Use this guide to connect evidence, calculations and professional judgment when evaluating investment managers and vehicles. The concepts follow the CDDA outline's progression from preparing a review to assessing investments and operations, then making and monitoring recommendations. Each example resolves a realistic analytical problem; each mistake highlights a specific weakness in the reasoning.
Preparing Evidence and the Review Agenda
1. Separate investment risk from operational risk
Investment due diligence examines whether the strategy, portfolio and terms suit the investor's objectives. Operational due diligence examines whether people, systems and controls can safeguard assets and execute that strategy reliably. A strong conclusion in one area does not resolve weaknesses in the other.
Worked example: A credit manager demonstrates disciplined security selection but allows one employee to initiate and approve payments. The investment case remains promising, while the payment control requires separate investigation and remediation.
Mistake to avoid: Treating attractive historical returns as evidence that operational controls are effective.
Source reference: cdda_menu Archives - IMDDA Membership Site
2. Map entities before evaluating responsibilities
Identify the manager, investment vehicle, general partner where relevant, adviser, administrator and asset-holding arrangements. Record ownership, contractual relationships and decision rights. Similar names do not establish that entities have identical obligations, resources or financial strength.
Worked example: An audited fund statement names Cedar Fund, while the questionnaire describes Cedar Management. The analyst maps both entities and requests manager financial information rather than assuming the fund audit covers the management company.
Mistake to avoid: Using evidence about one entity to support a conclusion about another.
Source reference: cdda_menu Archives - IMDDA Membership Site
3. Match document requests to the decision
Request materials that answer identifiable questions about investment suitability, control effectiveness or vehicle terms. Offering documents explain contractual arrangements; portfolio files reveal exposures; policies describe intended controls. A request list should connect each document to a review objective and identify missing evidence.
Worked example: To assess redemption liquidity, an analyst requests governing redemption terms, asset liquidity estimates and financing obligations. A presentation promising flexibility cannot establish when investors can actually receive cash.
Mistake to avoid: Collecting a large document library without identifying which decisions it supports.
Source reference: cdda_menu Archives - IMDDA Membership Site
4. Distinguish assertion from corroborated evidence
Manager statements are useful starting points, but their evidential value depends on relevance, independence and consistency with records. Direct confirmation and observed execution can strengthen an assertion. Independent evidence still requires checking its scope, date and relationship to the reviewed entity.
Worked example: The manager reports daily reconciliations. Dated reconciliation files and reviewer signoffs support that claim; an administrator confirms its own role but does not confirm the manager's internal review.
Mistake to avoid: Assuming an independent party has verified matters outside its engagement.
Source reference: cdda_menu Archives - IMDDA Membership Site
5. Read financial statements as connected evidence
The balance sheet describes resources and obligations at a date; the income statement describes performance over a period; cash flow information explains cash movements. Read notes alongside these statements. Accounting profit, cash availability and financial resilience answer different questions.
Worked example: A manager earns a profit of $600,000 but has $900,000 of unpaid client receivables. The analyst investigates collections and cash reserves before concluding that payroll funding is secure.
Mistake to avoid: Equating reported profit with cash immediately available to meet obligations.
Source reference: cdda_menu Archives - IMDDA Membership Site
6. Align dates, definitions and reporting boundaries
Evidence must refer to comparable periods, entities and measurement definitions. Assets under management, fund net assets and gross portfolio exposure are different quantities. Maintain a common review date or explain adjustments when documents reflect different dates.
Worked example: A presentation reports $240 million of firm assets in June, while September fund accounts show $180 million. Additional mandates and intervening withdrawals explain the difference; it is not automatically an accounting discrepancy.
Mistake to avoid: Comparing differently defined figures as though they measure the same thing.
Source reference: cdda_menu Archives - IMDDA Membership Site
7. Investigate discrepancies without prejudging them
When records conflict, document the precise difference, possible explanations and evidence needed to resolve it. Distinguish timing differences, definition changes and genuine inaccuracies. An unresolved discrepancy reduces confidence, but its existence alone does not establish misconduct.
Worked example: A holdings file lists 62 positions and a risk report lists 59. Three unsettled trades explain the difference. The analyst documents the reporting convention and confirms that their exposures enter the relevant risk calculation.
Mistake to avoid: Accepting a verbal explanation without checking the underlying records.
Source reference: cdda_menu Archives - IMDDA Membership Site
8. Build an agenda around consequential uncertainties
Prioritize review questions by potential impact, exposure and existing uncertainty. Connect each question to an interviewee, document or control demonstration. The agenda should change when new evidence reveals a more consequential issue rather than mechanically following the questionnaire order.
