An operational due diligence checklist covers eight areas of a fund manager's operations: the fund structure and its service providers, custody and cash controls, valuation, the audit, controls reports, regulatory and legal history, key people and governance, and continuity and cyber resilience. The usual version lists questions for the manager to answer in a due diligence questionnaire. That is the weak half. Each question needs a second column naming the document that answers it independently (the administrator's own confirmation, the audited notes, the custodian's statement, a regulator's register) and a third saying how to get that document without going through the manager. The checklist below is built that way. It is the method Botminds' Operational Due Diligence follows: its agents read the data room, then check each claim against a source the manager does not control and draft the confirmation requests for the analyst to approve.
The worked examples come from a sample review in the solution, on fictional data: Quillfield Capital's review of Fernhill Macro Fund SICAV-RAIF, a Luxembourg global macro fund. The firms and people are invented. The research figures come from regulators and peer-reviewed studies, linked where they appear.
When a checker asked someone other than the manager
16%
of funds described their signature process differently from their administrator
19%
of funds’ asset figures could not be verified, or disagreed with another source
14%
of investigations found a performance figure that disagreed or could not be verified
20%
of managers interviewed stated something incorrect when checked against documents
What should an operational due diligence checklist cover?
It should cover every place the allocator's money could be lost, mispriced or misreported without the strategy being at fault. In practice that is eight areas: who the entities and providers are; who holds the assets and who can move cash; how hard-to-value positions are priced; who audits the fund and what the opinion says; what the providers' controls reports cover; the manager's regulatory and legal history; who the key people are and what happens if they leave; and whether the business can keep running through an outage or an attack.
The research shows why each area needs a check, not only a question. The third-party due diligence firm whose 444 reports Brown, Goetzmann, Liang and Schwarz studied did not stop at the questionnaire. "They augment this by verifying operational controls, assets under management, and performance with the administrator," the authors write. "Finally, they attempt to verify the authenticity of the audit with the auditor and perform a background check on the management company and its key staff" (NBER working paper 15529). The disagreements in the figure above are what those checks turned up.
The checklist, question by question: the independent source for each
Read the table across. The second column is where the manager's answer usually sits. The third is the document that answers the same question independently; the fourth is how to obtain it so that the manager cannot shape it. Where the third column is empty in a review, the claim is single source and the report should say so.
Twelve operational due diligence questions, each with the document that answers it independently
| Question | The manager’s answer is in | Independent evidence | How to obtain it |
|---|---|---|---|
| Who administers the fund, and since when? | DDQ; offering memorandum | Audited notes; the administrator’s own confirmation; a regulator’s register | Request sent to the address in the register, manager not copied |
| Does the administrator calculate the NAV and send investor statements? | DDQ | The administrator’s confirmation; a statement received directly from it | Same request; ask for the latest month-end NAV it calculated |
| Who holds the assets? | DDQ; custody section of the offering memorandum | Custodian, depositary or prime broker statement or confirmation | Direct confirmation of the accounts and balances at a date |
| How many signatures move cash, and are they independent? | DDQ; treasury policy | The administrator’s or bank’s description of the signing mandate | Ask the administrator to describe the process; compare |
| Who audits the fund, and is the opinion unqualified? | DDQ; audit PDF in the data room | The auditor’s confirmation of the engagement; the firm’s public registration | Confirmation with the fund’s consent; registration on the regulator’s or PCAOB’s register |
| What share of the portfolio is valued independently? | DDQ; valuation policy | The administrator’s pricing description; the audited fair-value note | Administrator confirmation; read the note, not the summary |
| Has any service provider changed in three years? | DDQ | Audited notes year on year; each provider’s own reply | Compare two years of notes; confirm start and end dates |
| Is the controls report current, and for the right entity? | Data room | The SOC 1 Type II report itself: entity, period, exceptions | Request it from the provider; check the service organisation named |
| Any regulatory or legal history? | DDQ disclosure section | Regulators’ registers and enforcement records; court records | Search by entity and principal names |
| Who are the key people, and are they approved where they must be? | Pitch book; DDQ | Regulators’ registers of approved persons; the key-person clause | Search each name; read the fund documents |
| Is the continuity plan tested? | DDQ | The plan’s own test record and its date | Ask for the last full test report, not the policy |
| Are the performance figures the fund’s? | Marketing material | Administrator-calculated NAV history; audited financial statements | Administrator confirmation of NAV at chosen dates |
Two rows deserve emphasis. The signature row looks administrative and is not: Brown and his co-authors found that in 16% of cases "the fund’s version of the signature process did not match the version explained by the administrator". The due diligence firm graded the best practice as "institutional quality", which it defined "as all money movements requiring an internal and independent third party signature". And the service-provider-change row is where the sample review found its most serious finding, as the next section shows.
