ESMA looked at fund managers' control functions and found the governance

Most regulators judged overall compliance satisfactory, and then reported recurring weaknesses that were sharper in some jurisdictions than others. They also found significant differences in the quality and practical implementation of arrangements depending on the size, nature and complexity of the firm. That is a polite way of saying that a policy written for a large house and adopted by a small one did not survive contact with the small one.

Independence: whether the compliance and internal audit functions can reach an unwelcome conclusion and report it, without the person responsible also owning the activity being reviewed. Implementation: whether the internal policies are of adequate quality, and whether anyone followed them after they were approved and filed. Oversight: whether senior management and the board received what they needed, considered it and acted.

None of the three is a missing file. Each is a gap in what can be shown. A firm asked to demonstrate independence is asked who holds the function, what else that person does and to whom they report. A firm asked to demonstrate oversight is asked for the paper recording what the board was told, when, and what it decided.

The report notes divergent national practice on whether engaging a third party to perform internal audit counts as delegation under AIFMD and the UCITS Directive. That matters to a manager with entities in more than one member state, because delegation carries notification duties, oversight duties and a supervisor's continuing interest in whether the manager has become a letter-box. One outsourcing contract can be a delegation in one jurisdiction and an ordinary service arrangement in another.

A group cannot take a consistent position across jurisdictions without first being able to state the position at all. That means a list: for each authorised entity, who performs each control function, whether internally or through a group company or a third party, under which contract, and what was notified to which regulator. Very few groups can produce that list from a system. Most produce it from the memory of the person who arranged it.

Oversight becomes provable when three things are held together: the report that went to the board, the date it went, and the minute recording what the board decided about it. Spread across an inbox, a shared drive and a secretary's folder, they are three artefacts a reviewer has to assemble. Held against the entity, they are the answer to the supervisor's question.

Do the same for the functions themselves. Record who holds compliance and who holds internal audit for each authorised entity, the appointment document, the reporting line and the date the appointment took effect. Record each delegate and what was delegated to it. This is not another policy to write. It is being able to answer, entity by entity, the questions a policy asserts the answer to.

Officers and their appointments sit against the entity they serve, with the appointment documents attached and dated. Board and committee papers, terms of reference and minutes are filed against that same entity, so what was put to a board and what it decided lives with the vehicle it concerns.

Service arrangements are recorded the same way: the contract attached to the entity, and a compliance obligation carrying the review or notification date and its owner. Alethia does not perform the compliance function and does not speak to a national regulator on a manager's behalf. When the next supervisory action arrives, who holds internal audit for this entity, under what contract, and what the board saw are questions the register already answers, with the audit trail showing when each entry was made and by whom.