Worked example: A liquid equity manager introduces privately negotiated investments. The analyst moves valuation independence and redemption compatibility ahead of routine office administration because the strategy change creates larger unresolved risks.
Mistake to avoid: Giving every questionnaire item equal attention regardless of its consequences.
Source reference: cdda_menu Archives - IMDDA Membership Site
9. Use walkthroughs to connect policy with practice
A walkthrough follows an actual transaction or event through its stages, identifying owners, approvals, systems and retained evidence. It helps assess whether a control is implemented as described. One walkthrough illustrates a process but does not establish consistent operation across a period.
Worked example: An analyst follows a recent trade from order approval through settlement and reconciliation. The records reveal that an exception was resolved by the trader without the independent review required by policy.
Mistake to avoid: Treating a polished process description as proof of consistent execution.
Source reference: cdda_menu Archives - IMDDA Membership Site
Investment Opportunity, Firm and People
10. Test the investment thesis and claimed advantage
A credible investment thesis explains the opportunity, why it persists, how the manager accesses it and what could invalidate it. Separate a repeatable advantage from favorable market conditions. Assess whether competition, transaction costs or capital growth could erode the expected benefit.
Worked example: A manager attributes profits to rapid analysis of small issuers. As assets grow, required position sizes exceed normal trading volume. The original research advantage may persist, but implementation capacity limits its usefulness.
Mistake to avoid: Assuming an advantage remains equally valuable at every fund size.
Source reference: cdda_menu Archives - IMDDA Membership Site
11. Assess management company financial resilience
Evaluate recurring revenue, fixed costs, client concentration, debt and cash reserves at the management company. Distinguish stable fee income from uncertain performance fees. Financial pressure can affect staffing, systems spending and incentives even when the investment vehicle itself holds substantial assets.
Worked example: Recurring annual fees are $2.4 million and annual operating costs are $3 million. The $600,000 shortfall requires reserves or other funding; last year's performance fee does not establish a sustainable operating model.
Mistake to avoid: Using fund assets as a substitute for the manager's own financial resources.
Source reference: cdda_menu Archives - IMDDA Membership Site
12. Evaluate human capital and decision continuity
Identify who generates ideas, authorizes trades, controls risk and performs essential operational tasks. Examine relevant experience, turnover, workload and succession arrangements. Ownership changes also matter when they alter control or staff incentives. A documented deputy needs demonstrated capability and access to perform the role.
Worked example: Two analysts produce research, but only the founder understands the position-sizing model. The review identifies concentrated decision knowledge and requests evidence that a successor can operate and explain the model.
Mistake to avoid: Counting employees without examining where essential knowledge and authority reside.
Source reference: cdda_menu Archives - IMDDA Membership Site
13. Analyze incentives and investor alignment
Compensation, ownership, personal investment and contractual economics influence behavior. Examine whether rewards favor sustainable results, excessive risk, asset gathering or short-term outcomes. Manager investment can support alignment, but its significance depends on amount, funding, liquidity rights and exposure relative to personal resources.
Worked example: A portfolio manager receives rewards for gross returns without a risk adjustment. The analyst identifies an incentive to increase leverage and examines whether independent limits constrain that behavior.
Mistake to avoid: Treating any personal investment as conclusive evidence of aligned interests.
Source reference: cdda_menu Archives - IMDDA Membership Site
14. Trace the investment decision process
Follow idea generation, research, approval, sizing, execution, review and exit. Determine which judgments are discretionary and which follow documented rules. Examine rejected ideas and losing positions as well as successful investments to assess whether the stated process governs actual decisions.
Worked example: The manager says every position requires a downside case. Three recent losing investments lack that analysis. The analyst identifies inconsistent process execution rather than concluding that losses alone prove poor research.
Mistake to avoid: Evaluating the process only through successful investments selected by the manager.
Source reference: cdda_menu Archives - IMDDA Membership Site
Portfolio Analysis and Risk
15. Calculate gross and net exposure
For simple long and short positions measured consistently relative to net asset value, gross exposure adds their absolute exposures; net exposure subtracts short exposure from long exposure. Net exposure indicates directional balance, while gross exposure indicates the scale of positions. Derivatives require an appropriate, explicitly stated exposure measure.
Worked example: Long positions equal 130% of net asset value and shorts equal 50%. Gross exposure is 180%; net exposure is 80%. The portfolio is not equivalent to an unleveraged 80% long allocation.
