2009 Investment Management Compliance Testing Survey

1. 2009 Investment Management Compliance Testing Survey Lynne Carreiro, ACA Compliance Group Valerie Baruch, Investment Adviser Association May 27, 2009

2. Survey Focus Areas • Compliance resources • Changes to compliance programs in light of the market crisis • Valuation • Custody and safekeeping of client assets • Anti-money laundering • Risk management • Marketing and advertising • Portfolio management • Hot compliance topics

3. Key Survey Findings • 43% of the participants reported that their firm conducted new compliance tests or otherwise changed their testing in response to the market crisis. • The vast majority (85%) of firms did not cut compliance resources (and are not planning to) following the market crisis. • Survey respondents identified valuation as the hottest compliance topic. 41% of respondents said that the credit market turmoil has impacted their firm’s pricing and valuation processes, compared to 19% of respondents in our 2008 survey. • 45% of firms either have a formal, firm-wide “risk-management program” with a designated Chief Risk Officer (or an individual acting in a similar capacity) or are considering adding a program.

4. Survey Demographics 440 survey respondents: 153 small firms (AUM of under $500 million) 199 mid-sized firms (AUM of $500 million to $10 billion) 88 large firms (AUM over $10 billion) This year’s survey demographic appears to have shifted significantly towards bigger, older, more established firms than the previous years’ surveys. The shift towards larger firms is evidenced by a 9% increase in the percentage of firms reporting AUM over $1 billion and a 10% decrease in the percentage of smaller firms (those with under $500 million of AUM) from last year’s survey.

5. Under $250 million 23% $250 million to $500 million12% $500 million to $1 billion13% $1 billion to $10 billion33% $10 billion to $20 billion8% Over $20 billion 12% Survey Demographics What is your firm’s total AUM (assets under management)? • Over half of the respondents (53%) reported that they worked at firms with over $1 billion in assets under management and 35% reported that they worked at firms with under $500 million in assets under management. • 15% of the respondents reported that their firm had five or fewer employees. • The typical respondent’s firm had: • between 11 and 50 employees (42%) • been in business between 5 and 25 years (60%) • one, or fewer than one, full-time employee in the legal and/or compliance functions (56%)

6. 0 24% 132% 2-320% 4-1014% 11-204% More than 20 6% The Compliance “Department” • 2009 survey reflected a shift in the demographics of the respondents • 76% of respondents indicated that at least one person is employed full-time in the legal and/or compliance functions. This reflects an increase from 67% in 2008. • Although there has been about a 10% decrease from prior years, a significant majority of CCOs (70%) (compared to 79% in 2008 and 78% in 2007) continue to wear multiple hats and perform a significant amount of non-CCO functions. Not surprisingly, of the CCOs who solely perform CCO functions, 88% come from mid and large sized firms. • The biggest obstacle for CCOs with respect to testing is time. The majority (70%) of respondents said that they would do more in the area of testing if they had more time. 46% said that they would do more if they had more compliance personnel. How many employees at your firm are engaged full-time in legal and/or compliance functions? 33.3%0 30.6%1 20.3%2–3 9.5%4–10 3.7%11-20 2.7%More than 20

7. Compliance Resources Since the market crisis began, has your firm cut compliance resources (or is it currently planning to cut compliance resources)? • Of the firms that did cut or are planning to cut compliance resources, the top areas to be cut include (respondents could check all that apply): • Attendance at out-of-town compliance conferences (79%) • Compliance staff compensation (55%) • Overall compliance budget (52%) • Staff positions (42%) • Use of outside compliance consultants (42%) • The SEC staff’s “don’t cut compliance” message to the industry seemed to have little effect on a firm’s decision whether or not to cut compliance. Only 9% of respondents said that message had any effect on their budgeting decisions. Yes 15% No 85% • The vast majority of respondents (85%) reported that their firms did not cut compliance resources (and are not planning to) following the market crisis. Of the 15% of firms that cut compliance resources, small, mid, and large-sized firms were all impacted comparably by compliance cuts.

