Use of SSAE 16 (SAS 70) Internal Control Reports by Hedge Fund Managers to Credibly Convey the Quality of Internal Controls, Raise Capital and Prepare for Audits
Hedge Fund Law Report
An “institutional” quality infrastructure is becoming a prerequisite for hedge fund managers looking to raise capital from sophisticated investors. But institutional is a difficult quality to define with precision in the hedge fund industry, a function of, among other things, the relative youth of the industry, asymmetry in the size and structure of management companies and the reluctance on the part of managers to disclose information. As used by hedge fund investors, consultants, managers, regulators, service providers and others, institutional is more of a conclusion than a characteristic. Managers are said to be institutional when they have fund directors with substance, gray hair in key operational roles, best-of-breed technology, brand name service providers, top tier investment talent and high caliber personnel focused on aspects of the business other than investing. But a manager may be institutional without some of these elements, and even a manager with these elements can have holes in its processes that undermine the veneer of competence. So how can investors reliably assess the institutional caliber of a manager, and how can managers credibly demonstrate their level of institutionalization? Along similar lines, how can investors make institutional apples to apples comparisons when hedge fund management businesses are radically different in terms of size, structure, strategy and operations? One method is to focus on the robustness of a manager’s internal controls, since robust internal controls are a necessary – though not sufficient – element of an institutional quality infrastructure. Unlike other indicia of institutionalization, the robustness of internal controls can be measured at a single manager and compared across managers. Such measurement can be accomplished by having an independent auditor conduct an internal control audit and issue an internal control report in accordance with Statement on Standards for Attestation Engagements No. 16 (SSAE 16), which replaced the long-standing Statement on Auditing Standards 70 (SAS 70). While SSAE 16s have been in use in other industries for some time, they are a relatively new technique in the hedge fund industry. However, in a climate of heightened regulator and investor scrutiny of non-investment aspects of the hedge fund business, SSAE 16s offer one of the most objective available barometers of institutionalization. This article provides an introduction to the SSAE 16 audit process as applied to the hedge fund industry, including a description of the SSAE 16 audit and the corresponding internal control report; provides guidance regarding fund service providers a hedge fund manager should request an internal control report from and what should be covered in such internal control reports; outlines the reasons why hedge fund managers may consider obtaining an SSAE 16 audit on themselves, including a discussion of key benefits and costs of obtaining an internal control audit and report; describes the process for hedge fund managers to obtain an internal control audit and report; addresses who should pay for the internal control audit and report; addresses how often a hedge fund manager should obtain an internal control audit and report; identifies the challenges hedge fund managers face in obtaining an internal control audit and report; and explores whether there are any suitable alternatives to the internal control audit and report.