Mistake to avoid: Using net exposure alone to describe total portfolio risk.
Source reference: cdda_menu Archives - IMDDA Membership Site
16. Identify concentration beyond position count
Concentration can arise through issuers, sectors, countries, factors, financing sources or connected businesses. Numerous positions may still depend on the same economic outcome. Aggregate exposures using a consistent basis and examine shared drivers, including indirect exposures through funds or derivatives.
Worked example: A portfolio holds twelve different technology suppliers, each at 3%. Their combined 36% exposure depends heavily on the same customer spending cycle, despite the apparently modest individual weights.
Mistake to avoid: Equating a large number of holdings with effective diversification.
Source reference: cdda_menu Archives - IMDDA Membership Site
17. Interpret correlation conditionally
Correlation measures co-movement over a specified sample, not a permanent relationship or a guarantee against joint losses. Review the period, frequency and market conditions used. Diversification estimates become less reliable when exposures share funding, liquidity or economic dependencies that emerge during stress.
Worked example: Two strategies show low correlation during calm markets but both sell assets when lenders reduce financing. The analyst includes a joint funding shock instead of relying solely on the historical correlation.
Mistake to avoid: Assuming low average correlation rules out simultaneous losses.
Source reference: cdda_menu Archives - IMDDA Membership Site
18. Separate security selection from factor exposure
Returns can reflect broad market, sector, credit, currency or other systematic exposures as well as security selection. Factor analysis helps identify the economic risks behind a strategy label. Estimates depend on model choice and data, so reconcile them with positions and the manager's explanation.
Worked example: A supposedly defensive portfolio rises mainly when lower-quality credit rallies. Holdings confirm substantial credit exposure, so its recent performance does not establish independence from the credit cycle.
Mistake to avoid: Accepting a strategy's marketing label as its actual risk profile.
Source reference: cdda_menu Archives - IMDDA Membership Site
19. Connect leverage with financing resilience
Leverage can amplify both gains and losses, while financing terms can force action before a long-term thesis resolves. Examine borrowing maturity, collateral requirements, lender discretion and available liquidity. A portfolio's ability to survive adverse price moves depends partly on its funding arrangements.
Worked example: A fund has $100 million of equity supporting $150 million of assets and $50 million of debt. A 10% asset decline leaves $85 million of equity, a 15% equity loss before costs.
Mistake to avoid: Assessing leverage amplification without examining potential collateral calls.
Source reference: cdda_menu Archives - IMDDA Membership Site
20. Compare asset liquidity with cash obligations
Liquidity assessment links realistic asset-sale timing to redemptions, collateral calls and other cash needs. Consider market depth, position size, settlement and sale discounts. Cash availability under stress may differ sharply from normal conditions, especially when several investors or lenders demand cash together.
Worked example: A fund expects $12 million of near-term cash needs but holds $5 million of cash and only $4 million of readily saleable assets. The $3 million gap requires a credible funding or liquidity response.
Mistake to avoid: Assuming all listed assets can be sold immediately at their reported values.
Source reference: cdda_menu Archives - IMDDA Membership Site
21. Use stress scenarios to expose vulnerabilities
Stress analysis asks how a portfolio behaves under specified adverse changes, including interacting market and funding shocks. State assumptions and distinguish modeled losses from forecasts. Supplement quantitative results with risks the model omits, such as market closures, discontinuous prices or unreliable liquidity estimates.
Worked example: A currency shock produces a modeled $4 million loss, while associated collateral calls require $7 million of cash. The review separates economic loss from the larger immediate funding need.
Mistake to avoid: Treating a scenario's modeled result as an exhaustive account of risk.
Source reference: cdda_menu Archives - IMDDA Membership Site
Performance and Investment Vehicle Terms
22. Compound returns across periods
A cumulative return multiplies successive wealth factors and subtracts one. Adding periodic returns ignores the changing investment base. Use consistent fee, currency and distribution assumptions. Compounding matters especially when gains and losses alternate, because equal percentage gains and losses do not cancel.
Worked example: A portfolio gains 20% and then loses 20%. Its wealth factor is 1.20 × 0.80 = 0.96, producing a cumulative loss of 4%.
Mistake to avoid: Adding the two returns and reporting a zero cumulative return.
Source reference: cdda_menu Archives - IMDDA Membership Site
23. Distinguish time-weighted and money-weighted returns
Time-weighted returns link subperiod returns to reduce the effect of external cash-flow timing. Money-weighted returns reflect the size and timing of investor cash flows. Choose the measure according to the question, and establish cash-flow conventions before calculating or comparing results.