8. New Compliance Tests 43% of the respondents reported that their firm conducted new compliance tests or otherwise changed their testing in response to the market crisis. 64% of large firms (56 firms), 43% of mid-size firms (85 firms), and 32% of small firms (49 firms) conducted new tests These new or heightened tests generally focused on three areas: Review of portfolio holdings and investment guidelines Adequacy of disclosure about investment risk and/or credit risk in light of new information about products or markets Greater scrutiny of counterparties Yes 43% Since the market crisis began, has your firm conducted new tests or otherwise heightened or changed your testing to specifically address issues raised by the crisis? No 57%

9. Heightened Testing or Changed General Testing Focus We have initiated testing of fees and spot checking client account and third-party billing to make sure we are in accordance with the client contracts specifically regarding cash allocations. Because of the market volatility, many clients have built up huge cash positions and have questioned as to whether we should be billing on cash. We have re-evaluated our risk assessments to determine where heightened testing may be needed in our firm. In this process, we have added a risk assessment chart to map conflicts of interest. Both of these tools have assisted our firm in updating how our policy is monitored, the frequency with which the monitoring occurs, how our policy is tested, how often, and who is responsible for conducting the tests. • We increased the frequency of testing already in place. • Heightened review of client files and firm communications regarding the events. • The new testing we have implemented during the time of the market crisis has more to do with strengthening our overall compliance program and the annual review process than with the market crisis itself. • We focus more on counterparty risk, how our sub-adviser monitors liquidity, and fair valuation. • We have added additional processes and testing for derivative instruments.

10. Custody • The vast majority (89%) of respondents did not change their custody testing in light of the Madoff scandal, perhaps because the overwhelming majority (93%) of respondents maintain client assets at a third-party, independent custodian. • Respondents did not perceive custody to be a particularly high risk area, although they did recognize it as one of the top three compliance “hot topics” for 2009. • Of the firms that changed their custody testing in light of Madoff: • 44% (22 firms) heightened oversight of outside custodians (such as requesting SAS 70s or performing on-site due diligence visits); and • 38% (19 firms) reviewed contracts with custodians to ensure that proper controls are in place.

11. Other Custody Tests Other custody tests conducted by large firms: We already were conducting on site due diligence visits and requesting SAS 70s. Reviews of SAS 70 documents and reconciliations are a part of our regular operational and oversight practices. This year we confirmed directly with a sample of clients that they are receiving custodian statements directly; confirmed with custodian that they send statements directly to clients on at least a quarterly basis. We already have reconciliation procedures with custodians in place in our accounting departments and we looked specifically at that area this year given the relevance to the custody rule. The CCO has requested via letter that the custodian verify that they are sending statements at least quarterly to the clients. • Other custody tests conducted by mid-sized firms: • It is not the CCO or compliance personnel conducting the secondary audit but the administrative supervisor performs a random check sampling. • We requested copies of audits and recorded deeds of trust from outside managers of hedge and real estate funds. • Since we do not custody assets, we have sent several reminders to clients that they must be receiving statements from their custodians on at least a quarterly basis. In addition, we contacted all custodians to confirm that they are providing statements to our mutual clients. • We plan to run an ad-hoc test to compare a sample of our internal records of client addresses vs. custodian client addresses.

12. Anti-Money Laundering • On October 30, 2008, the Treasury Department’s Financial Crimes Enforcement Network (FinCEN) withdrew the investment adviser anti-money laundering (AML) program rules that had been proposed, but never adopted. Despite that, the vast majority of firms (86%) have not significantly changed their AML program since that time, and have no plans to change it. • Of the firms that have changed or are planning to change their AML program: • 54% (33 firms) have either enhanced their AML program or are planning to make their program more comprehensive; and • 28% (17 firms) have curtailed or are planning to make their AML program less comprehensive. • Only 18% (11 firms) have eliminated their programs entirely.

