The conversation opened with a practical question: which risks are receding, and which are growing?

On the receding side, expert network governance has tightened materially across the industry. Transcription services have further reduced MNPI exposure. Disaster recovery, long a staple of ODD questionnaires, has largely normalised post-COVID — most managers are now fully cloud-based. The exception: certain systematic and CTA managers still maintaining legacy physical DR facilities, and some managers maintain DR facilities uncomfortably close to their primary sites (< 50 miles).

The growing risks were more pointed:

The discussion on fund administrators surfaced a persistent issue: confirming the actual scope of a service provider relationship matters as much as confirming the relationship exists.

Even full-service administrators frequently do not provide all services to a given manager. Investor relations, NAV calculations, transfer agency, and cash control may each sit with different parties — or not be covered at all — regardless of what the fund administration capabilities imply. Reviewing the actual agreement is the only reliable approach.

Specific concerns from the room:

For private markets managers, the independent valuation agent is the most consequential service provider to verify. In VC, administrators often exercise limited control over valuations — practical authority frequently rests with the manager, creating the very conflict the structure is meant to prevent.

Not all administrators hold ISO and SOC 1 certifications. Where SOC reports exist, ensure it's Type II and not Type 1 and also audit scope requires scrutiny — firms can limit what is covered, and a narrow scope can obscure meaningful gaps. A qualified opinion on a SOC 1 should not be treated as a routine finding. Two questions warrant direct follow-up: Is this consistent across review periods? And what is the manager actually doing about it?

The framework for evaluating an administrator has moved beyond certifications. Team size, systems capability, and the manager's actual influence over that administrator are all material inputs.

The room was frank about how power dynamics shape ODD outcomes.

Managers frequently tell allocators that a given question has never been asked before. The room reached a quiet consensus: they almost certainly say the same thing to every allocator.

Timing is the more consequential dynamic. ODD teams arriving late in a fundraising cycle find that leverage shifts considerably. But there is a subtler dynamic at play even when timing is right: when managers push back on a recommendation or decline to remediate a finding, they are frequently not disagreeing on the merits. They are testing whether the allocator will actually walk away. It is a calculated read on conviction — and managers have become sophisticated at making it. The only credible response is genuine willingness to act on the concern, backed by internal alignment that makes the walk-away threat real rather than rhetorical.

Larger managers have accumulated significantly more negotiating power than they held seven or eight years ago. The primary lever that remains is exclusion from the next re-up. That threat has teeth, but only with genuine internal alignment behind it.

On remediation: allocators own the decision; consultants recommend. Raising issues at the tail end of a fundraising process is tough as that's when resolution is hardest, unless your allocation amount is significant. The room agreed that arriving earlier changes almost everything.

Regional differences ran as a consistent undercurrent.

European allocators operate within a more structured environment. AIFMD drives requirements around valuation independence and risk management. Valuation practice was a specific point of divergence. The room considered current US standards weaker than European norms — both in the independence of the process and the conservatism of the marks.

SEC oversight shapes how US-based allocators think about electronic communications. FCA oversight shapes focus on conduct risk, and documentation standards. The room's assessment was plain: US ODD standards are more relaxed in some areas.

European allocators also travel less frequently for on-site visits than their US counterparts. That difference shapes what can be assessed in person, and has become a point of structural distinction between the two approaches rather than simply a carbon footprint preference.

No unified cross-regional framework exists, and there was no expectation of one.

This generated the most discussion, and the most variance in experience. Firms are at meaningfully different stages — some have recently deployed general-purpose LLM tools such as Copilot, ChatGPT, Claude for the first time; others have built proprietary AI applications for specific workflows. Several firms have implemented AI usage trackers, requiring staff to demonstrate how AI is embedded in their work rather than simply affirming that it is.

Junior staff are being managed inconsistently. Some firms have asked junior employees to hold off on AI tools entirely. Others are actively using AI as a training scaffold. The room acknowledged that junior staff often identify novel use cases faster than senior colleagues — and that blanket caution may carry its own costs.

Hallucinations are a material concern. Most firms have imposed token limits as a practical cost guardrail. A minority have not. The skill gap — knowing what to look for in AI output, and how to prompt effectively — is not being closed fast enough.

Cyber training must catch up. Staff awareness of AI-enabled threats — deepfakes, synthetic impersonation, more convincing phishing — is an active gap. The threat is evolving faster than most training programmes.

Headcount is not falling — yet. AI is not reducing teams yet. Whether that changes as tools mature was left open.

Who pays for AI? The cost question remains unresolved: fund expense or management company expense? No consensus, and no expectation of one soon. Checkout DV views on this.

Our poll data from a recent AI webinar for asset managers captures what is landing on their side of the table. The leading question — raised by roughly 70% of allocators — is simply: do you use AI? Disclosure is the baseline.

The pattern is familiar to anyone who watched cybersecurity diligence evolve over the past decade. It begins as a disclosure question. It becomes a governance question. Then it becomes a threshold. Managers treating AI disclosure as a compliance exercise are likely underestimating the trajectory.