Worked example: An account starts at $100, grows to $110, receives $100 and ends at $189. Its subperiod returns are 10% and −10%, giving a time-weighted return of −1%; investor experience also depends on the contribution's timing.
Mistake to avoid: Comparing unlike return measures without considering who controlled cash flows.
Source reference: cdda_menu Archives - IMDDA Membership Site
24. Interpret risk-adjusted performance cautiously
The Sharpe ratio divides return above a risk-free reference by return volatility, using consistent periods and conventions. It summarizes a particular relationship between return and variability. Illiquid pricing, asymmetric losses and short histories can make volatility an incomplete risk measure.
Worked example: Using consistently annualized inputs, a return of 9%, reference rate of 3% and volatility of 12% produce a Sharpe ratio of 0.5. That figure does not reveal exposure to a rare large loss.
Mistake to avoid: Treating a higher Sharpe ratio as proof of lower overall risk.
Source reference: cdda_menu Archives - IMDDA Membership Site
25. Choose benchmarks that match the mandate
A useful benchmark represents relevant opportunity sets and risks. Compare currency, leverage, liquidity and investment constraints before interpreting excess return. Attribution then examines which exposures or decisions contributed to results. Neither a favorable comparison nor attribution alone establishes repeatable skill.
Worked example: An emerging-market equity fund returns 11% while a relevant index returns 13%. Its excess return is −2 percentage points; comparison with a 7% developed-market index would answer a different question.
Mistake to avoid: Selecting a convenient benchmark after seeing the performance outcome.
Source reference: cdda_menu Archives - IMDDA Membership Site
26. Measure drawdown and recovery separately
Drawdown measures decline from a previous peak; maximum drawdown is the largest such decline over the observed period. Recovery requires a gain calculated from the reduced base. Examine both loss depth and time below the peak, while recognizing that historical drawdown does not cap future losses.
Worked example: Net asset value falls from 100 to 75, a 25% drawdown. Returning to 100 requires a gain of 25 ÷ 75 = 33.33%, not 25%.
Mistake to avoid: Assuming the recovery percentage equals the preceding loss percentage.
Source reference: cdda_menu Archives - IMDDA Membership Site
27. Separate realized and unrealized private-fund value
Distributions to paid-in capital divide cumulative distributions by paid-in capital. Residual value to paid-in capital uses remaining reported value. Their sum is total value to paid-in capital. These multiples do not account for timing, and residual value depends on valuation assumptions.
Worked example: Paid-in capital is $20 million, distributions are $8 million and residual value is $18 million. DPI is 0.4, RVPI is 0.9 and TVPI is 1.3; most reported value remains unrealized.
Mistake to avoid: Interpreting a value multiple as an annual return or fully realized proceeds.
Source reference: cdda_menu Archives - IMDDA Membership Site
28. Connect vehicle structure with investor exposure
Identify what the investor owns, who controls investments and how capital enters or exits. The CDDA outline includes pooled funds, private-market vehicles, funds of funds and separately managed accounts. Product names do not establish identical liquidity, reporting or investor rights; examine governing documents and applicable requirements.
Worked example: A fund of funds offers periodic investor withdrawals while underlying funds restrict exits. The analyst examines the liquidity mismatch rather than assuming diversification eliminates withdrawal risk.
Mistake to avoid: Inferring redemption rights from a product label, including UCITS or 40 Act Fund.
Source reference: cdda_menu Archives - IMDDA Membership Site
29. Calculate economics from the actual fee terms
Fees affect investor outcomes through their rates, bases, timing and interaction. Examine management fees, incentive arrangements, expenses, hurdles and loss-recovery provisions where present. Share classes or negotiated terms may produce different outcomes. Calculate only after establishing the applicable contractual sequence.
Worked example: Assume a $1 million account earns $100,000, pays a $20,000 management fee, then pays a 20% incentive fee on the remaining gain. Incentive fees are $16,000 and the net gain is $64,000.
Mistake to avoid: Applying incentive fees to an assumed base without checking the contract.
Source reference: cdda_menu Archives - IMDDA Membership Site
Operational Processes and Accounting
30. Separate incompatible duties
Segregation of duties reduces opportunities to create and conceal errors or misuse. Examine initiation, authorization, asset access and recordkeeping together. Small teams may require compensating controls, but those controls need sufficient independence, timeliness and evidence rather than a nominal second signature.
