Picture the screens a fund actually looks at for one of its portfolio companies. There’s the portfolio-monitoring dashboard: revenue, burn, growth rate, the same figures that were in the last board deck. Most months, it’s reassuringly green.
Now picture the other screen. The one that would tell you the founder was just named in a fraud investigation, that a subsidiary turned up on a sanctions list, that the company’s largest customer is a shell with no real operations behind it. For most funds, that screen doesn’t exist. The performance dashboard stays green right up until the day the reputational one nobody built would have been flashing red. Nobody chose to leave it unbuilt. It just isn’t what either of the tools the fund already owns was designed to show.
And the gap is costly. A study carried out by HEC Paris, the World Bank, and Singapore Management University showed that private equity firms which had a number of environmental and social incidents above the median among their portfolio companies were much less likely to secure a follow-up fund; 40% of these firms were unable to do so compared with a base figure of about 25%. The striking point is the area in which the damage appeared: it was in raising funds, not in the performance of the funds. The companies themselves were usually doing well. Performance was never the risk.
The reason this keeps happening isn’t negligence. It’s a category problem. A portfolio company is two things at once, an investment and a third party, and the software market is split into two categories that each handle only one of them. The risk that matters most falls in the overlap between them, and neither category was built to catch it. Understanding that overlap is the whole point of this piece.
A portfolio company is two things at once
Hold both truths in your head at the same time, because the whole problem comes from treating them separately.
As an investment, a portfolio company is something you want to grow. You track its KPIs, you sit on its board, you care about revenue and runway and the path to an exit. This is the lens every fund is built around, and it’s the right one for the job it does. The mistake isn’t using that lens. It’s assuming it’s the only one a portfolio company needs.
As a third party, the same company is something you’re exposed to without controlling. Its founder’s conduct, its sanctions and regulatory standing, its litigation, its reputation, all of it can land on your fund, and a board seat and some information rights don’t give you the power to prevent any of it. We made the full case for that in our piece on applying third-party risk management to portfolio companies, and the ongoing-monitoring version of the argument in Beyond Onboarding. Here, take it as given: the company you own is also, in every way that creates risk, a third party. The question is why your tools don’t treat it as one.
Two tool categories, each built for half
The reason is that the market solved two different problems with two different kinds of software, and a portfolio company sits across both.
Portfolio-monitoring and management tools are built to track financial and operational performance. They pull in KPIs, roll up metrics across the book, and show you how the investment is doing, mostly from data the company reports to you. They’re genuinely good at the investment view. But they measure performance, and they rely on the company’s own reporting, which makes them structurally blind to external conduct risk. A founder’s indictment doesn’t show up in a metrics roll-up, because nobody files it there.
The tools designed for managing vendors and those provided by third parties were created with the vendor relationship in mind. In their world, the typical elements are security questionnaires, service-level agreements, contracts, and attestations – the various measures you put in place around a supplier. The entire approach is based on the idea of having a vendor that you pay, not a company which you own a third of, and it focuses on onboarding and contracting rather than on the continuous, external monitoring of a company’s founders, owners, and reputation over the period that you hold the company. The framework these tools are based on is the third-party risk lifecycle which has been formalised by banking regulators, and while this is a reasonable approach, it was developed for the purposes of procurement, not for equity. If you ask a vendor-risk platform to keep an eye on a founder’s reputation by referring to news and court records over the next five years, you’re putting it to use in a way that it was never designed to handle.
So one category watches performance you’re told about, and the other manages a supplier you don’t own. Line them up against a portfolio company and you can already see the seam running down the middle.
Why the market ended up split in two
It might be worth taking a moment to consider how we arrived at our present situation, since the gap is not the result of any single vendor making a mistake; rather, it’s built into the origins of these tools. Portfolio-monitoring software developed on the deal and operations side of the business, being designed to deal with the question that partners really asked: how are our investments doing? All its features, including the metrics, the aggregate figures, and its dependence on company reports, stem from that single question.
Vendor-risk software developed in a completely different place, within the fields of procurement and information security, in order to deal with a different issue: can we safely allow this supplier access to our systems and our data? That is why there are questionnaires, certifications, and contract clauses. These are two genuine kinds of tools, each of which effectively addresses a real problem. The problem is that a portfolio company is not a simple investment-and-operations issue nor a straightforward procurement issue; it is both of these at the same time, and no one originally set out to create a solution for this awkward combination in the middle, since it didn’t neatly fit with either of the teams that were buying software. Therefore, the gap remained not because anyone had decided it was acceptable, but because it wasn’t anyone’s responsibility to build it and wasn’t part of anyone’s budget to purchase it.
The overlap is exactly where the damage is
Here’s the uncomfortable part. The risk that actually sinks funds doesn’t sit neatly inside either category. It sits in the overlap between them.
Consider the nature of that risk: negative media coverage involving a founder or a recently hired executive, a change in someone’s sanctions or their politically exposed status, new litigation, a regulatory action, a shift in beneficial ownership that alters the actual parties with whom you’re doing business, difficulties arising at a major customer or supplier. All of these are external factors and so do not show up in a performance dashboard. Each one relates to conduct and reputation rather than to operational metrics, and all pertain to companies with which you are exposed but which you cannot control. It is exactly this combination—being external, being based on conduct, and relating to a company that you own but cannot influence—that neither of the two tool categories was designed to address.
