In-depth guide · Governance
Risk management in a family office
Updated: · Leutrim Miftaraj, FLIORE · Editorial standards · Other languages: Deutsch · Français · Español
Short answer
Risk management in a family office looks not only at investments but at everything that can endanger the family wealth and the family: market and liquidity risks, operational and legal risks, cyber attacks, dependence on key people, reputation and conflicts within the family. A risk register with assessments, owners and measures, a defined risk appetite and a regular report to the family council make it effective.
More than investment risk
Asset managers measure the volatility and drawdown of their mandates. Family wealth, however, is more than the sum of the mandates: it includes a business, real estate, loans, structures in several countries and people with different goals. The heaviest losses for families often arise outside the securities – through concentration in their own business, through fraud, through disputes or through the loss of a person who knew everything.
Risk categories
- Market and liquidity: price losses, interest rates, currencies, liquidity shortages, concentrations.
- Operational: errors and fraud in payments, data quality, failure of service providers.
- Legal and regulatory: reporting duties, taxes, due diligence obligations, liability of officers.
- Cyber: account takeovers, data leaks, encryption of systems.
- Key people: loss of the head of the family office or of the principal.
- Family and governance: conflicts, unclear decision paths, succession.
- Reputation: public reporting, sanctions or legal cases.
The process
- Identify risks – in conversations with the family, the team and advisers, not only at the desk.
- Assess the likelihood and impact of each risk, for example on a scale of 1 to 5.
- Set the risk appetite: which risks does the family bear consciously, and which not?
- Decide on measures: avoid, reduce, transfer (for example through insurance) or consciously accept.
- Assign owners and dates.
- Monitor and report regularly, in full at least annually and immediately when events occur.
Risk register (example)
| Risk | Likelihood | Impact | Measure | Owner |
|---|---|---|---|---|
| Payment fraud through a forged instruction | 3 | 4 | Four-eyes approval, call-back procedure, training | CFO |
| Loss of the head of the family office | 2 | 5 | Deputy, documented processes, emergency access | Family council |
| Concentration in the family business | 3 | 5 | Gradual diversification, liquidity reserve | Investment committee |
| Missed reporting deadline | 2 | 3 | Compliance calendar with owners | Compliance |
| Conflict between family branches | 2 | 4 | Family constitution, family council, facilitation | Family council |
Worked example (simplified)
A family council asks the family office for a first risk register. Conversations show that the family's main worry is not the stock market but its dependence on the long-standing head of the family office, who is the only one who knows all the access rights and processes. The register rates this risk with the highest impact. Measures: a deputy, documented processes, a sealed emergency access and a central platform instead of personal files. A year later the risk has fallen considerably – and the head of the family office has been relieved.
Reporting
A good risk report is short: the main risks with the change since the last report, the status of the measures, new risks and events. An overview in the form of a likelihood and impact matrix helps the family council to set priorities. ISO 31000 and the COSO framework for enterprise risk management offer a proven structure that can be tailored to the size of a family office.
Formulating the risk appetite concretely
A risk appetite that only says «the family is conservative» helps no one. It becomes effective when it is measurable. Possible examples: net worth should not fall by more than a set percentage in a severe stress scenario; liquidity should cover twelve months of needs under stress; no single asset other than the family business should exceed a set share of the wealth; Lombard loans should not exceed a ceiling relative to the lendable portfolio value; operational risks such as payment fraud are reduced with all proportionate controls.
Such statements can be monitored and reported. They should be adopted by the family council and reviewed at least annually, because life situations, generations and goals change. It also matters what the family consciously bears – such as the concentration risk in its own business – so that it is documented as a decision rather than an omission.
In FLIORE
FLIORE provides data for the main risks: consolidated wealth with look-through and concentrations, liquidity and commitments, risk assessment of the mandates, deadlines and controls in the compliance calendar, rights and the audit trail. Measures can be tracked as tasks with owners and dates.
At a glance
| Frameworks | ISO 31000, COSO Enterprise Risk Management |
|---|---|
| Core instrument | Risk register with assessment, measures, owners |
| Often the biggest risk | Key people, concentration in the own business, fraud |
Terms on this page
- Consolidated wealth
- The overall view of a family's wealth across all banks, structures and currencies in one reporting currency.
- Audit trail
- An unalterable log that records who created, changed, approved or deleted which data and when.
Frequently asked questions
Who is responsible for risk management in a family office?
The head of the family office coordinates; responsibility for the risk appetite lies with the family council or the owners. Individual risks have their own owners.
How often is the risk register reviewed?
In full at least annually, and immediately after material events, such as an incident, a change of staff or a large transaction.
What is risk appetite?
The conscious decision about which risks the family wants to bear and to what extent – such as a maximum loss under stress or a minimum level of liquidity.
How are risks assessed?
Usually by likelihood and impact on a simple scale. The shared discussion and the measures derived from it matter more than the precision of the numbers.
Do family conflicts belong in the risk register?
Yes. Conflicts and unclear decision paths are among the most frequent causes of losses in value in family wealth. Measures include a family constitution and a family council.
Does insurance help?
For certain risks such as liability, cyber or tangible assets, yes. Insurance transfers the financial consequences but does not replace prevention.
How does risk appetite differ from risk tolerance?
Risk appetite describes which risks the family is willing to take to achieve its goals. Tolerance sets the concrete limits whose breach triggers a response.
What is a near miss?
An event in which damage was only just prevented, such as a forged payment instruction that was spotted. Near misses are valuable indications of weaknesses and should be analysed like incidents.
How is risk management built into everyday work?
Through fixed dates in the calendar, risks as an agenda item at meetings of governing bodies and measures as tasks with owners. This way it does not remain an annual document but becomes part of management.
How extensive must a risk register be?
For a family office, 15 to 30 clearly described risks are often enough. Understandable descriptions, realistic assessments and measures with owners and dates matter more than completeness down to the last detail.
Sources
- ISO – ISO 31000 Risk management – Guidelines
- COSO – Enterprise Risk Management Framework
- Basel Committee (BIS) – principles for the management of operational risk
- CFA Institute – risk management
- Swiss Federal Office for Cybersecurity (NCSC/BACS)
This page provides orientation and does not replace legal or tax advice. The cited legal sources in their applicable version are authoritative.
Read more
More on Setup, governance & selection
FLIORE in your family office
See structures, compliance and consolidated wealth with your own questions – in a personal demo.