Worked example: An operations employee prepares payments and maintains beneficiary details. A separate authorized reviewer verifies supporting documents and beneficiary changes before release, reducing the employee's ability to redirect funds unnoticed.
Mistake to avoid: Counting approvers without checking their independence and review substance.
Source reference: cdda_menu Archives - IMDDA Membership Site
31. Follow the trade lifecycle through settlement
Trade controls connect authorized orders, execution records, allocations, confirmations, settlement and accounting. Each handoff can introduce errors or missing information. Examine ownership of exceptions and verify that unresolved settlement problems enter cash, position and risk reporting.
Worked example: A purchase appears in the trading system but lacks counterparty confirmation. Operations investigates the mismatch before expected settlement and includes the pending obligation in cash planning.
Mistake to avoid: Assuming a recorded trade has settled merely because execution occurred.
Source reference: cdda_menu Archives - IMDDA Membership Site
32. Use reconciliations to identify unexplained differences
Reconciliation compares records from different sources and explains differences in positions, cash or transactions. A control needs a suitable frequency, complete inputs, investigation and independent review. Timing differences may be valid, but persistent unresolved items can conceal accounting errors or missing assets.
Worked example: The internal ledger shows $2.6 million of cash and the bank shows $2.4 million. A verified $200,000 payment awaiting ledger posting explains the difference and leads to an accounting correction.
Mistake to avoid: Closing a reconciliation simply because a difference has been labeled as timing.
Source reference: cdda_menu Archives - IMDDA Membership Site
33. Evaluate payment authorization and beneficiary changes
Cash controls should verify the purpose, authority and destination of payments. Changes to beneficiary details deserve independent confirmation using established contact information. Examine access rights, approval limits, supporting records and bank-level controls together; a manager's internal policy may not govern every payment channel.
Worked example: An emailed invoice changes a provider's bank account. Operations confirms the change with a known contact using previously recorded details before the authorized approvers release payment.
Mistake to avoid: Verifying changed payment details using contact information contained in the change request.
Source reference: cdda_menu Archives - IMDDA Membership Site
34. Assess valuation independence and uncertainty
Valuation review examines price sources, methods, assumptions, overrides and challenge procedures. Hard-to-value assets require attention to estimation uncertainty and conflicts. An independent reviewer must have relevant information and authority to challenge valuations, rather than merely reproduce the portfolio manager's figures.
Worked example: A private loan is marked at par despite deteriorating borrower cash flow. The valuation committee requests updated repayment assumptions and comparable evidence instead of accepting the unchanged mark.
Mistake to avoid: Treating a precise reported price as evidence of low valuation uncertainty.
Source reference: cdda_menu Archives - IMDDA Membership Site
35. Reconstruct net asset value
Net asset value equals recognized assets minus liabilities; per-unit value divides that amount by the relevant units outstanding. Review valuation inputs, accrued expenses, liabilities and investor activity. Different share classes may require separate allocations, so a correct fund total does not automatically establish correct class values.
Worked example: Assets are $52 million, liabilities are $2 million and five million identical units are outstanding. Net assets are $50 million and net asset value per unit is $10.
Mistake to avoid: Omitting accrued expenses because they have not yet been paid.
Source reference: cdda_menu Archives - IMDDA Membership Site
36. Check expense allocation against documented terms
Determine which expenses belong to the manager, fund, investment or investor class. Shared costs need a documented and supportable allocation basis consistent with applicable agreements. Review actual postings and approvals, because a fair-sounding policy can still be applied inconsistently.
Worked example: A $60,000 shared expense is allocated by documented assets of $80 million and $40 million. The allocations are $40,000 and $20,000, subject to confirming that this basis is permitted and appropriate.
Mistake to avoid: Assuming every manager business expense may be charged to investors.
Source reference: cdda_menu Archives - IMDDA Membership Site
37. Control subscriptions and redemptions
Investor activity requires accurate eligibility checks, instructions, deadlines, unit calculations and cash movements under the vehicle's terms. Examine how exceptions and preferential arrangements are authorized. Distinguish an accepted redemption request from completed payment, particularly when restrictions or liquidity constraints affect settlement.
Worked example: An accepted $300,000 subscription uses a verified $12 unit value and therefore issues 25,000 units, assuming no applicable charges. Investor records and fund accounting should agree on both cash and units.
Mistake to avoid: Applying standard terms without checking the investor's applicable class or agreement.