It’s also, no coincidence, the risk involved in reputational contagion as a result of the opening. The scandal which delays your next fundraise becomes apparent to the public first in the filings, in the local press, on watchlists, and in court records, long before it makes it to the headlines. It is right in this area of overlap, and that is precisely the reason it goes unnoticed. By the time it has become a figure in terms of a lost customer or a frozen account, it has already been visible to the public for months.
The four risks that live in the overlap
It’s useful to identify exactly what is present in that gap, since ‘conduct risk’ remains abstract until you analyse it further. There are four types of such risk and each of them is not visible on a performance dashboard and is not touched upon in a vendor questionnaire. They almost never occur by themselves; one usually leads to the next, for example a regulatory action following an adverse media story or an ownership change which brings in a sanctioned counterparty.
Founder and executive conduct. Reputationally, the people running a portfolio company are the portfolio company. An indictment, a fraud allegation, a pattern of adverse media that follows a founder from one venture to the next, none of it shows up in revenue, and none of it was captured by a form filled in at onboarding. Yet it’s the single most common way a portfolio scandal begins.
Sanctions and politically exposed status. A founder, an owner, or a key counterparty can be sanctioned, or become a politically exposed person, at any point after you invest. The exposure is immediate and, in the case of sanctions, strict, and a performance tool has no reason to go looking for it.
Litigation and regulatory action. Lawsuits and regulator investigations are matters of public record, and they’re often the earliest formal sign that something has gone wrong. A fund watching only its board reports hears about them late, if it hears about them at all.
Changes in ownership and counterparty. After you have made an investment the person who controls a portfolio company may change and so may the one it relies on. Whether the new owner is involved, the supplier two links down the chain turns out to be sanctioned, or the customer turns out to be a shell, each of these cases alters your risk even though there is no change to any of the figures on the dashboard.
A failure in the gap, step by step
It usually unfolds in the same manner. A fund invests in a promising company, carries out proper due diligence when it first enters the investment, and all the checks turn out to be satisfactory. The founder comes across as impressive, the figures are solid, and the portfolio dashboard turns green and remains that way. However, after eighteen months, a regulator launches an investigation into the founder’s earlier business, and a local media outlet reports on it. Since nothing has happened to revenue, the performance monitoring tool registers nothing and the vendor-risk questionnaire—completed only at onboarding—also shows nothing. The fund becomes aware of the situation when a journalist asks for the fund’s comments regarding one of its portfolio companies, which is nearly the worst possible way of finding out. All the systems that the fund has paid for functioned precisely as they were designed. The risk had simply been situated in an area that none of the systems were monitoring, and the damage accumulates because the incident that embarrasses you in public is the one your investors remember when you next seek funding.
If external and continuous monitoring is carried out during the same timeline, the situation fails a lot earlier. The regulator’s filing and the local news story come to light within days of occurring, and the fund becomes aware of them while they are still small, allowing it to decide how to respond in a quiet manner and on its own schedule, rather than being suddenly confronted by a reporter. It’s the same facts, completely different outcome, and the only thing that changed was whether or not the right screen was being watched.
Why bolting the two tools together doesn’t fix it
The obvious answer is to “use both”. If you run a portfolio-monitoring platform and a vendor-risk tool together, the gap will certainly disappear. The idea is plausible, but it still isn’t sufficient.
If you combine the two, you end up with a performance dashboard and a vendor questionnaire. Both of them rely heavily on information provided by the company and are in effect static snapshots—the dashboard is updated at regular intervals and the questionnaire is completed at onboarding and possibly at renewal. Neither of them carries out what the overlap actually calls for, namely continuous, externally derived, source-linked monitoring of the people and activities within a company you are involved with. Two incomplete pictures of the wrong sort do not together provide you with external risk intelligence. You can have both types of tool and yet still be unaware of the founder’s criticism. The issue has never been that there aren’t enough tools; it’s that both of them are focused on the wrong kind of signal. Adding a third instance of the same type of signal—more performance metrics or another questionnaire—makes no difference. What you need is a completely different kind of signal: one that comes from outside the company and relates to the people and their actions.
What actually covers the overlap
Covering the gap takes a different capability, effectively a third category, and it’s worth being specific about what it has to do.
It must be based on external information, drawing on public sources rather than on what the company decides to report. It should include not only the company but also the individuals involved, such as the founders, executives, owners, and key counterparties, since it is precisely among these people that conduct risk exists. The system has to operate continuously, so that when a sanctions list is updated or an indictment is issued it is immediately brought to your attention rather than waiting until the next board meeting. It needs to be structured in tiers so that the level of scrutiny corresponds to the company’s actual exposure rather than treating a domestic seed investment the same as a cross-border fintech. It also has to be source-linked, meaning that each finding can be verified and presented to an investment committee or to an LP. This is a distinct type of tool from a performance dashboard and also different from a vendor questionnaire, and it is the one that most funds still lack. It is important to note what it is not: it does not aim at replacing your portfolio dashboard or your onboarding checks, both of which carry out their own functions well. It is additive in nature and fits in alongside the other tools you already use, addressing the risk that lies between them and turning a blind spot into something that can be seen and acted upon. In most firms it is the only one of the three capabilities that is currently missing, which is the reason why adding it tends to have a greater impact on the risk profile than any amount of adjustment made to the other two.
