Superannuation funds are facing rising pressure to strengthen oversight of investment managers, as regulators push for more rigorous and consistent approaches to operational risk across outsourced mandates.
In response, the Association of Superannuation Funds of Australia (ASFA), in collaboration with JANA, has released its final Better Practice Guidance Note on Investment Manager Operational Due Diligence (Ops DD), providing a framework aimed at lifting industry standards and improving consistency in how funds assess manager risk.
The guidance arrives as APRA’s CPS 230 Operational Risk Management standard reshapes expectations around operational resilience and third-party oversight, with the note designed to help RSE licensees meet fiduciary and regulatory obligations while improving comparability across manager assessments.
“The strength of our due diligence frameworks really matters to the integrity of the super system. So this work has consequences for every Australian worker and retiree. The Guidance Note gives the industry a consistent, practical method for assessing investment manager risk. It’s also timely. Quite rightly, regulators’ expectations around operational resilience are only moving in one direction, and that’s upwards,” said ASFA chief executive Mary Delahunty.
The framework positions operational due diligence as a forward-looking, risk-based exercise requiring independent judgement, rather than a compliance-driven process, and introduces a more structured approach to evaluating governance, controls and risk culture.
Guidance within the document emphasises that operational risk is central to investment decision-making rather than peripheral, reinforcing the need for trustees to assess not just strategy but the underlying operational capability supporting it.
JANA’s head of operational consulting, Jo Leaper, said the industry needed to move beyond superficial assessments.
“Operational due diligence isn’t a tick-the-box exercise. In practice, there can be gaps between how processes are documented and how they operate day to day,” Leaper said. “Effective due diligence is about understanding how an investment manager functions, and whether governance and controls are genuinely working under pressure.
“Clear roles and responsibilities, appropriate segregation between decision-making and oversight, and well-defined escalation pathways are fundamental to making due diligence meaningful.”
The guidance sets out a detailed review framework spanning governance structures, personnel, trading and operational processes, technology systems and cyber security, as well as business continuity and ESG considerations, reflecting the breadth of risks now expected to be assessed under prudential standards.
It also formalises operational due diligence as a core component of ongoing manager oversight, with the document noting that reviews should identify and rate operational risks associated with appointing or retaining managers, forming part of a broader evaluation alongside performance and mandate compliance.
Key elements of the guidance include a requirement for clearer separation of duties, stronger governance frameworks and escalation processes, as well as expanded review coverage across areas such as cyber security, ESG factors, business continuity and data management.
The note recommends full operational due diligence reviews at least every three years, supported by interim updates as risks evolve, while encouraging ongoing monitoring through regular reporting on breaches, personnel changes, regulatory issues and operational incidents.
Importantly, the framework reflects APRA’s expectation that investment managers will generally be treated as material service providers under CPS 230 unless a justified exception applies, increasing the level of scrutiny applied to outsourced investment functions and requiring stronger contractual and oversight arrangements.
The guidance also highlights that operational due diligence models will vary across funds, ranging from fully in-house reviews to outsourced or hybrid approaches, but stresses that ultimate accountability for assessing and managing operational risk remains with the RSE licensee regardless of the model used.
ASFA said the guidance was developed through extensive consultation with asset owners, investment managers and consultants, forming part of a broader push to strengthen governance, transparency and operational resilience across the superannuation system.
