Ask ten institutional investors what operational due diligence (ODD) involves and you may get ten different answers. For some, it is a thorough programme: in-depth initial reviews, independent background checks, onsite visits across jurisdictions, analysis of audited financials and detailed reporting to the investment committee. For others, it is a leaner exercise built around periodic questionnaires, virtual meetings and targeted reviews when a concern surfaces. Practice also splits on timing. Some treat ODD mainly as a gate at the point of appointment, while others monitor providers continuously for as long as they hold assets with them. Two institutions can therefore describe their ODD in almost identical terms while spending very different amounts and getting very different levels of assurance.
That variation matters, because deciding who should carry out ODD only makes sense once you are clear about what it needs to cover. Institutions can run it entirely in-house, hand it to a specialist provider, or combine the two. There is no single right model. However, the larger and more complex the portfolio, the more institutions tend to keep the judgement and final decision in-house while drawing on external specialists and technology for data, capacity and specialist domains such as cyber. Where you sit on that spectrum should be a deliberate choice, shaped by governance requirements, portfolio complexity, internal capability, cost and the need for independence.
This article sets out the three models fairly, explains why many large asset owners settle on an insourced or hybrid approach, and closes with a short set of questions to help you locate your own programme. Why the question matters now?
For many institutions, ODD began as a gate: a questionnaire and an onsite visit before the first allocation, with a periodic refresh after that. That model is giving way to continuous oversight, not only of investment managers but of the custodians, fund administrators and other providers around them. We explore that shift in From RFP to Ongoing ODD: Closing the Monitoring Gap.
Several pressures are converging. Manager line-ups are broadening, particularly into private equity, private credit and other illiquid strategies that call for a different diligence approach from liquid funds. In the Standards Board for Alternative Investments’ (SBAI) 2024 Operational Due Diligence Practices Survey, roughly half of respondents said their approach to private markets differs markedly from their approach to liquid strategies, and credit and digital assets were among the areas where teams felt their knowledge was weakest.
Expectations of evidence have risen too. Boards, trustees and supervisors increasingly want to see that oversight is ongoing and documented, not simply that a review took place at onboarding. Australia’s CPS 230 is one clear example: APRA’s guidance places ultimate accountability for overseeing operational risk management, including service provider arrangements, with the board, which is also expected to review risk and performance reporting on material service providers. Our APRA CPS 230 compliance guide looks at this in more detail.
At the same time, the scope of “operational” has widened. Cyber security, operational resilience and third- and fourth-party dependencies now sit squarely within ODD, alongside governance, valuation and fund administration. The SBAI survey found teams under real strain as a result, citing rising volumes, more complex reviews and an ever-wider range of required expertise. Some 41% of respondents said they do not always have enough time to complete a review.
The result is that the question facing most institutions is no longer whether to do ODD, but who should do which parts of it.
The ODD spectrum explained
In practice, ODD resourcing sits on a spectrum rather than being a binary choice. Three broad models are common.
Model | How it Works | Who Owns the Opinion | Often Suits |
| Fully insourced | An in-house team runs questionnaires, on-site or virtual visits, analysis and ongoing monitoring | The institution | Well resourced programmes, large, concentrated or complex mandates |
| Fully Outsourced | A specialist provider conducts reviews and issues opinions, ratings or reports | Formed by the provider and relied on by the institution | Smaller investors and those without dedicated ODD staff |
| Hybrid (co-sourced) | The in-house team owns the framework, risk appetite and final decisions; specialists and platforms supply data, capacity and expertise | The institution, informed by external input | Institutions with broad or growing provider bases |
Few institutions sit neatly at either end. Even fully insourced teams usually buy in some data, and even fully outsourced programmes need someone internally to read, challenge and act on the provider’s findings
The case for insourcing ODD
The strongest argument for an in-house function is accountability. Whatever support an institution uses, the decision to appoint, retain or exit a manager is its own, and boards and supervisors expect the reasoning behind that decision to sit with the people who make it. An internal team that forms its own view is well placed to explain and defend it.