The overlap isn’t the same size at every fund
The gap exists for every kind of investor, but it doesn’t look the same everywhere, and that matters for how much you should worry about it.
For venture funds, the risk is concentrated in people. Early-stage companies are their founders far more than they are their financials, so a founder’s conduct, history, and reputation carry an outsized share of the risk, and there are often dozens of small bets to keep an eye on at once. For private equity and buyout firms, the cheques are larger and the control is greater, but control is not the same as oversight of conduct, and a controlled company’s scandal lands even harder on a firm that was visibly in charge. Growth investors sit between the two. Family offices often have the least dedicated compliance capacity of all, which tends to make the gap widest exactly where there’s the least resource to cover it.
What ties all this together is that the level of oversight should correspond to the amount of exposure rather than to the size of the fund. An individual investment in an early-stage company by a high-risk founder in a difficult jurisdiction can involve greater conduct risk than a large and unexciting domestic buyout. This is the reason for introducing tiers: instead of applying the same level of scrutiny to all holdings, or much more commonly applying none at all, you should match the intensity of your monitoring to the level of exposure for each individual investment. It is often the firms that are most exposed who are also the ones most certain that they are small enough not to need such scrutiny—until one poor investment proves them wrong.
What to ask before you buy another tool
When you are deciding whether something really deals with the overlap or is merely providing a fourth dashboard, a few questions quickly get past the sales talk.
- Is it external, or self-reported? If the data comes from what the company tells you, it will never show you what the company would rather you didn’t know. The overlap needs outside sources.
- Does it watch the people, not just the entity? Conduct risk lives with founders, executives, owners, and counterparties. A tool that only tracks the company misses most of it.
- Is it a continuous process or one that takes place at a specific point in time? If the check is carried out at the time of onboarding or refreshed on a quarterly basis, there will be long periods during which the system is blind. The risk that you are concerned about occurs between these checks.
- Can it be divided into tiers? Trying to apply cross-border fintech standards to a domestic seed is wasteful in the first case and deprives the other of adequate attention. The level of intensity ought to correspond to the amount of exposure.
- Can every finding be traced back to its source? An alert that you can’t verify actually requires more work rather than less and wouldn’t hold up when presented before an investment committee or an LP.
If a tool gives a negative answer to the first three questions, then it is merely a performance dashboard or a vendor questionnaire using different branding and won’t bridge the gap. The objective has always been not to accumulate more tools but to ensure that one of them is actually focused on the area of overlap. It is worth asking the single question—Is anything we own aimed at the gap—before the next renewal rather than waiting until after the next incident.
The gap is organisational, too
The division in the tooling reflects a division regarding who is responsible for the problem. The deal teams are in charge of performance; they work from the portfolio-monitoring perspective. Compliance—where it is present at a fund—takes responsibility for vendors and the onboarding diligence. As for the ongoing conduct and reputation risks associated with the portfolio companies, neither party by default owns them; instead, these risks lie between the different departments.
It’s important to point this out since this is the reason why the risk is not monitored: it’s not because people have decided that it doesn’t matter, but rather because no one has been given the responsibility for it. Nowadays investors are more and more asking about how fund managers keep an eye on risk in relation to their investments, and the questions included in their due diligence checks now deal directly with this issue, so the reply ‘it wasn’t anyone’s job’ will not work during a fundraise. You should decide in advance who is responsible for portfolio conduct risk, since after an incident it will be too late to make that decision. The companies that deal with this matter effectively usually assign a single team with a clear mandate and provide it with a tool designed for the purpose, rather than relying on the gap between two different teams to resolve itself.
Cover the overlap, not just the halves
The money that is caught by a portfolio company usually failed to pick up on a performance signal but did fail to detect a conduct one, in the gap between the tool which monitors the numbers and the tool which manages the vendors, since no one was looking there. It is a quiet kind of failure until it becomes a loud one, and by the time it has become loud, the most inexpensive opportunity to have picked it up—months earlier, when it was still just a filing or a local story—is no longer there.
Beady is designed to cover the area of overlap. It keeps a continuous watch over the portfolio companies and the individuals associated with them, monitoring adverse media, sanctions and changes involving PEPs, litigation, regulatory actions, and shifts in ownership, with the level of monitoring matching the degree of exposure. The system is external rather than relying on self-reported data, and each signal is traceable back to its original source so that it can be verified and presented to an investment committee or to an LP. It is not a performance dashboard and it is not a vendor questionnaire; it is the layer that identifies the types of risk that the other two were not built to detect. It is the screen referred to at the opening of this article, the one that would have been flashing even though the dashboard remained green.
If you want to see what continuous, external monitoring of your portfolio would actually surface, book a demo and we’ll run it against your holdings.