How do you verify a fund administrator?
Verify the administrator from outside the manager in three steps. Find the administrator in an independent document: the audited notes, which disclose changes of administrator, and, where the administrator is regulated, the regulator's register. Then write to it at an address taken from that register, not from the manager's questionnaire, and ask it to confirm its appointment and start date, that it calculates the net asset value and sends investor statements, a recent net asset value, and its latest controls report. Finally, reconcile the reply line by line with the questionnaire.
A fund administrator keeps the fund's books, calculates the net asset value at which investors subscribe and redeem, maintains the register of investors and often sends their statements. That is why its independence matters: an administrator that receives prices and positions from the manager and passes them through adds a signature, not a check. The confirmation should ask what the administrator itself sources and calculates.
In the sample review, three sources the manager does not control agreed with each other and not with the manager: note 2 of the 2025 audited accounts, in French, recorded that Valmont Fund Administration replaced Calder Fund Services from March 1, 2026; Calder confirmed its appointment ended on February 28; and the Luxembourg regulator's register listed Valmont. The questionnaire, dated August 14, still named Calder and said no provider had changed in three years. The controls report in the data room was Calder's, so it covered the former administrator only.
Each entity in the structure, with its claims and the source that checked them
Custody and cash: what the Custody Rule already makes someone else check
For a US-registered adviser, the SEC's Custody Rule puts several independent parties into the custody chain, and an ODD checklist should confirm each one rather than ask about it. Rule 206(4)-2 requires that a qualified custodian hold client funds and securities, either in a separate account for each client or in accounts containing only clients' assets (17 CFR 275.206(4)-2).
The rule then adds an outside check. Client assets must be "verified by actual examination at least once during each calendar year" by an independent public accountant "at a time that is chosen by the accountant without prior notice or announcement to you and that is irregular from year to year." A pooled fund such as a limited partnership can use the rule's alternative instead: the fund is audited at least annually, and its audited financial statements, prepared under generally accepted accounting principles, go to all investors within 120 days of the fiscal year end, from an accountant registered with, and subject to regular inspection by, the Public Company Accounting Oversight Board.
Custody and cash: six checks that need no answer from the manager
- Name the qualified custodian, and confirm it holds the fund’s assets
A statement or confirmation from the custodian or depositary at a date you choose.
- Check which audit route the fund uses
A surprise examination by an accountant, or an annual audit with statements distributed to all investors within 120 days of year end.
- Confirm the auditor is registered and inspected where the rule requires it
PCAOB registration and inspection status, which Form ADV also asks the adviser to state.
- Get the signing mandate from the administrator or bank
Compare it with the questionnaire; look for a signature independent of the manager.
- Ask where cash can go
Whether transfers from the prime broker are limited to the fund’s own bank account.
- Confirm investors receive statements from someone other than the manager
Ask the administrator whether it sends them, to all investors or some.
What is a SOC 1 report, and what does it not tell you?
A SOC 1 report is an auditor's examination of a service provider's controls that matter to its clients' financial reporting. The AICPA describes it as "an examination of controls at a service organization that are likely to be relevant to user entities’ internal control over financial reporting" (AICPA, SOC 1). For an ODD team the service organisation is usually the administrator or the custodian, and in a Type II report the auditor reports on the controls' design and also, in the AICPA's words, "the operating effectiveness" of them (AICPA).
Three checks make a controls report useful. Is it for the entity that actually services the fund? In the sample, the report in the data room was Calder's, the administrator the fund had left. Does its period cover the months you care about, or end before a change? And what exceptions did the auditor report, and what did management say about them? A report that is current, for the right entity and clean on the controls that touch net asset value and cash is strong evidence. One that is none of those is a document, not a check.
A controls report as evidence: when it counts, and when it does not
Weak evidence: The provider’s group, or a provider the fund has left
Strong evidence: The legal entity that services this fund now
Weak evidence: Ended before the provider took the fund on
Strong evidence: Covers the months under review
Weak evidence: Controls unrelated to NAV, cash or the investor register
Strong evidence: Pricing, reconciliation, cash movement and register controls
Weak evidence: Not read, or read only in the summary
Strong evidence: Each exception read, with management’s response
Weak evidence: A PDF in the manager’s data room
Strong evidence: Sent by the provider, with its confirmation of the appointment
Valuation and performance: checks that do not depend on the manager
Valuation and performance are where a manager has the most room to shade numbers and the allocator has the fewest outside sources, so the checklist should name them precisely. Ask the administrator which prices it sources itself and which it receives from the manager, and compare its answer with the valuation policy. Brown and his co-authors found that 3.6% of funds "disagreed with the administrator on the process used to price the portfolio". Low, but each case is a fund whose investors were told one thing about pricing while another happened.
