A5 · Advisory
Portfolio AI Governance Sweep
One framework across every portfolio company in sixty days, and a single page the investment committee can actually read.
Fifteen portfolio companies, fifteen different answers
LPs and insurers have started asking what AI risk sits in the portfolio. The honest answer at most funds is that nobody knows, because each portfolio company has its own general counsel, its own risk appetite and its own idea of what counts as AI.
Asking each of them produces fifteen documents in fifteen formats, none comparable. That is not a portfolio view; it is a filing cabinet.
A sweep applies one instrument identically across every company, on the same timetable, and produces a single comparable picture. The value is not the depth per company — it is deliberately shallow — it is that the companies can be ranked against each other, which is the only thing that tells an operating partner where to spend.
What you get
-
Portfolio kickoff and sponsor letter
Scope, company list, and a letter from the fund positioning this as value creation and exit readiness rather than an audit. That framing decides how much cooperation you get.
-
Snapshot-level review per company
The Regulatory Exposure Snapshot process, capped at 12 systems each: inventory, exposure map, and a quick score across the five pillars. Same intake, same rubric, same cap, every time.
-
Portfolio heat map — one page
Every company, five pillars, red/amber/green, with the three highest-exposure companies flagged. This is the page that goes to the investment committee.
-
Operating partner readout
A portfolio remediation plan sequenced by exposure, and a list of which companies warrant a full assessment.
-
Per-company readouts
Optional 30 minutes each. Each company keeps its own results — which is what makes them willing to answer honestly next time.
Scope
Fixed on both sides. Anything outside it is a separate engagement, quoted separately.
Included
- Fixed intake and rubric applied identically to every company
- Up to 12 systems per company
- One-page portfolio heat map
- Portfolio remediation plan, sequenced
- Operating partner readout
- Optional per-company readouts
Not included
- Full assessments of flagged companies — scoped separately
- Remediation delivery at any company
- Deal diligence on prospective acquisitions
- Filling gaps with estimates where a company did not respond
- Legal advice
How it runs
| Week 1 | Kickoff with the ops partner. Sponsor letter issued. Intake forms to every portfolio company GC. |
|---|---|
| Weeks 2–5 | Rolling reviews, three to four companies a week. |
| Weeks 6–7 | Scoring, heat map, portfolio plan. |
| Week 8 | Operating partner readout. Per-company readouts scheduled. |
Common questions
The portfolio companies will resist this.
Some will, and a parent-mandated review is an unwelcome email in a busy week. Two things help: the sponsor letter framing it as exit readiness rather than audit, and each company keeping its own results. A company that believes the findings go only upward answers differently from one that gets its own report.
What if a company's data is poor?
We record the gap rather than filling it with a guess. A company that could not answer is itself a finding, and it appears on the heat map as such. Estimating to make a grid look complete would make the whole comparison worthless.
Why cap at 12 systems if some companies have more?
Because the sweep's value is comparability, and an uncapped review of the largest company would consume the budget for the other fourteen. Companies that clearly exceed the cap are flagged for a full assessment, which is one of the outputs.
Can this be billed to the portfolio companies?
Usually yes, and several funds prefer it. It changes who the client is and therefore who receives the findings, so it is worth deciding before the sponsor letter goes out rather than after.
How often should it be repeated?
Annually is the natural cadence, and the second sweep is worth considerably more than the first because it shows direction. The first is a photograph; the second is a trend.
A sweep is an advisory review against a published rubric, not an audit, a legal opinion, or a compliance certification, and no attorney–client relationship is created. Findings reflect information provided by each portfolio company within the engagement period; gaps are recorded as gaps rather than estimated.
How many companies, and by when?
Sweeps are usually scoped around an LP question or an insurance renewal, which sets the date.