Start with a figure that should stop a GP cold. When a fund’s portfolio companies pile up environmental and social incidents, its ability to raise the next vehicle drops sharply. In a study from HEC Paris, the World Bank, and Singapore Management University, around 40% of firms with an above-median incident count couldn’t raise a follow-up fund, compared with about 25% normally. The surprise is where it bit. Not performance, which largely held, but fundraising. Reputation, not returns.
Now the scenario behind the number. A fund runs months of diligence, clears the committee, sends the wire, and turns to the next deal. Two years on, the company is in the press for a bribery investigation or a fraud claim. The fund’s name rides along in every story. Existing LPs get nervous. The next close, supposedly routine, drifts by two quarters.
Here’s the part that stings. In the same firm, the operations team is putting the expense-filing software through a formal vendor-risk review, questionnaire and annual reassessment included. The company the fund owns a third of, the one generating the headlines, gets a quarterly board deck and a catch-up call.
The risk that can actually end a fund is watched less carefully than the tools it rents by the seat. This piece closes that gap. And the reassuring part is that the fix isn’t exotic. You already run the discipline it needs somewhere else in the building.
A portfolio company is a third party. Start there.
Third-party risk has a plain definition. It’s the exposure you take on from a party whose conduct can hurt you but whom you don’t fully control. Your cloud provider, your outsourced payroll, your law firm. You don’t run their operations, yet their failures become your problem, so you screen them, tier them, and keep an eye on them.
Read that definition again with a portfolio company in mind. You put capital in. You may hold a board seat and some information rights. What you almost never hold is operational control. A minority position clearly doesn’t give it to you, and even a majority stake rarely means you’re making the daily decisions that create risk. The founder still hires. The executives still sign the contracts, pick the counterparties, and talk to the press. You carry the exposure. Someone else holds the reins.
That is third-party exposure in its purest form. We tend to ignore this because of an “ownership exemption” mindset—a quiet belief that investing capital somehow frees you from the discipline you’d demand from any other external party. It doesn’t. In reality, portfolio risk is often far more dangerous than vendor risk because your capital—and your reputation—is directly on the line.
You already own the playbook
Here’s what makes the gap frustrating rather than merely unfortunate. The discipline for managing this exact kind of exposure already exists, it’s mature, and your firm probably runs a version of it.
Third-party risk management isn’t a novel idea. Banking regulators have spent years formalising it. The 2023 interagency guidance from the Federal Reserve, the FDIC, and the OCC sets out sound practice for managing third-party relationships across their whole life cycle, and it rests on a principle that travels well beyond banks: you assess a party before you take it on, and you keep assessing it for as long as you’re exposed.
Funds already do part of this instinctively. The pre-investment diligence process is, in effect, third-party due diligence performed to a very high standard. And thanks to investor expectations and rules like the EU’s sustainability disclosure regime, most funds already track their portfolio companies on ESG factors and report on them. The muscle exists. The ILPA due diligence questionnaire that investors send has entire sections on how a manager oversees risk across its holdings. So the question was never whether funds can do structured oversight. It’s why that oversight so often stops the moment the deal closes, and why it covers such a narrow slice of risk when it does carry on.
The lifecycle maps almost perfectly
The handy thing about borrowing third-party risk management is that its shape already matches how a fund runs. The lifecycle moves through clear stages, and every one of them has an investing equivalent.
Planning and risk assessment is your thesis and sourcing. Due diligence and selection are your pre-investment work, the stage funds are genuinely great at. Contracting is your term sheet and shareholder agreement, where you set information rights, inspection rights, and reporting covenants. Ongoing monitoring is your post-close oversight. Termination is your exit.
Line the two up and the weak link is obvious. Funds throw resources at diligence and treat ongoing monitoring as an afterthought, usually a board seat and a quarterly report. In a real third-party programme it’s the reverse: monitoring is the whole point. Diligence tells you what’s true on signing day. Monitoring tells you what’s true every day after, and that’s where most of the risk you care about actually lives, because it hasn’t happened yet when you sign.
The lifecycle view also shows you where your leverage is, and it sits earlier than funds tend to use it. The moment to lock in the information and monitoring you’ll want later is the term sheet, not the aftermath of a problem. Writing in real reporting rights and audit access up front is routine in third-party risk. It gets a lot harder once you’re in and something has already gone wrong.
Tier your portfolio like a risk inventory
One more idea to lift straight from the discipline: not every third party deserves the same scrutiny, and pretending otherwise just burns effort on low-risk relationships while starving the high-risk ones. Third-party programs handle this by tiering by criticality and matching oversight to the tier.
Portfolios need the same treatment. A domestic productivity-software seed with a clean, well-known founding team is not the same risk as a cross-border fintech operating in a lightly regulated market with founders who sit close to politically exposed persons. Treating them identically means you’re either over-monitoring the first or, far more dangerously, under-monitoring the second.