Source reference: cdda_menu Archives - IMDDA Membership Site
38. Interpret audits within their scope
An audit opinion concerns specified financial statements under an identified reporting framework and period. Read the opinion, notes and any relevant modifications carefully. It does not establish investment merit or guarantee that every operational control is effective; separate control findings may require further evidence.
Worked example: A fund receives an unmodified audit opinion. A later review finds weak access controls at the manager. The opinion does not resolve that weakness because financial-statement assurance and access-control assessment address different matters.
Mistake to avoid: Treating an audit opinion as a blanket endorsement of the manager.
Source reference: cdda_menu Archives - IMDDA Membership Site
Compliance, Governance and Technology
39. Map applicable obligations to entities and activities
Regulatory analysis starts with the entity, jurisdiction, activity and investor context. Establish which requirements apply, who interprets them and how compliance is evidenced. Registration or authorization status should be verified where relevant, but it does not by itself establish sound controls or suitable investments.
Worked example: A manager operates through entities in two jurisdictions. The analyst requests an obligation map and responsible owners rather than assuming the home entity's framework covers every vehicle and marketing activity.
Mistake to avoid: Applying one jurisdiction's rules to all entities without checking their applicability.
Source reference: cdda_menu Archives - IMDDA Membership Site
40. Evaluate conflicts through actual allocation decisions
Conflicts arise when the manager or its personnel have competing interests across clients, products or personal activities. Examine identification, disclosure, controls and escalation. Allocation rules should address scarce opportunities and unfavorable outcomes as well as routine transactions.
Worked example: Two funds seek a limited investment, but one pays higher fees. The analyst checks whether the documented allocation method was applied and whether deviations received independent review.
Mistake to avoid: Assuming disclosure alone prevents conflicted decisions.
Source reference: cdda_menu Archives - IMDDA Membership Site
41. Assess investor identification and financial-crime controls
Where applicable, controls should identify investors and relevant beneficial owners, assess risk and escalate unresolved concerns. Examine responsibilities among the manager and service providers, including periodic updates and screening. Specific obligations depend on the vehicle and jurisdiction; outsourcing does not prove that coverage is complete.
Worked example: A subscription arrives through a corporate investor with unexplained ownership changes. The responsible team obtains clarifying documentation and escalates the unresolved identification issue under its applicable procedures before acceptance.
Mistake to avoid: Treating receipt of an identity document as a complete risk assessment.
Source reference: cdda_menu Archives - IMDDA Membership Site
42. Test compliance monitoring and breach handling
A compliance program needs controls that detect departures from applicable requirements and internal limits. Examine monitoring inputs, exception review, investigation, remediation and escalation. A low reported breach count can reflect effective compliance or weak detection; assess the process rather than the count alone.
Worked example: A portfolio limit report excludes unsettled trades. Adding pending purchases reveals an excess that was previously invisible, so the firm corrects both the exposure and the monitoring design.
Mistake to avoid: Interpreting an empty breach log as conclusive proof of compliance.
Source reference: cdda_menu Archives - IMDDA Membership Site
43. Assess governance through challenge and accountability
Governance allocates authority, oversight and responsibility for consequential decisions. Examine committee mandates, independence where needed, information quality, attendance and follow-through. Minutes should show substantive consideration and actions, while delegated responsibilities should have clear reporting and escalation paths.
Worked example: A valuation committee records disagreement over a property estimate, requests external evidence and documents its final decision. This demonstrates challenge more clearly than minutes stating that all valuations were approved.
Mistake to avoid: Using committee existence as a substitute for evidence of effective oversight.
Source reference: cdda_menu Archives - IMDDA Membership Site
44. Apply least privilege to system access
Users should receive access appropriate to their roles, with sensitive privileges separately controlled and reviewed. Examine joiner, role-change and departure processes, privileged accounts and authentication. Access controls should cover external services and data repositories as well as core investment systems.
Worked example: A former employee's trading access is removed, but their cloud-storage account remains active. The review identifies an incomplete departure process and requires verification across the full account inventory.
Mistake to avoid: Assuming termination in one system disables access everywhere.
Source reference: cdda_menu Archives - IMDDA Membership Site
45. Evaluate cyber incident detection and response
Cyber resilience includes detecting suspicious activity, assigning response roles, containing disruption and restoring trusted operations. Examine exercised response plans and evidence from incidents or simulations. Notification and reporting obligations require assessment under the relevant arrangements and jurisdiction rather than a universal timetable.
Worked example: A simulated account compromise shows that the team can disable access but cannot identify the incident decision-maker. The analyst records a response-governance gap and requests a repeat exercise after roles are clarified.
