vaayaa Inclusive Education
Finance risk assessment

Asset and Portfolio Management Risk Assessment: Valuation, Controls and Reporting Risks

A worked example of how a small asset management team finds, scores and controls the risks to portfolio valuation, trade processing, client money, reporting and conduct, from stale prices to misappropriation and weak access.

Updated November 2026 8 hazards assessed Review every 6 months Highest risk: Critical to Medium
See the Asset and Portfolio Management course

Executive summary

This assessment shows how a small asset and portfolio management team can find, rate and control the risks that matter most to asset values, client money and trust. Eight risks were chosen because they are plausible in daily investment, operations and reporting work. Valuation errors, weak data and cyber exposure score highest before controls, because they touch many holdings and reports at once. Fraud and misappropriation are less likely but cause serious harm. Each risk is scored before controls and again after existing and added controls. Most risks fall to Medium or Low once added controls are in place, while valuation risk remains Medium because stale prices can still mislead clients. The first actions are a written pricing policy with independent price checks, dual approval of trades and payments, a tested backup and a conflicts register. The business is a teaching example, so every score illustrates method, not a real firm.

Focus area
Asset and portfolio management
Setting
Investment management team running discretionary and advisory portfolios for a small group of clients
Method
Five by five likelihood and impact risk register

Scope

This assessment covers the asset and portfolio management function, from client mandates and investment decisions through trade execution, valuation, reconciliation, client reporting and regulatory duties. It looks at risks to asset values, client money, data, reputation and legal duties. It does not cover individual investment advice or the tax position of any real client. Jurisdiction, fund structure and systems are assumptions made for teaching.

Context

The team has a chief investment officer, two portfolio managers, an operations analyst, a compliance officer and an IT lead who supports the portfolio system. Holdings are recorded in a portfolio management platform, with spreadsheets used for some valuations and performance checks. Custodians hold the assets and send daily statements, and an external administrator prepares periodic reports. Each risk is scored before controls to show its natural level, then again after existing and added controls.

Objectives, assets and stakeholders

The objective is to value and manage client assets accurately, execute trades correctly, protect client money and data, report honestly on performance and meet the duties owed to clients and regulators. The assets in scope are client portfolios and holdings, cash and custody balances, valuation models and price files, the portfolio platform, client records and the reputation of the team. Stakeholders include clients, the investment committee and board, custodians and administrators, pricing vendors, brokers, auditors and regulators. Every risk has one owner role, and the chief investment officer keeps the register current and reports to the investment committee each quarter.

Risk matrix: before and after controls

Each cell shows hazard numbers placed by likelihood and impact. Compare the two grids to see how controls move each hazard.

Before controls

Inherent risk

Risk before controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain Likelihood 5, impact 4, score 20, critical: H01
4 Likely Likelihood 4, impact 3, score 12, high: H02 H08 Likelihood 4, impact 4, score 16, high: H06
3 Possible Likelihood 3, impact 3, score 9, medium: H07 Likelihood 3, impact 4, score 12, high: H04 H05 Likelihood 3, impact 5, score 15, high: H03
2 Unlikely
1 Rare

After controls

Residual risk

Risk after controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely
3 Possible Likelihood 3, impact 2, score 6, medium: H08 Likelihood 3, impact 3, score 9, medium: H01
2 Unlikely Likelihood 2, impact 2, score 4, low: H07 Likelihood 2, impact 3, score 6, medium: H02 H04 H05 H06 Likelihood 2, impact 4, score 8, medium: H03
1 Rare
  • Low 1 to 4
  • Medium 5 to 9
  • High 10 to 16
  • Critical 17 to 25

Hazard register

A summary first, then the detail for each hazard.

Summary of hazards with scores before and after controls
No.HazardBeforeAfterOwner
H01 Valuation errors and stale pricing 20 Critical 9 Medium Chief investment officer
H02 Trade execution and transaction processing errors 12 High 6 Medium Operations lead
H03 Misappropriation and fraud in payments and client money 15 High 8 Medium Internal auditor
H04 Conflicts of interest and conduct breaches 12 High 6 Medium Compliance officer
H05 Liquidity and counterparty exposure 12 High 6 Medium Treasury lead
H06 Data quality and cyber exposure 16 High 6 Medium IT lead
H07 Regulatory reporting and tax duty failures 9 Medium 4 Low Compliance officer
H08 Market and concentration risk in holdings 12 High 6 Medium Head of risk
H01

Valuation errors and stale pricing

Financial Before 20 After 9

Holdings are priced from stale or unverified sources, illiquid assets are marked using untested models, and errors in price files or formulas flow into client statements and performance figures.