Tier by real exposure. Sector and its regulatory intensity. Jurisdiction and its rule-of-law and sanctions profile. Customer and counterparty concentration. Key-person dependence. Then set monitoring intensity to match, with continuous coverage on the top tier and a lighter, periodic touch on the rest. The aim isn’t to watch everything equally. It’s to watch the things that can hurt you in proportion to how much they can hurt you.
The risks that show up after the check clears
What is ongoing monitoring actually looking for, once you commit to it? The signals that diligence structurally can’t catch, because they emerge after you’ve invested.
Adverse media about a founder or a newly hired executive. A change in someone’s sanctions or politically exposed status. Fresh litigation naming the company. A regulatory action or investigation. A shift in beneficial ownership that quietly changes who you’re really in business with. Trouble at a major customer or supplier that flows back to your company’s revenue or reputation. None of this sits in a data room at signing. All of it is knowable in near real time, if someone is watching the right public sources instead of waiting for the quarterly deck or the reporter’s call.
This is also where the reputational contagion from the opening becomes concrete. The scandal that taints a fund almost never appears from nowhere. It builds in public first, in filings, in local press, on watchlists, in court records, usually well before it reaches the national story that puts the fund’s name in the headline. The difference between managing it and being blindsided by it is simply whether anyone was looking during the gap.
Concentration and fourth-party risk
Two more ideas are worth borrowing, because funds rarely map either and both can bite.
Start with concentration risk. A serious third-party programme worries about leaning too hard on any single provider. The portfolio version is correlated exposure: a cluster of companies in the same sector, the same country, or depending on the same few counterparties, so one shock hits several holdings at once. If you’ve only ever read your portfolio as a list of separate bets, and not as a map of shared exposure, that’s a gap worth closing.
Then there’s fourth-party risk, which is just your third party’s third parties. Your vendor’s subcontractor is your fourth party, and a good programme follows that thread. Every portfolio company sits on its own web of suppliers, customers, and partners, and a sanctioned counterparty or a breached supplier two steps down the line can still land on you. Mapping every node isn’t realistic. But for your high-tier companies, knowing who they lean on is part of knowing your own exposure.
This is a fund-level compliance question, not a nice-to-have
It would be easy to file all of this under operational hygiene. That undersells it. This is franchise risk and fiduciary risk, and the outside world increasingly treats it that way.
Regulators have shown that they are prepared to follow the chain of responsibility to its higher links. Whenever a portfolio company breaks the law, supervisory bodies and enforcement authorities have reached for the sponsor instead of stopping short at the company. Investors, on their side, are asking increasingly pointed questions about the manner in which you oversee what you own, and their due diligence questionnaires now inquire into portfolio risk management without any indirection. The body of research on contagion reminds us, moreover, that the market factors this in regardless of whether you choose to. The reputational cost of a collapse within the portfolio settles on your ability to raise your next fund, and therefore on the underlying economics of the firm.
Bringing third-party discipline to your portfolio isn’t caution for its own sake. It protects the two things a fund actually runs on, its returns and its reputation, and it lets you show an investor or a regulator that you were watching.
What bringing the discipline over looks like
In practice, importing third-party risk management into a portfolio comes down to a handful of moves.
- Tier every portfolio company by real exposure, not by cheque size or how much you like the founders.
- Set monitoring cadence by tier, with continuous coverage for high-risk holdings and a lighter periodic review for the rest.
- Negotiate information, reporting, and audit rights at the term sheet, while you still have leverage.
- Screen founders, executives, and key counterparties on an ongoing basis for adverse media, sanctions, litigation, and regulatory action, not just once during diligence.
- Map concentration across the portfolio and fourth-party exposure for your highest-risk companies.
- Keep a source-linked, auditable record of what you saw and when, so it stands up to an investor review or a regulator’s question.
- Define escalation paths, and where the risk warrants it, know what would trigger a harder conversation or an early exit.
Adopting this discipline doesn’t turn an investment firm into a rigid compliance bureaucracy. Scrutiny scales alongside actual risk exposure—protecting downside without slowing down growth.
Point the discipline inward
You already manage this kind of exposure carefully. Just not here. A portfolio company is a third party you happen to own, and the ownership exemption lasts only as long as you let your stake obscure that. Strip the illusion away and the move is obvious: take the discipline you apply to every other party you can’t control, and aim it at the companies whose problems will carry your name. That’s the model we made the case for in Beyond Onboarding.
Running it is what Beady does. It monitors companies and their people across more than 100,000 public sources, surfacing adverse media, sanctions and PEP changes, litigation, and regulatory action as they happen, tiered so the effort tracks the exposure. Because each signal links back to its original source, you can verify a finding and show it to an investor or a regulator, rather than accept a number on faith. Across a portfolio, monitoring shifts from a quarterly deck to a live picture.
If you want to see what that oversight would turn up in your own holdings, book a demo and we’ll run it against them.