Mistake to avoid: Equating preventive software with a complete incident-response capability.
Source reference: cdda_menu Archives - IMDDA Membership Site
46. Distinguish business continuity from data backup
Backups preserve recoverable data; business continuity maintains or restores essential services, including people, vendors, communications and facilities. Assess recovery priorities, dependencies and demonstrated restoration. Recovery objectives should reflect actual business needs and be tested rather than inferred from backup frequency.
Worked example: Daily backups exist, but a restoration test takes two days while payment obligations arise within hours. The analyst identifies an operational recovery gap despite successful data preservation.
Mistake to avoid: Assuming a completed backup proves that critical operations can resume promptly.
Source reference: cdda_menu Archives - IMDDA Membership Site
47. Control data lineage and system changes
Data lineage traces information from source through transformations to reports. Change controls govern development, testing, approval and deployment of altered systems or models. Examine whether production changes are independently checked and whether reports can be reconciled back to reliable source records.
Worked example: A pricing-file format changes and a system imports blank prices as zero. Predeployment testing with missing-value cases would reveal the error; reconciliation identifies the affected holdings before reporting.
Mistake to avoid: Assuming automated processing makes source changes harmless.
Source reference: cdda_menu Archives - IMDDA Membership Site
Service Providers and Counterparties
48. Define provider responsibilities and independence
Assess administrators, auditors, custodians and other providers according to their actual contracted roles. Examine competence, resources, conflicts, information access and termination arrangements. Independence is task-specific: a provider may calculate a figure while relying entirely on manager-supplied inputs for a critical component.
Worked example: An administrator calculates net asset value but accepts private-asset marks from the manager without challenge. The analyst treats administration and independent valuation as separate responsibilities requiring separate evidence.
Mistake to avoid: Assuming an established provider performs every control associated with its title.
Source reference: cdda_menu Archives - IMDDA Membership Site
49. Read outsourced-control assurance for boundaries
A service-provider control report covers defined services, controls and periods. Review exceptions, excluded subcontractors and controls that the client must perform. Assurance over a provider's process does not establish that the manager has fulfilled its complementary responsibilities or addressed later changes.
Worked example: A provider report assumes clients review daily exception files. The manager does not perform that review, so the outsourced arrangement retains a control gap despite favorable provider assurance.
Mistake to avoid: Reading only the report's conclusion and ignoring required client controls.
Source reference: cdda_menu Archives - IMDDA Membership Site
50. Measure counterparty exposure beyond notional amounts
Counterparty risk concerns loss or disruption if another party fails to perform. Exposure depends on current claims, future changes, collateral, settlement and enforceable contractual arrangements. Notional amounts describe transaction scale but do not necessarily equal the amount at risk.
Worked example: A derivative has $40 million notional, a $2 million positive replacement value and $1.5 million of recognized collateral. Current unsecured exposure is $500,000 under those assumptions; future exposure still requires assessment.
Mistake to avoid: Equating derivative notional with current unsecured credit exposure.
Source reference: cdda_menu Archives - IMDDA Membership Site
51. Identify counterparty concentration and wrong-way risk
Counterparty concentration increases dependence on a particular institution or connected group. Wrong-way risk occurs when exposure rises as the counterparty's ability to perform deteriorates. Review economic relationships and collateral quality as well as the number of separately named counterparties.
Worked example: A lender accepts collateral issued by its own parent group. If that group weakens, the lender's credit quality and collateral value may deteriorate together, reducing the protection precisely when needed.
Mistake to avoid: Assuming collateral removes credit risk without examining its relationship to the counterparty.
Source reference: cdda_menu Archives - IMDDA Membership Site
52. Examine asset rights and custody arrangements
Identify where assets are held, whose records establish interests and which contracts govern their use, transfer or recovery. Distinguish custody, financing and collateral arrangements. Legal protections depend on documentation and applicable law, so unresolved rights or enforceability questions need appropriately qualified review.
Worked example: A prime broker agreement permits specified collateral reuse. The analyst investigates which assets are affected and obtains legal clarification rather than assuming every holding has identical protection if the broker fails.
Mistake to avoid: Inferring asset protection solely from the provider's name or reputation.
Source reference: cdda_menu Archives - IMDDA Membership Site
Findings, Recommendations and Monitoring
53. Write findings as evidence-linked conclusions
A useful finding identifies the observed condition, expected control or requirement, supporting evidence and potential consequence. Separate facts from interpretation and unresolved questions. This structure makes the conclusion reviewable and gives the manager a precise issue to address.