Who or what is affected: Clients, portfolio managers and the investment committee

Causes

Thinly traded holdings, reliance on one vendor and spreadsheets used to override prices.

Consequences

Misstated client statements, incorrect fees, poor investment decisions and complaints or claims.

Existing controls

  • Prices are taken from a recognized pricing vendor each day.
  • Month-end valuations are reviewed by the portfolio administrator.

Control gaps

Vendor price exceptions are cleared by one person, and model inputs are not revisited each quarter.

Additional controls

  • Prevent: Adopt a written pricing policy with independent checks for any holding without a daily market price.
  • Detect: Compare model values with later realized prices and report differences above a set tolerance.
Likelihood 5 x impact 4 before; 3 x 3 after Owner: Chief investment officer Target: Within 45 days Early warning: A holding priced from a source older than the agreed age limit.
H02

Trade execution and transaction processing errors

Operational Before 12 After 6

Orders are entered with the wrong size, side or security, allocated to the wrong portfolio, or settled late, so positions and cash balances differ from what clients expected.

Who or what is affected: Clients, operations staff and custodians

Causes

Manual order entry, rushed trading at market open and unclear allocation rules.

Consequences

Client losses, reimbursement costs, failed settlement and questions from regulators.

Existing controls

  • Orders are checked against mandate limits before release.
  • Trade confirmations are matched with the broker each day.

Control gaps

Limits are set per account but not per security, so large single errors can pass unnoticed.

Additional controls

  • Prevent: Use size and price checks in the order system that block trades outside set bounds.
  • Respond: Cancel or correct erroneous trades within agreed timeframes and record the cost to the firm.
Likelihood 4 x impact 3 before; 2 x 3 after Owner: Operations lead Target: Within 30 days Early warning: Trade corrections or late settlements above the normal weekly count.
H03

Misappropriation and fraud in payments and client money

Financial Before 15 After 8

Fake counterparties, altered payment instructions or diverted client cash take money from portfolios, often in small amounts that go unnoticed for a long time.

Who or what is affected: Clients, custodians and the firm's staff

Causes

Trust placed in one person, pressure to meet targets and weak checks on changes to payment instructions.

Consequences

Direct client loss, legal claims, custody disputes and damage to trust.

Existing controls

  • Payment instructions above a set value need a manager signature.
  • Client cash is held in segregated accounts at the custodian, and no one can both create and release a payment.

Control gaps

Instruction checks are done on a sample, so small repeated diversions can pass.

Additional controls

  • Prevent: Verify new counterparties and changed bank details by a call to a known contact before any payment.
  • Detect: Match payments to approved instructions and review round sum or repeated transfers each month.
Likelihood 3 x impact 5 before; 2 x 4 after Owner: Internal auditor Target: Within 45 days Early warning: A payment instruction change that is not confirmed by a call back.
H04

Conflicts of interest and conduct breaches

Reputational Before 12 After 6

Managers trade ahead of clients, favor related brokers, accept inducements or allocate attractive new issues unfairly, which weakens trust and breaches the duties owed to clients.

Who or what is affected: Clients, colleagues and regulators

Causes

Personal investments, incentive pay tied to short term results and close ties with brokers.

Consequences

Client detriment, disciplinary action, loss of clients and reputational harm.

Existing controls

  • A code of conduct is signed each year.
  • Personal trading in listed securities must be pre-approved.

Control gaps

Personal trading reports are collected but not compared with the firm's own trades.

Additional controls

  • Prevent: Keep a conflicts register and check every new mandate and broker against it before dealing.
  • Respond: Provide a confidential route to raise concerns and record how each concern was resolved.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Compliance officer Target: Within 60 days Early warning: A declared interest linked to a security being bought or sold for clients.
H05

Liquidity and counterparty exposure

Financial Before 12 After 6

Clients redeem faster than assets can be sold, a counterparty or broker fails, or a leveraged holding moves sharply, so the portfolio cannot meet its obligations when they fall due.

Who or what is affected: Investors, clients and the treasury team

Causes

Concentration in a few holdings or counterparties and cash forecasts that are rarely updated.

Consequences

Forced sales at poor prices, missed payments, suspension of dealing and client harm.

Existing controls

  • The liquidity of each holding is reviewed each month.
  • Derivative counterparties must meet agreed credit ratings.