13. Market Crisis – Pricing and Valuation 59% of firms said that the credit market turmoil has not impacted their firm’s pricing and valuation processes. However, the 41% of firms impacted by the crisis represents a significant increase from the 19% of firms impacted in our 2008 survey. 36% of firms have faced isolated pricing and valuation issues. Of those firms, 75% have AUM of $500 million or above. Large firms (AUM over $10 billion) seem to have been disproportionately impacted by the credit market turmoil. 68 out of 88 large firms (77%) reported that they have had difficult-to-price securities. Only 5% of firms (21 firms) reported significant pricing and valuation issues. Over half of those firms are large firms (AUM over $10 billion). Since the market crisis began, has the credit market turmoil impacted your firm’s pricing and valuation process? Yes, significantly. 5% Yes, slightly. We’ve had some isolated issues but seem to have worked through them. 36% No, not at all. None of our securities have been difficult to price.59% 5% 36% 59%

14. Market Crisis – Pricing and Valuation Of firms that have had their pricing and valuation process significantly impacted: • Lack of liquidity in market has resulted in market valuations bearing no relationship to the underlying credit quality. In almost every case there has been no adverse change in the issuer’s creditworthiness. • Independent valuation sources vary widely in their evaluation of similarly rated securities. • We have had a hard time obtaining independent pricing quotes on several securities; much more than in the past. • We have scrutinized our valuations much more closely and applied heavier write-downs than we have in previous years under similar circumstances. • Reduced liquidity in the market results in less confidence in execution prices as reliable indicators of valuation; obtaining broker quotes has been more difficult; more securities requiring fair valuations.

15. Risk Management Does your firm currently have a formal, firm-wide “risk management program” with a designated Chief Risk Officer (CRO) or an individual acting in a similar capacity?Yes 27%No, but we are considering it 18%No, and we are not planning to 56% Of the firms with formal risk management programs: Assets under management 10% have under $250 million 8% have $250 million-$500 million 9% have $500 million-$1 billion 37% have $1 billion-$10 billion 13% have $10 billion-$20 billion 22% have over $20 billion Number of employees 4% have 1-5 employees 9% have 6-10 employees 36% have 11-50 employees 31% have 51-250 employees 6% have 251-500 employees 15% have more than 500 employees 27% 56% 18%

16. Risk Management • 36% report that the CCO is also the CRO. • 56% report that they have an official “Risk Committee.” • Compliance and operational risks are most frequently assessed by firms, followed closely by catastrophic risks and regulatory risks. • Of the firms with a formal risk management program, only about half assessed investment risks, market risks, liquidity risks, or portfolio risks. • Self-assessments (70%) and interviews with firm personnel (64%) are the most frequently employed methods of assessing risk. • About 70% of CROs are participating in: • Due diligence reviews when new products or services are being considered. • Business development efforts, when new clients or markets are being considered. • Functional committee meetings (e.g. investment, best execution, pricing).

17. Risk Management Risk Reporting 99% of firms provide some type of reporting to senior management, boards of directors, or other interested parties regarding the outcome of any risk testing. • Other types of reporting: • Risk Management Committee meeting minutes • Regular reports to senior management • Real time alerts to issues • Risk assessment spreadsheet/document updates • Firms reported a wide audience for reports: • Senior Management • Boards of Directors/Trustees • Risk Committee Members • Department Heads • Other Firm Committees • Auditors/Consultants • Clients

18. 86% of firms reported having written policies and procedures governing marketing activities, with the percentage increasing for the larger more established firms. Marketing/Advertising Under $250 million 79% $250 million to $500 million 83% $500 million to $1 billion 84% $1 billion to $10 billion 90% $10 billion to $20 billion 94% Over $20 billion 92% Less than 1% of firms reported that they do not engage in any marketing or advertising activities to prospective clients. Of respondents indicating that they have eliminated procedures, the most frequently cited was the removal of the cash solicitation rule policies and procedures from placement agreements for private funds.

19. Marketing/Advertising Since January 1, 2008 70% of firms made no modifications to marketing policies and procedures. 19% have implemented additional policies and procedures, including: • Employee training about marketing regulations has been increased. • Secondary reviews and regular updates to RFP data. • All policies and procedures are reviewed annually and updated based on new SEC rules or internal changes to business. • The use of past specific recommendations has been eliminated. 18% have implemented/strengthened the approval process, including: • All materials sent out, including emails, must now have the approval of a firm's director as well as CCO prior to distribution. • A folder on the firm’s shared drive with approved marketing materials; pre-clearance from Compliance required and a copy to Compliance for any marketing pieces not included in the folder. .

