Operational Due Diligence in Private Equity
Operational due diligence is the review of a fund manager's business infrastructure, controls and governance, separate from its investment skill, to judge whether investors' capital is safeguarded and accurately reported.
Reviewed by José Vasquéz, Managing Partner · Last reviewed
Structure
Investment due diligence asks whether a manager can pick good companies. Operational due diligence in private equity asks whether the firm can hold, value, report and move money without error or fraud. The two reviews use different evidence and are often run by different people. A strong investment record does not offset a weak control environment, because operational failures are losses that no portfolio company can repair.
The ILPA Due Diligence Questionnaire 2.0 shows the scope. Its 20 sections run from the firm, fund and key persons through investment process, fund terms, governance, risk and compliance, accounting and valuation, reporting, legal, data security and third parties. Most operational questions sit in the last ten. The related Due Diligence Questionnaire (DDQ) entry explains the document itself; this entry explains how a reviewer uses the answers.
- Governance and conflicts: who approves valuations, allocations among vehicles and related-party transactions, and whether anyone independent can say no.
- Valuation: written policy, frequency, who sets marks, and whether an outside party reviews them.
- Service providers: an independent fund administrator, an auditor of recognized standing and outside counsel. The DDQ asks directly whether the fund uses an independent, unaffiliated administrator (question 15.14).
- Compliance: registration status, Form ADV disclosures, the code of ethics, trade and personal-account controls, and regulatory examinations.
- Cash controls: who can initiate and who must approve a wire, and whether capital call and distribution notices are reconciled to the administrator's records.
- Technology and cyber: the DDQ asks whether the cyber policy follows a recognized standard such as NIST, is reviewed annually and is audited independently by a third party, and whether the firm or its portfolio companies have had a breach in five years (questions 18.1 to 18.5).
- Business continuity: a tested plan, covering the loss of a key person, an office or a system.
Worked Example
Consider two hypothetical managers reviewed on a 100-point scorecard. The weights are illustrative; each allocator sets its own. Ratings run from 0 to 5 per category.
| Category | Weight | Manager A | Manager B |
|---|---|---|---|
| Governance and conflicts | 20 | 4 (16.0) | 3 (12.0) |
| Valuation process | 20 | 5 (20.0) | 2 (8.0) |
| Service providers | 20 | 5 (20.0) | 4 (16.0) |
| Compliance | 15 | 4 (12.0) | 4 (12.0) |
| Cash controls | 15 | 4 (12.0) | 3 (9.0) |
| Cyber and continuity | 10 | 3 (6.0) | 3 (6.0) |
| Total | 100 | 86.0 | 63.0 |
Each weighted score is the rating divided by 5, multiplied by the weight. Manager A totals 86.0 and Manager B totals 63.0. The sum hides one important point: Manager B scores 2 on valuation, which a reviewer would treat as a stand-alone red flag even if the total cleared a threshold. A sensible policy sets a minimum on certain categories, so a high total cannot buy back a failing control.
Operational Due Diligence in Private Equity Fund Selection
Reviewers begin with documents and finish with people. Documents include the audited financial statements, the Form ADV, the compliance manual, the valuation policy and the administrator's engagement letter. Interviews cover the chief financial officer, the chief compliance officer and, where one exists, the operations lead. A reviewer then tests whether the answers agree: the person who writes the valuation policy should describe the same process the administrator describes.
Audit timing is a concrete check. Under the SEC custody rule, Rule 206(4)-2, an adviser to a pooled vehicle is deemed to satisfy the rule's surprise-examination requirement when the vehicle is audited at least annually by an independent accountant that is registered with, and inspected by, the PCAOB, and the audited financial statements reach all investors within 120 days of the vehicle's fiscal year end. The qualified-custodian requirement still applies. A manager that is routinely late, or whose auditor changes without explanation, deserves a question.
Operational findings are rarely binary. A reviewer records each gap, rates its severity, and either accepts it, asks for a fix before investing or declines. Findings should be tracked after the commitment, because controls decay unless someone asks about them again.
What It Means for a Limited Partner
For a limited partner, operational risk is the part of manager risk that diversification cannot remove. A fund of any size depends on the same few controls: who holds the cash, who sets the marks, who reports to investors. A limited partner with a small team can still run a disciplined review by asking the same questions of every manager, scoring the answers in the same way and keeping the file. Consistency matters more than scale, because it lets an allocator compare managers and see changes over time. Emerging managers deserve the same standard, applied with judgment: a first-time team may use a shared administrator and outsourced compliance, which can be strong, instead of in-house staff. The question is whether the controls are independent and documented, not how large the back office is. Findings should also feed into the Key Person Provision review, since continuity of the people who run operations is part of the risk. A fund of funds must run this review on every underlying manager as well as on itself.
In Life Sciences and Healthcare
Life sciences portfolios add operational questions of their own. Valuations often rest on clinical or regulatory milestones rather than revenue, so a reviewer should read the valuation policy for how a trial readout, an approval decision or a financing at a different price is reflected in the mark. Portfolio companies may hold patient data, so the firm's oversight of portfolio cybersecurity matters beyond the manager's own systems. The ILPA questionnaire asks about the standards, testing and third-party assessments used by portfolio companies.
Frequently Asked Questions
How is operational due diligence different from investment due diligence?
Investment due diligence tests whether a manager can find, price and improve companies. Operational due diligence tests whether the firm can safeguard capital and report accurately: valuation, cash controls, service providers, compliance and technology. A manager can pass the first and fail the second, so allocators often run them as separate workstreams with separate sign-offs.
What documents does an operational review request?
Typical requests include audited financial statements, Form ADV, the compliance manual and code of ethics, the valuation policy, administrator and auditor engagement letters, insurance certificates, the business continuity plan and cyber policy. The ILPA DDQ 2.0 organizes most of these requests in a standard format, so a manager can answer once and send the same file to many investors.
Should a first-time manager expect the same review?
Yes, with proportionate expectations. A first-time team will have fewer staff, so reviewers look for independence through outside providers: an unaffiliated administrator, a reputable auditor and outsourced compliance, and they ask for written policies even where one person holds several roles. See Emerging Manager for how allocators weigh newer firms.
Related Reference
Operational review is one part of manager selection in growth equity. Related entries: Due Diligence Questionnaire (DDQ), Key Person Provision and Emerging Manager.