Control gaps

Liquidity stress is tested only once a year, and counterparty limits are not rechecked daily.

Additional controls

  • Prevent: Set liquidity limits for illiquid holdings and a maximum share of exposure to any single counterparty.
  • Respond: Agree a standby cash plan and an order of asset sales for a redemption shortfall.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Treasury lead Target: Within 60 days Early warning: Cash cover or saleable assets below the agreed floor for the next 30 days.
H06

Data quality and cyber exposure

Technology and data Before 16 After 6

Weak passwords, phishing and unprotected spreadsheets expose client records and portfolio data, while poor reference data and manual copying between systems create errors in holdings and reports.

Who or what is affected: Clients, staff, custodians and the IT lead

Causes

Phishing, reused passwords and spreadsheets copied between people.

Consequences

Stolen client data, false instructions, report errors and a notice from regulators.

Existing controls

  • The portfolio platform requires a password and is backed up each night.
  • Client files are shared only through the firm's approved storage.

Control gaps

Key valuation spreadsheets sit outside the platform and outside its access controls.

Additional controls

  • Prevent: Enable multi-factor sign in and train staff each year to spot payment fraud and credential requests.
  • Recover: Test restoring the portfolio database from backup and keep a written recovery plan.
Likelihood 4 x impact 4 before; 2 x 3 after Owner: IT lead Target: Within 30 days Early warning: Repeated phishing reports or failed sign in attempts on finance mailboxes.
H07

Regulatory reporting and tax duty failures

Legal and compliance Before 9 After 4

Client reports, performance figures, tax reporting or regulatory returns are late, inaccurate or misapplied, so clients and authorities receive information they cannot rely on.

Who or what is affected: Clients, the board and regulators

Causes

Rules that differ by jurisdiction, manual report production and last minute preparation.

Consequences

Penalties, restated reports, client complaints and loss of regulator trust.

Existing controls

  • A reporting calendar lists the main deadlines.
  • Performance figures are checked by the administrator before release.

Control gaps

Jurisdiction is assumed, and no one confirms current rules before a return is made.

Additional controls

  • Prevent: Keep a compliance calendar with an owner and backup owner for each duty, checked monthly.
  • Detect: Have a qualified reviewer test a sample of reports against the rules that apply.
Likelihood 3 x impact 3 before; 2 x 2 after Owner: Compliance officer Target: Within 30 days Early warning: A report due within 10 days with no preparer or reviewer named.
H08

Market and concentration risk in holdings

Financial Before 12 After 6

Large positions in one sector, issuer or currency, or a sharp market move, cause losses beyond what the mandate allows, and limits are breached before anyone acts.

Who or what is affected: Clients, portfolio managers and the risk committee

Causes

Conviction positions, benchmark drift and limits that are checked only at the time of trading.

Consequences

Client losses, mandate breaches, forced selling and loss of trust.

Existing controls

  • Position limits are checked before each trade.
  • Exposure reports go to the investment committee each month.

Control gaps

Limits are not rechecked when prices move, so drift builds up unnoticed.

Additional controls

  • Prevent: Set concentration limits by issuer, sector and currency within each mandate and enforce them in the system.
  • Detect: Run stress tests each quarter and report any breach to the risk committee the same week.
Likelihood 4 x impact 3 before; 3 x 2 after Owner: Head of risk Target: Within 60 days Early warning: Any position above its concentration limit or outside its mandate range.

Rating method and evaluation

Each risk is rated on two five-point scales. Likelihood runs from Rare to Almost certain, and impact runs from Insignificant to Catastrophic, covering client loss, cost to correct, effect on reported performance and harm to trust. Multiplying the two gives a score from 1 to 25, which falls into one of four bands: Low from 1 to 4, Medium from 5 to 9, High from 10 to 16 and Critical from 17 to 25. The score is a guide for ordering work, not a precise measurement. Inherent risk is the score before any controls. Residual risk is the score after the existing and added controls, and it can never be higher than the inherent score. Any inherent score of 10 or more must show a lower residual score once controls are considered. Critical and High risks need senior attention and a dated plan, Medium risks need routine controls with a named owner, and Low risks are accepted and watched. Ratings are challenged by the people who do the work and by the internal auditor, who can ask for evidence before a score is lowered. Ratings are reviewed on the stated cycle and whenever an indicator reaches its escalation threshold.