Insourcing also builds institutional knowledge. Analysts who review the same managers and providers over several years develop context that is hard to replicate: how a manager responded to past findings, which issues were remediated and which were deferred, and how the relationship has evolved. Direct relationships with managers’ operations, compliance and technology teams make it easier to ask difficult questions and receive candid answers. That advantage is strongest in familiar territory, however, and it takes years to build in a new asset class.
Finally, an in-house team can integrate ODD tightly with investment decisions and governance, contributing to investment committee discussions as they happen rather than through a report delivered at the end of a process.
Where insourcing strains
- Cost and scalability. Each additional manager, vehicle or provider adds workload, and experienced ODD professionals are in short supply. Headcount rarely grows as fast as the portfolio.
- New and less familiar asset classes. As allocations extend into areas such as private credit, infrastructure, insurance-linked securities, litigation finance, royalties and digital assets, in-house teams are often asked to assess operating models they have not reviewed before. These strategies bring their own operational questions: how illiquid or hard-to-price assets are valued, how bespoke structures and side vehicles are administered, who holds the assets and how, and whether a newer or smaller manager’s infrastructure has kept pace with its growth. A team with deep experience of listed equity and fixed income managers will not always know what good looks like here, or which questions to ask first.
- Specialist coverage. Few ODD teams include cyber security specialists, and the same is often true of custody and fund administration. See Why Cyber Risk Belongs in Operational Due Diligence?
- Coverage gaps. As portfolios grow, teams are forced to prioritise, and lower-tier relationships can go long periods with limited oversight, a risk we discuss in How Often Should ODD Be Refreshed?
The case for outsourcing ODD
Outsourcing deserves a fairer hearing than it sometimes gets. For many institutions it is not a compromise but the right answer.
A specialist provider offers immediate access to experience across a wide range of strategies, jurisdictions and service providers, without the time and cost of building that expertise internally. Because providers often review the same managers for several clients, they can spread research costs and offer peer benchmarking that a single institution could not produce alone. An external opinion can also bring a degree of independence from internal investment pressures, which some boards value in its own right.
For smaller funds, family offices and investors without dedicated ODD resource, outsourcing is often the most practical and proportionate model. The SBAI survey reflects this: 59% of respondents used external consultants, with use concentrated among small and mid-sized investors, rising to 77% among those without a dedicated internal ODD team. Of the institutions with no dedicated team, around a third outsourced ODD entirely.
Where outsourcing strains
- Accountability stays at home. An institution can outsource the work, but not responsibility for the decision. Boards and supervisors will still look to the institution to show how it reached, and oversaw, its conclusions.
- The “black box” risk. A rating or pass/fail opinion is only as useful as the reasoning behind it. If the institution cannot see or challenge the analysis, it may struggle to explain a decision later.
- Thinner insight into your own exposures. A provider’s standard review may not reflect the specific vehicle, side letter, mandate size or concentration that matters most to you.
- Dependency. Relying on a single provider for every opinion creates its own concentration risk, and can leave little internal capability if the relationship changes.
Why many large funds land on insourced or hybrid ODD
For larger asset owners, the balance tends to tilt towards keeping the opinion in-house. The SBAI data points in that direction: use of external consultants declined as internal ODD teams grew, which the survey’s authors read as a sign of greater internalisation, and dedicated teams of five or more were largely confined to investors with more than $20bn under management. In our own work with asset owners, a recurring theme is not abandoning external support but using it more selectively, co-sourcing specific expertise such as cyber assessment where it adds depth an internal team would struggle to build.
The logic is straightforward. Large institutions generally want to own the risk opinion because they own the accountability, but they also recognise that no internal team can be expert in everything or scale indefinitely. A hybrid model resolves that tension.
Timing is a further pressure. Investment teams sometimes need to move quickly, for example on a co-investment, a secondary or continuation vehicle, a capacity-constrained fund close, or a manager transition. ODD can then become the critical path. An internal team already committed to its review cycle may not have the bandwidth to deliver a robust opinion in days rather than weeks, and the choice can narrow to delaying the investment or accepting a lighter review than policy intends. Keeping a specialist provider on a standing arrangement, with terms, scope and data access agreed in advance, gives the institution capacity it can call on at short notice without compromising its standards or its timetable. The benefit is greater where the provider also runs an ODD platform. If a manager’s questionnaire responses, financial statements, cyber posture and adverse media history are already held and monitored there, a short-fuse review starts from an established baseline rather than a blank page.
