News 23/07/26

Areas for attention for compliance and internal audit functions at fund managers

Many fund managers have their compliance and internal audit functions well organised. Nevertheless, improvements are needed. For example, documentation is not always up to date, fund managers do not always retain sufficient control when outsourcing, and decisions based on proportionality are often insufficiently substantiated. This is evident from research carried out by the Dutch Authority for the Financial Markets (AFM) among Dutch fund managers, conducted as part of a European Common Supervisory Action (CSA) coordinated by ESMA. The AFM expects managers to use these points for attention to further strengthen their governance and internal controls.

In short

Compliance documentation could be improved
Outsourcing requires oversight
Decisions need to be better substantiated

Compliance documentation could be improved

Most fund managers have compliance documents, such as monitoring plans and reports. However, the quality varies. Documentation is sometimes out of date, incomplete or too general. Furthermore, planning, monitoring and reporting do not always align properly. As a result, there is a risk that shortcomings will not be identified or followed up in a timely manner. The AFM expects managers to update their documentation regularly and ensure it is tailored to the risks specific to their own organisation.

Outsourcing requires oversight

Many fund managers engage external parties to carry out compliance or internal audit work. Whilst this is permissible, responsibility always remains with the manager themselves. The AFM has observed that organisations sometimes rely heavily on external parties. This can obscure risks and reduce the effectiveness of the control function. Fund managers must therefore maintain sufficient knowledge and involvement within their own organisation and actively oversee the performance of this work.

Better justification of choices

Fund managers regularly apply the principle of proportionality, for example by combining roles or reorganising the internal audit function. The AFM has observed that the justification for such decisions is often lacking or too limited. Fund managers must be able to clearly explain why a chosen structure is appropriate to the nature, scale and complexity of their organisation. The AFM also expects a clear separation between operational activities and control functions. This contributes to sound and controlled operations.

The AFM will continue to include the topics and findings from the report in its supervision and expects fund managers to use the outcomes of the investigation to further improve their compliance and internal audit functions. The AFM’s findings form part of a broader European Common Supervisory Action (CSA) by ESMA concerning the structure and functioning of compliance and internal audit functions at fund managers. The ESMA report is available here.