Worked example: Rather than writing 'weak operations,' the analyst records that four sampled payments lacked the required independent approval and explains the resulting risk of unauthorized transfers.
Mistake to avoid: Using broad judgments that cannot be traced to a specific observation.
Source reference: cdda_menu Archives - IMDDA Membership Site
54. Assess materiality in the investor's context
Prioritize findings according to plausible impact, likelihood, exposure and existing safeguards. Materiality depends on the investment and investor context, not simply the number of exceptions. A small observed error may reveal a weakness capable of producing much larger losses.
Worked example: A $200 payment error results from unrestricted beneficiary changes. Its amount is small, but the underlying control permits larger unauthorized transfers, making the process weakness more consequential than the observed loss.
Mistake to avoid: Ranking deficiencies solely by the dollar amount of the sampled error.
Source reference: cdda_menu Archives - IMDDA Membership Site
55. Make uncertainty explicit in the conclusion
Distinguish demonstrated weaknesses, plausible concerns and matters that remain unverified. Explain how evidence limitations affect the recommendation and what could resolve them. Missing evidence does not prove failure, but it can prevent a sufficiently supported conclusion about a critical control.
Worked example: The manager cannot produce restoration-test results. The analyst reports that recovery capability is unverified and requests a witnessed test, rather than stating either that recovery will fail or that backups guarantee success.
Mistake to avoid: Turning lack of evidence into unsupported certainty in either direction.
Source reference: cdda_menu Archives - IMDDA Membership Site
56. Integrate investment and operational recommendations
A recommendation should connect suitability, strategy risks, operational findings and contractual terms to the investor's objectives. State whether evidence supports proceeding, proceeding subject to conditions, deferring or declining. Serious operational concerns require explicit treatment even when expected investment returns are attractive.
Worked example: A strategy fits the investor's portfolio, but payment controls are deficient. The recommendation defers investment until independent authorization is implemented and verified, with the investment thesis documented separately.
Mistake to avoid: Averaging a critical control failure away using favorable investment characteristics.
Source reference: cdda_menu Archives - IMDDA Membership Site
57. Design mitigation around the root cause
A mitigation plan specifies the deficiency, underlying cause, action owner, deadline and evidence of completion. Prefer measures that change the weak process rather than merely acknowledge it. Distinguish immediate containment from a durable correction and establish how each action will be verified.
Worked example: Recurring reconciliation delays stem from absent backup staffing. Clearing the current backlog contains the issue; training a deputy and testing coverage addresses the recurring cause.
Mistake to avoid: Treating removal of today's backlog as proof that the process is repaired.
Source reference: cdda_menu Archives - IMDDA Membership Site
58. Evaluate residual risk after remediation
Residual risk is the exposure remaining after controls and mitigation operate. Reassess both implementation and effectiveness; a completed policy document may leave practical weaknesses unresolved. Acceptance depends on the investor's risk constraints and decision authority, not on the manager's declaration that the issue is closed.
Worked example: A second payment approver is appointed, but both approvers can alter beneficiary records without independent confirmation. Unauthorized-transfer risk is reduced only partially, so the finding remains open pending further control changes.
Mistake to avoid: Closing a deficiency when an action is completed without testing its effect.
Source reference: cdda_menu Archives - IMDDA Membership Site
59. Build a monitoring plan with actionable measures
A monitoring plan defines what to review, how often, which evidence to use, who is responsible and how findings affect decisions. Frequency should reflect risk and information needs. Measures must connect to specific vulnerabilities rather than becoming a generic collection of periodic reports.
Worked example: For a manager with concentrated funding, monitoring includes lender exposure, financing maturity and collateral liquidity. A documented deterioration prompts review of the funding assessment and investment recommendation.
Mistake to avoid: Collecting reports without assigning responsibility or defining a response.
Source reference: cdda_menu Archives - IMDDA Membership Site
60. Use events to reopen the relevant review
Ongoing due diligence should respond to changes such as key departures, ownership transitions, provider replacement, strategy drift or market disruption. Identify which earlier assumptions the event affects and obtain targeted evidence. A routine calendar review may be too slow when the investment or control environment changes materially.
Worked example: The chief operating officer departs unexpectedly. The analyst reassesses payment authority, reconciliation oversight and succession coverage immediately rather than waiting for the scheduled annual review.
Mistake to avoid: Assuming the original approval remains valid after its supporting assumptions change.
Source reference: cdda_menu Archives - IMDDA Membership Site
Sources
Source checks:
All study guides