Dan Ostergaard · Co-founder, Trusty · Former Novartis Global Head of Compliance · Founder of PolicyStore
Venture capital is built on risk assessment. Funds carefully price product risk, market risk, execution risk, and founder risk. But one category of risk is still widely underpriced: portfolio compliance and governance risk.
As regulatory scrutiny increases and reputational crises increasingly translate into instant valuation collapses, the question is no longer whether compliance matters. The real question is whether a VC’s failure to mandate basic governance safeguards across portfolio companies is still a governance preference, or whether it is becoming a fiduciary blind spot.
Portfolio compliance is not just a founder problem
Most funds focus heavily on product–market fit. Far fewer assess governance–risk fit.
At a portfolio company level, that fit is reflected in simple, verifiable questions:
- Is there a documented code of conduct?
- Have employees received training and demonstrated understanding?
- Is there a functioning whistleblowing or internal reporting channel?
- Is there evidence that reasonable preventive procedures were implemented?
Not intent. Evidence.
When misconduct occurs, regulators, courts, acquirers, and LPs do not assess what a fund assumed would happen. They assess what was documented, implemented, and monitored. Compliance failures rarely stay isolated at company level. They affect exits, valuations, follow-on funding, and fund reputation.
Governance is not bureaucracy. It is defensibility.
The fiduciary duty gap in venture capital
VCs have a fiduciary duty to protect LP capital. While legal liability frameworks differ across jurisdictions, the commercial reality is consistent.
When a portfolio company faces a data breach, harassment claim, bribery investigation, or cultural scandal, the consequences extend beyond the company. Exit timelines shift. Buyer confidence drops. Reputational damage compounds.
The real exposure is not that founders make mistakes. It is that the fund cannot demonstrate it required reasonable safeguards across its portfolio.
If baseline portfolio compliance expectations are not mandated, what exactly is protecting LP capital when something goes wrong?
Three governance risks many funds still underestimate
Unpriceable downside risk
Regulators increasingly apply “failure to prevent” and “reasonable procedures” standards. Investigations focus on systems, controls, and evidence, not informal assurances.
Exit and valuation risk
Governance failures can derail acquisitions, delay IPOs, and weaken negotiating positions. Buyers and late-stage investors expect documented internal controls and cultural safeguards.
Lack of defensibility
Without policies, training records, and reporting mechanisms, there is no evidence of effort. In regulatory or civil scrutiny, evidence matters. Trust does not survive litigation. Systems do.
A simple portfolio compliance self-assessment for VCs
If a portfolio company faced public scrutiny tomorrow, could you clearly answer:
- Do we know the compliance exposure across our portfolio?
- Can founders produce timestamped training records?
- Is a code of conduct in place and enforced?
- Are internal reporting mechanisms active and trusted?
- Can we demonstrate that reasonable preventive steps were required?
If the answer is “it depends,” that uncertainty represents a fund-level governance risk.
Governance as risk infrastructure
Portfolio compliance is often framed as friction. In reality, it is risk infrastructure.
Like brakes on a race car, governance does not slow growth. It allows aggressive growth without catastrophic failure.
Forward-looking funds are beginning to treat portfolio compliance the same way they treat financial reporting: standardized, mandated, monitored, and documented. Not because regulators expect perfection, but because LPs expect discipline.
Trusty enables VCs to mandate and monitor core compliance safeguards across their entire portfolio with minimal operational burden, turning compliance from fragmented effort into structured, defensible evidence.
The question VCs can no longer avoid
Founder autonomy is fundamental to venture capital. But autonomy does not eliminate fiduciary responsibility.
At what point does failing to mandate a code of conduct, training, and reporting mechanisms stop being a governance style choice and start becoming a fiduciary risk?
Funds that address this early will not only reduce downside. They will look significantly more credible when scrutiny inevitably arrives.
Funds that address portfolio compliance early do not just reduce downside risk. They strengthen exit readiness, LP confidence, and long-term fund credibility.
Trusty enables VCs to mandate and monitor policies, training, and reporting mechanisms across their entire portfolio from one central view. Contact us.
Frequently asked questions
Funds have a duty to protect LP capital, and when a portfolio company faces a data breach, harassment claim or bribery investigation the consequences reach exits, valuations, follow-on funding and fund reputation. The exposure is that the fund cannot show it required reasonable safeguards.
Not intent but evidence: a documented code of conduct, training records that show understanding, a functioning whistleblowing or internal reporting channel, and proof that reasonable preventive procedures were implemented and monitored.
Unpriceable downside risk under failure-to-prevent and reasonable-procedures standards, exit and valuation risk when governance failures derail acquisitions or IPOs, and lack of defensibility when there are no policies, training records or reporting mechanisms.
A mandated, monitored and documented baseline of code of conduct, training and reporting mechanisms across portfolio companies, treated like financial reporting rather than left to each founder.
POLICIES, TRAININGS AND HOTLINE
Trusty Compliance App: company policies, compliance training and a whistleblowing channel in one app for your employees. 10 ready-made policies, 6 trainings, free trial, no IT setup.