How the work is typically split
Area | Typically led internally | Typically supported externally |
| Framework, risk appetite and policy | Set by the internal team and approved through governance | Benchmarking against peer practice |
| High-conviction, large or complex mandates | Full review led internally, often including onsite visits | Specialist input on specific domains |
| Breadth of the roster | Tiering, oversight and exception handling | Questionnaire collection, document review and baseline assessments |
| Specialist domains (cyber, custody, fund administration) | Interpreting findings and agreeing remediation | Technical assessment and independent evaluation |
| Capacity peaks (new programmes, re-ups, transitions) | Prioritisation and final sign-off | Additional review capacity |
| Short-fuse reviews (co-investments, secondaries, time-limited closes) | Setting the minimum standard, reviewing findings and final signoff | Rapid-turnaround review under a pre-agreed retained arrangement |
| Ongoing monitoring | Deciding when a signal warrants action | Financial, cyber and media monitoring with alerts |
A useful feature of this split is that deeper work is triggered by evidence, not just the calendar. When monitoring raises a flag, such as a delayed audit, a key-person departure or a change in cyber posture, the internal team can commission an onsite visit or targeted deep dive, drawing on external specialists where needed. The same arrangement supports deals with a short fuse: because the provider already knows the institution’s framework, it can start work immediately rather than being onboarded mid-transaction. And because monitoring data, review history and findings sit on a single platform, such as Thomas Murray’s Orbit, the internal team and its external specialists work from the same evidence, and each review adds to a record the institution retains. That allows the model to scale with the portfolio without diluting accountability.
A short checklist for choosing your model
Five factors tend to determine where an institution should sit on the spectrum.
Factor | Questions to ask | Trends to point towards |
| Governance Requirements | What do your board, trustees and supervisor expect to see, and who must be able to explain an ODD conclusion? | Insourced or hybrid where accountability expectations are high |
| Portfolio Complexity | How many managers and providers do you oversee, how many reviews does that generate each year, including fund-level assessments and refreshes, and how much sits in private markets, credit or newer, less familiar strategies? | Hybrid as breadth and complexity grow |
| Internal Capability | Do you have dedicated ODD staff, and do they cover cyber, custody and fund administration? | Hybrid where specialist gaps exist; outsourced where there is no dedicated ODD resource |
| Cost | Do you know what your programme costs today across staff time, external services, technology and travel? What would it cost to build and retain the expertise internally, compared with buying it in? | Outsourced for smaller programmes; hybrid where scale supports in-house judgement |
| Independence | Do you need an external view to challenge internal investment pressure or reassure stakeholders? | External input at defined points, within any model |
| Capacity and speed | Can your team absorb short-fuse deals, or a provider issue that triggers reviews across many managers at once, without delaying investments or lowering standards? | Hybrid, with external capacity retained in advance |
| Efficiency and technology | How much of your team's time goes on administration, such as issuing and chasing questionnaires, handling documents and maintaining records, rather than on judgement? | A platform-supported model in which technology carries the administration and the team focuses on the opinion |
Technology as the enabler of hybrid ODD
A hybrid model only works if information from internal reviews, external specialists and ongoing monitoring comes together in one place. Without that, teams end up reconciling spreadsheets, emails and provider reports, and the benefit of sharing the workload is lost in coordination. Platforms change that in several ways.
- One view of each relationship. Questionnaires, documents, financial statement analysis, adverse media and cyber monitoring held together, with alerts when something changes. See Financial Statement Red Flags: An ODD Perspective and Media Monitoring as an ODD Signal.
- From periodic to continuous. Rather than waiting for the next scheduled review, teams receive early warning in between and can decide whether a deeper look is needed.
- More time for judgement. When data collection and chasing are automated, analysts spend more of their time on analysis, challenge and engagement with managers.
- Comparability. Standardised data makes it possible to compare providers with one another and to track the same provider over time.