For performance, the independent figure is the administrator's net asset value history, not the track record in the pitch book. In the study, performance figures disagreed with another source, or could not be verified, in 14% of investigations. Ask the administrator to confirm the net asset value at two or three dates you choose, and reconcile them with the audited statements at year end. The valuation policy review covers the policy itself: who can change a price, and who hears about it.
Confirm directly, or it is not a confirmation
A confirmation only counts if the request goes from the allocator to the provider, at an address the manager did not supply, and the reply comes back the same way. Anything routed through the manager, or sent to a contact the manager named, can be shaped by the party being checked.
Even regulators have learned this the hard way. In its review of the Madoff examinations, the SEC's inspector general found that examiners "drafted a letter to the National Association of Securities Dealers (NASD) (another independent third-party) seeking independent trade data, but they never sent the letter, claiming that it would have been too time-consuming to review the data they would have obtained" (SEC OIG, Report OIG-509, 2009). The letter that is drafted and not sent is the most common failure in any checklist.
A request drafted and never sent checks nothing. The checklist item is not "ask the administrator"; it is "send the request to the address in the register, and reconcile the reply".
Auditors are the hardest to confirm. The due diligence firm in the Brown study found that most auditors "would not discuss any aspect of their audits with the DD company, even going as far in some cases as not to confirm the fund was a client of the company", whatever permission the fund gave. The practical answer is to ask the fund to instruct its auditor to confirm the engagement, and to read the audited notes, which carry the facts an auditor will not discuss.
A confirmation goes to the provider at the regulator's address, after the analyst approves
Hedge fund operational due diligence checklist: what to add, and for private equity
A hedge fund checklist adds the machinery of an open-ended fund: each prime broker and what it holds as custodian, the financing terms that let a broker seize collateral, the redemption terms and any side letters granting better ones, and the frequency of the net asset value the administrator calculates. A private equity checklist adds governance over the fund's life: how unrealised holdings are valued each quarter, how fees and expenses are allocated and offset, when the advisory committee must consent to a conflict, and what the key-person clause does when a principal leaves.
The verification habit carries over unchanged. Whatever the strategy, the questionnaire answer is the claim and the provider's reply is the evidence. How often questionnaire answers turn out to be wrong, and how to test whether a review process catches them, has its own guide; the manager's own filing with the SEC is a cross-check worth adding to every row.
Operational due diligence checklist PDF: what the paper version should keep
A checklist printed as a PDF tends to lose its third and fourth columns, because they are filled in per review rather than once. Keep them as columns with a status: verified, single source, contradiction or not yet requested, and the date of each reply. A checklist that ends a review with every row ticked and no evidence column is a record of questions asked.
In the solution the checklist is a setting: the house standard (the sample allocator's has 34 controls in 7 themes) and the questionnaire templates, AIMA, ILPA or the firm's own, which the Head of ODD approves version by version. To see the structure, the claims and the confirmations on your own past reviews, start from Operational Due Diligence.
Questions people ask
What documents are needed for operational due diligence?
From the manager: the due diligence questionnaire, offering documents, audited financial statements, the main policies (valuation, allocation, personal trading, cyber, continuity) and the service providers' controls reports. From outside the manager: the providers' own confirmations, regulators' registers and the manager's Form ADV where it files one. The sample review read 38 documents, 2,146 pages, in English, French and German.
What is a service provider due diligence checklist?
It is the part of the ODD checklist that covers the administrator, custodian or depositary, auditor and prime brokers: who each is, since when, what it does for the fund and whether its controls report covers it. Each item is confirmed by the provider directly, at an address taken from a regulator's register rather than the manager's documents.
What does a fund administrator do?
It keeps the fund's books, calculates the net asset value at which investors subscribe and redeem, maintains the investor register and often sends investor statements. For an ODD team the key question is which prices and positions it sources itself and which it receives from the manager.
Is a SOC 1 Type II report enough to clear a provider?
Not on its own. It reports whether the provider's controls operated effectively, but it has to be for the right legal entity, cover the period under review and be read for exceptions. In the sample review the report supplied was for the administrator the fund had already left.
Who should an ODD analyst contact to confirm a manager's claims?
The providers themselves (administrator, custodian or depositary, auditor, prime brokers) at contact details from a regulator's register, never details the manager supplied, and without copying the manager. The analyst should approve each request before it is sent and reconcile each reply to the claims it covers.