20. Marketing/Advertising The most common types of monitoring/testing conducted on respondents’ marketing activities based on AUM: Up to $1 billion: Marketing materials require formal approval by the CCO prior to use. $1 billion to $20 billion: Compliance periodically reviews the firm’s website. Over $20 billion: Marketing materials are logged and tracked as they are prepared. Other types of testing include: • Review by internal counsel/legal department. • Review by affiliates (e.g. funds, broker/dealers). • Review of electronic and hardcopy work flows for approvals.

21. Portfolio Management • 91% of respondents have policies and procedures in place to ensure that portfolios are managed in accordance with client objectives and restrictions. • The following tests are most frequently used by respondents: • Compare account holdings against client investment guidelines and/or restrictions (71%) • Compare account transactions against client investment guidelines and/or restrictions (59%) • Compare performance of accounts with like objectives to determine consistency of portfolio management (53%) • Compare performance of similarly managed client accounts to detect any favoritism, misallocation of investment opportunities, or other breaches of fiduciary responsibility (51%) Does your firm have policies and procedures in place to ensure that portfolios are managed in accordance with client objectives and restrictions? Yes 91% No 5% Not applicable. We do not manage client portfolios. 4% NO 5% YES 91 % NA 4%

22. 21% 59% 20% Sub-Adviser Oversight Does your firm have written policies and procedures in place withrespect to portfolio management by sub-advisers, to ensure that they are managing portfolios in accordance with client objectives and restrictions? • The majority (59%) of survey respondents do not use sub-advisers. Of those respondents who do use sub-advisers, the firms are split between those firms that have written policies and procedures in place with respect to portfolio management by sub-advisers and those firms that do not. • The most frequently used tests for overseeing sub-adviser portfolio management include the following: • Visit sub-advisers and interview key personnel (68%) • Distribute and review questionnaires (59%) • Obtain certifications from sub-advisers regarding compliance with client objectives and restrictions (58%) • Review sub-adviser policies and procedures related to portfolio management compliance (53%) No, but we do have sub-advisers. 20% Yes 21% Not applicable. We do not utilize sub-advisers. 59%

23. Compliance Trends • In 2008, 63% of firms reported adding additional compliance procedures, with 18% reporting the deletion of procedures. • In 2009, 98% of firms reported an increase in compliance testing and 53% reported a decrease in testing. • The largest area of decreased testing in 2009 was AML with 13% of firms reporting that they had decreased either the type, scope, or frequency of testing in this area. In 2008, 61% of firms reported having some or all of the components of an AML program. That year, 87% of those firms reported they or third-parties conducted testing on the program.

24. Compliance Trends • Other areas of increased testinginclude: • Sub-adviser due diligence • Due diligence reviews of third-party service providers • Email reviews • The largest areas of increased testing(in addition to previous chart): • 28% Disaster recovery • 27% Personal trading • 26% Client guidelines • 22% Portfolio management • 39% of respondents indicated that they realized that their testing program needs to be enhanced. • The top reasons reported for not doing more: 70% not enough time 46% not enough compliance staff 37% other priorities standing in the way 24% budget not big enough 10% not enough senior management buy-in

25. Survey Feedback A good survey...it was detailed and, at the same time, avoided the tedious overkill that, more often than not, characterizes most surveys. And, this survey did not leave me with the usual sinking feeling of "why did I just waste my time on this?" I will be glad to participate in this survey again in the future. We are a two-person shop with 2 support personnel. Most of this does not apply to us, since we are all aware of everything that goes on with our clients and their portfolios. Thanks for making the survey very current and not just reusing last year's! • Very topical and user friendly. • Being presented with lists of testing items is helpful in determining how I can improve what I do. • Always a thoughtful survey and well worth the time to complete.

26. Contact Information Valerie BaruchInvestment Adviser Association(202) 293-4222 Jeff Morton ACA Compliance Group(973) 631-1085 Cathie SaadehACA Insight(301) 896-0100 Amy YuterOld Mutual Asset Management(610) 578-1257