Every manager has a callback rule in its procedures. The expected loss shows why operational due diligence has to test whether it operates.
Price the control as an expected loss: attempts a year × chance an attempt succeeds × average payment. With two fraudulent change-of-bank-details attempts a year on 1.8m payments, email checks alone expect to lose 1.08m a year, a callback that is written down but never tested 0.54m, and a tested callback 0.07m. Over ten years a loss is near certain without a tested callback and still a one-in-three chance with one.
Worked in full in Operational Due Diligence in Private Equity by Julian R. Sterling, with every figure reproduced in a free workbook.See the book on Amazon →
Payment-instruction fraud is simple. Someone impersonates a portfolio company, a lender, an investor or a law firm and asks for the next payment to go to a new account. The defence is equally simple: call the counterparty on a number already on file, never one in the email, before changing any bank details. Almost every private equity manager has that rule in its procedures. Operational due diligence is about whether the rule actually operates, and the difference is worth computing because it is larger than most findings an analyst will write up.
| Input | Value |
|---|---|
| Fraudulent change-of-instruction attempts a year | 2 |
| Average payment targeted | 1.8m |
| Success rate: email confirmation only | 30% |
| Success rate: callback in the procedures, never tested | 15% |
| Success rate: callback tested and evidenced | 2% |
| Horizon | 10 years |
Expected annual loss = attempts × success rate × payment
Probability of at least one loss in n attempts = 1 − (1 − p)n
=1-(1-B4)^(B2*B7).| Control | Expected loss a year | Chance of a loss in any year | Chance over 10 years | Expected loss over 10 years |
|---|---|---|---|---|
| Email confirmation only | 1.08 | 51.0% | 99.9% | 10.8 |
| Callback written, never tested | 0.54 | 27.8% | 96.1% | 5.4 |
| Callback tested | 0.07 | 4.0% | 33.2% | 0.72 |
The written but untested callback halves the expected loss and leaves the long-run outcome almost unchanged: a 96.1 per cent chance of at least one successful fraud over the horizon. On paper the two lower rows are indistinguishable. The procedures manual reads the same in both, and so does the answer to the due diligence questionnaire.
Testing the control is worth 0.468m a year in expected loss against the untested version. If a quarterly test, a staged fake request to the finance team with the result logged, costs 0.05m a year, it returns 9.4 times its cost. Few controls an analyst asks for have a cleaner business case.
Put the email-only figure in fund terms. On a 500m fund, an expected loss of 1.08m a year is 21.6 basis points of commitments every year, a meaningful slice of the management fee, borne by the investors or the manager depending on how the loss is treated. That is the figure to put in front of a manager that regards callback testing as an administrative burden.
Two attempts a year is conservative for a manager with many portfolio companies, lenders and service providers, all of them plausible impersonation targets.
| Attempts a year | Email only: loss a year | Email only: chance over 10 years | Untested: loss a year | Untested: chance over 10 years | Tested: loss a year | Tested: chance over 10 years |
|---|---|---|---|---|---|---|
| 1 | 0.54 | 97.2% | 0.27 | 80.3% | 0.04 | 18.3% |
| 2 | 1.08 | 99.9% | 0.54 | 96.1% | 0.07 | 33.2% |
| 4 | 2.16 | 100.0% | 1.08 | 99.8% | 0.14 | 55.4% |
| 6 | 3.24 | 100.0% | 1.62 | 100.0% | 0.22 | 70.2% |
Even the tested control does not make the risk disappear as attempts rise. It turns a certainty into a probability, and that is why the review should also ask about the second line of defence: dual authorisation on payments, a cooling-off period on new bank details, and insurance cover that actually responds to social-engineering losses.
The common mistake is to accept the policy as evidence of the control. An analyst who reads "all changes to payment instructions are verified by telephone" and ticks the box has tested the drafting, not the practice. The evidence that separates the 15 per cent row from the 2 per cent row is specific: a log of callbacks with the number dialled and its source, the results of staged tests, and the exceptions from the last year with what was done about them.
The second mistake is thinking in annual probabilities. A 4.0 per cent chance a year sounds remote. Across a ten-year fund life the same control leaves a one-in-three chance of a loss of 1.8m, and for email-only verification the expected time to a successful fraud is 1.7 years.
The free workbook for this book at the companion page works this case among the three new ones. For how a finding like this should feed into a manager's rating without being averaged away, see why refining an ODD rubric makes it weaker, and for the cost side of the operating model, what a cheaper administrator actually saves.
It is a rule that any change to bank details is confirmed by telephone on a number already on file, never one supplied in the request. In an illustrative fund facing two fraud attempts a year on 1.8m payments, a tested callback cuts the expected loss to 0.07m a year from 1.08m with email confirmation only.
Ask for evidence of operation, not the policy: a callback log showing the number dialled and its source, results of staged fake requests, and last year's exceptions. In an illustrative case the gap between an untested and a tested callback is worth 0.468m a year in expected loss, so a test costing 0.05m a year returns 9.4 times its cost.
It is 1 minus (1 minus the success rate) to the power of the number of attempts. With 20 attempts over ten years, an untested callback failing 15 per cent of the time gives a 96.1 per cent chance of at least one loss; a tested callback failing 2 per cent of the time still gives 33.2 per cent.
This article is one calculation from Operational Due Diligence in Private Equity. The book takes the same case from first principles to the decision, chapter by chapter, and every figure it prints is a live formula in the free companion workbooks.
Get the book on Amazon →Free companion files
Also on Amazon UK · Amazon Germany · Amazon France · Amazon Canada
Reading guide: private equity and private markets → · All 324 articles →
If this book helped, or didn’t, a few lines on Amazon are worth more than they look: they are what the next reader goes on. Write a review. The workbook stays free either way.