- Emerging AI support. Automation and AI are beginning to assist with scoring, triage and summarising responses. These tools can help direct attention, but they support professional judgement rather than replace it, as we discuss in What AI Actually Changes About the DDQ.
Adoption remains uneven. The SBAI survey found that most respondents had not yet adopted third-party data-gathering tools, and that adoption was lower among larger teams, suggesting some institutions are still choosing to invest in people rather than platforms. That leaves considerable room for lean internal teams to extend their reach.
As one example of a platform-enabled hybrid model, Thomas Murray’s Orbit Risk platform brings questionnaire-based assessments, financial statement analysis, proprietary cyber risk evaluations and curated news alerts into a single view, supported by a managed services team that can take on reviews or specialist domains where an internal team needs additional depth or capacity.
Conclusion: owning the judgement, sharing the workload
There is no single right answer to how ODD should be resourced, and the SBAI itself concluded that institutions take a broad spectrum of approaches. For large asset owners, though, the centre of gravity is clear: judgement and accountability held in-house, supported by specialist input wherever it adds depth, breadth or capacity including when the front office needs to move quickly or the portfolio moves into less familiar asset classes. Technology is what makes that model practical, allowing a lean internal team to oversee a broad and complex provider base without losing sight of what changes between reviews. Used well, it takes on the administration so the team can concentrate on the judgement, which is the part of ODD that cannot be outsourced or automated.
Six questions to locate yourself on the spectrum
If a board member or supervisor asked your team to explain an ODD conclusion today, could it do so without relying on a provider’s summary?
Which parts of your roster received meaningful oversight in the last 12 months, and which did not?
Where does your team lack specialist expertise, including in newer asset classes,and how is that gap being filled now?
How would your programme cope if your private markets allocation, or the number of providers you oversee, grew significantly over the next three years?
If the investment team needed an ODD opinion within days, or a problem at an administrator or prime broker required you to review every manager using it, where would the capacity come from?
When something changes at a manager or provider between reviews, how, and how quickly, would you find out?
If the answers reveal gaps in accountability, coverage capacity or early warning, that is usually a sign the balance between insourced judgement and external support is worth revisiting.
Operational Due Diligence
Automate your operational due diligence with Orbit Risk technology.
Get ongoing monitoring of your investment managers, track adverse media, and receive cyber risk alerts as they happen.
Frequently Asked Questions
What is outsourced operational due deligence?
Outsourced operational due diligence is where an institutional investor engages a specialist provider to review investment managers and service providers on its behalf, typically producing reports, ratings or opinions. The investor remains responsible for the investment decision and for overseeing the provider.
What is a hybrid ODD model?
In a hybrid, co-sourced, ODD model the in-house team owns the framework, risk appetite and final decisions, while external specialists and technology platforms provide data, additional capacity and expertise in areas such as cyber, custody and fund administration.
Can accountability for ODD be outsourced?
An institution can outsource ODD work, but responsibility for the resulting decisions generally stays with the institution and its board. That is why even fully outsourced programmes need internal capability to review, challenge and act on a provider's findings.
Should smaller funds outsource ODD?
For smaller funds and family offices without dedicated ODD resource, outsourcing is often the most practical and proportionate option, giving access to specialist expertise and broad coverage. Many still keep someone internally responsible for reviewing the findings and making the final decision.
Insights
Insource, Outsource or Both? Finding Your Place on the ODD Spectrum
Owning the judgement, sharing the workload: a balanced look at insourced, outsourced and hybrid ODD models.
How Often Should ODD Be Refreshed? A Practical Framework
Most allocators do a full ODD review every 12 to 36 months, but the right cadence depends on risk. Here's a practical five-step framework for deciding how often to review each manager.
What AI Actually Changes About the DDQ (and What It Doesn't)
AI is transforming DDQ workflows, but it doesn't change what a questionnaire actually is: self-reported data. Here's where the line falls, and what to ask before adopting an AI-assisted tool.
From RFP to Ongoing ODD: Closing the Monitoring Gap
RFP rigour rarely survives past manager selection. What a robust RFP process looks like, and how to close the monitoring gap that opens once it's over.