CCO Resource Hub: Oversight Resources

Chief Compliance Officer Committee

Members’ Oversight Resources, Including Questionnaires and Certifications

Over the years, at the request of members of the Committee, the Institute has collected from members of the Committee various resources that the members use to oversee their vendors and service providers. These resources often consist of questionnaires or certifications members ask their vendors to sign affirming compliance with various legal requirements or the fund’s/adviser’s policies and procedures. The resources members have shared with us are available through the following links:

Intermediaries and Fund Distributors

Resources Relating to the Intermediaries and Fund Distributors, Including Questionnaires Members Use as Part of their Oversight Process

Subadvisers

In 2023, a Working Group of the CCO Committee completed a multi-year project to develop an Annual Due Diligence Document that fund advisers could use to oversee their subadvisers. The goal of this project was to come up with a uniform questionnaire that a subadviser would only have to complete once a year. After completing the Questionnaire, the subadviser could provide all fund advisers that oversee the subadviser’s activities a copy of the document to satisfy the funds’ annual due diligence oversight. The document, which is 139 pages in length and includes 192 questions, was designed to be comprehensive in order to provide fund advisers the vast majority, if not all of, the information they may be interested in when reviewing a subadviser’s activities. To fulfill the Committee’s goal of making the due diligence process more uniform and, therefore, more efficient, the Institute encourages members to consider using this document to conduct the annual due diligence of their subadvisers. The document was designed to be used in an electronic format so members can incorporate it into their systems to facilitate their review and analysis of the information in the Questionnaire. We have also encouraged members to share this document with any consultants or vendors they retain to assist with their oversight of the funds’ subadvisers. Below are links to both a pdf version and a word version of the Questionnaire:

In 2024-25, ICI asked members for the names of vendors that assist advisers and/or sub-advisers with the due diligence questionnaire process. We compiled a list of those vendors (listed in alphabetical order) in the following document, which may be updated periodically.

  • List of DDQ Vendors (2025) (pdf) [Note: ICI does not endorse any of the vendors on this list and simply provides their names as a member resource.]

Miscellaneous Vendors

Resources members use to oversee the following have been combined into one compilation. This compilation covers:

  • Fund Administrators
  • Fund Accounting
  • Transfer Agent
  • Custodians
  • Subadvisers
  • Expert Networks
  • Blue Sky Administration
  • Pricing Vendors
  • AML and
  • Distributors of Pooled Vehicles

In the compilation, the above documents are organized by the type of vendor they are used to oversee.

The CCO Oversight Resources section of this Resource Center also includes resources to oversee the following:

OFAC Compliance

On May 2, 2019, the U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) published A Framework for OFAC Compliance Commitments (the “Compliance Framework”). Through this publication, OFAC “strongly encourages” subject to OFAC to utilize “a risk-based approach to sanctions compliance by developing, implementing, and routinely updating a sanctions compliance program (SCP).” The Framework discusses in detail issues a firm may want to consider in connection with developing and maintaining an SCP. Accordingly, as members think about their OFAC compliance efforts they may want to be familiar with these resources:

Third-Party Oversight Resources

OCC Resources

Like mutual funds, federally registered banking institutions often rely on the services of third parties to conduct their operations. In light of this and the risks associated with such relationship, the Office of the Comptroller of the Currency has published two bulletins on this topic. The first bulletin, which was published in 2013, discusses in detail issues that such institutions should consider when considering retaining a third-party service provider and provides guidance on how these relationships should be overseen through the duration of the relationship. [Notwithstanding the age of this bulletin, its information remains valuable.] The second bulletin, which was published in 2017, supplements the information in the 2013 bulletin with Frequently Asked Questions. This information may be valuable to compliance officers as they think about their third-party relationships. You can access these bulletins through these links:

Creating an Eight Step Program to Mitigate Third-Party Cyber Risk

In June 2019, FinOps held a webinar with Joanna Fields of Aplomb Strategies in which she discussed the cybersecurity risks associated with third-party relationships. [Aplomb Strategies describes itself as a “Financial Market Structure Consultancy Offering Regtech Development Solutions.” See https://aplombstrategies.com/about/. Joanna Fields is the Founding Partner of the firm.] During this webinar, which was conducted in a Q&A format, Ms. Fields identified several issues and questions that firms may want to think about in overseeing their vendors’ cybersecurity programs. FinOps agreed to let ICI publish the transcript of this webinar as a resource to our members.


The documentation provided by ICI that may be accessed by committee and task force members is restricted to members use only and not for distribution or reproduction. Documentation may be used internally at member organizations as needed to facilitate committee and task force initiatives.