Likelihood, impact and rating bands

Likelihood

  • 5 Almost certain: Expected to happen in most circumstances.
  • 4 Likely: Will probably happen in many circumstances.
  • 3 Possible: Could happen at some time.
  • 2 Unlikely: Not expected, but it could happen.
  • 1 Rare: Only in exceptional circumstances.

Impact

  • 1 Insignificant: No lasting effect. Handled within routine work.
  • 2 Minor: Small effect that is quickly corrected.
  • 3 Moderate: Noticeable effect that needs managed effort to correct.
  • 4 Major: Serious effect on people, delivery or reputation.
  • 5 Catastrophic: Severe or lasting effect that threatens the whole activity.

Bands (likelihood x impact)

  • Low (1 to 4): Accept and monitor.
  • Medium (5 to 9): Manage with routine controls.
  • High (10 to 16): Senior attention and a treatment plan.
  • Critical (17 to 25): Act first. Do not proceed until reduced.

Monitoring, escalation and review

Review this assessment every 6 months, and sooner when an indicator below reaches its threshold.

Early-warning indicators and escalation thresholds
Indicator to watchEscalate when
Holdings priced from a stale source or without an independent check beyond the agreed age.Escalate to the valuation committee at once when a price is older than the agreed limit, and to the chief investment officer if unresolved after 5 days.
Trades or payments that lack a second approval.Escalate to the operations lead when found, and hold the trade or payment until the approval is recorded.
Unmatched custody or administrator breaks older than 10 days.Escalate to the operations lead after 10 days, and to the chief investment officer if any break exceeds 30 days.
Declared personal interests linked to a security or client being managed.Escalate to the compliance officer within one working day, and restrict the affected trades until cleared.
Client cash or liquidity cover below the agreed floor.Escalate to the treasury lead when cover falls below the floor, and to the investment committee if it stays low for a month.

Contingency arrangements

If a serious event occurs, such as a valuation error reaching clients, confirmed misappropriation or a cyber breach, the chief investment officer pauses affected trading and payments, preserves records and informs the investment committee. The IT lead isolates affected systems and restores data from the latest tested backup. Compliance contacts the custodian, administrator and regulators as the relevant jurisdiction requires. Affected clients are told early and plainly, and corrected reports are issued before further decisions are made.

Prioritized action plan

  1. Adopt a written pricing policy with independent price checks for illiquid holdings, owner chief investment officer, within 45 days.
  2. Require dual approval for trades and payments and review user access rights, owner operations lead, within 30 days.
  3. Confirm counterparty and bank detail changes by call back and review duplicate payments, owner internal auditor, within 45 days.
  4. Enable multi-factor sign in and test a restore from backup, owner IT lead, within 30 days.
  5. Maintain a conflicts register and check it before each new mandate, owner compliance officer, within 60 days.

Conclusion

Sound portfolio management depends on a few steady habits: a documented pricing policy, independent price checks, dual approval of trades and payments, tested backups and a current conflicts register. The highest scores sit with valuation, data and cyber exposure, and each has actions that bring the residual score down. Treat the register as a living record, review it on the stated cycle, and seek qualified advice for any real investment, legal, tax or regulatory question.

Assumptions and limitations

Assumptions

  • The portfolios hold listed securities, funds and some illiquid holdings, priced from third party sources.
  • A custodian holds client assets and an independent administrator calculates net asset values.
  • Jurisdiction is not specified, so legal and tax duties are described in general terms only.
  • Staff are trained investment professionals using managed computers and a central portfolio system.

Limitations

  • The scores are examples for learning and do not describe any real fund, client or manager.
  • Investment, tax and conduct rules differ by country and change over time, so specialist review is needed.
  • This is educational content and is not investment, legal, tax or regulatory advice.

Related frameworks to study

  • Internal control framework with control activities and monitoring
  • Three lines model of risk ownership
  • Hierarchy of controls
  • Fair value measurement principles
  • Risk and control self-assessment

Finance Risk Assessment

China, India, United States, Indonesia, Pakistan, Nigeria, Brazil, Bangladesh, Russia, Japan, Mexico, Philippines, Vietnam, Egypt, Turkey, Germany, United Kingdom, France, Italy, Canada, South Korea, Australia, Spain.

For Learning Reference Only: This assessment demonstrates how risk assessment principles are applied in a practical setting, providing a useful reference for learning and understanding. Actual assessments may be adapted to suit specific site conditions and circumstances.

Keep learning

Study the subject behind this assessment.

Asset and Portfolio Management course Read the best practices for this course

More Finance risk assessments

Hourly Active: 40,745 Learners