such as documentation, segregation of duties, valuation governance, compliance testing, and vendor oversight.

Emerging managers frequently have talented investment teams but have not yet built the operational infrastructure that institutional investors expect. Investors want to see that key processes are documented, consistently followed, and subject to appropriate oversight.

Areas that commonly receive attention include cash movement controls, valuation procedures, cybersecurity policies, disaster recovery planning, and evidence that compliance programs are being actively monitored and tested rather than simply maintained on paper.

Question 3:

Why have cybersecurity and vendor management become such important parts of operational due diligence?

Today's investment managers rely heavily on third-party service providers such as fund administrators, outsourced CFOs, custodians, cloud providers, portfolio management systems, and other third-party vendors. As a result, a significant amount of sensitive investor and portfolio company information often sits outside of the manager's direct control.

Investors want to understand how firms identify, assess, and monitor those risks. They are looking for formal cybersecurity policies, periodic risk assessments, incident response plans, employee training programs, and a structured approach to vendor due diligence.

Cybersecurity is no longer viewed as purely an IT issue. Investors increasingly consider it a core component of operational risk management and an important indicator of the overall maturity of an investment platform.

Question 4:

What level of operational infrastructure do institutional investors expect from emerging managers?

Investors generally recognize that an emerging manager with less than $100 million of assets under management is not going to have the same infrastructure as a multi-billion-dollar platform. Investors expect a degree of operational infrastructure consistent with the manager’s complexity and stage of growth.

Investors want to see a thoughtful governance structure, reputable service providers, documented policies and procedures, independent fund administration, valuation oversight, and a reasonable framework for information security and business continuity.

Most investors understand that infrastructure develops over time. What they want to see is a management team that recognizes the importance of operational excellence and has a clear plan for continued growth and enhancement of the control environment.

Question 5:

What can managers do today to improve their chances of a successful operational due diligence review?

The most effective approach is to treat operational due diligence as an ongoing process rather than something that begins when fundraising starts.

Managers should maintain current policies and procedures, perform periodic compliance testing, document governance activities, review third-party service providers, and regularly assess cybersecurity risks. They should also periodically step back and evaluate their operations from the perspective of an institutional investor.

Industry resources and standard due diligence questionnaires can be valuable tools for identifying gaps before prospective investors do. In our experience, the managers that perform best during operational due diligence reviews are typically the ones that have invested in building a strong operational foundation long before the first investor questionnaire arrives.