vaayaa Inclusive Education
Finance risk assessment

Asset Management Strategies Risk Assessment: Maintenance, Data, Supplier and Safety Controls

A worked example of how an asset management function identifies, scores and controls risks to physical and financial assets, from maintenance backlog and data loss to supplier failure, fraud and safety exposure.

Updated November 2026 8 hazards assessed Review every 6 months Highest risk: Critical to Medium
See the Asset Management Strategies course

Executive summary

This assessment shows how an asset management team can identify, rate and control the risks that threaten its assets, service continuity and the trust placed in its reporting. Eight hazards were chosen because they are plausible in everyday asset strategy work, including maintenance backlog, inaccurate registers, supplier dependency, data outages, knowledge loss and safety failure. Each hazard is scored before controls to show its natural level, then again after existing and added controls. The highest inherent scores sit with data loss and maintenance deferral, while safety and fraud carry serious consequences even where likelihood is lower. Most hazards fall to Medium or Low once added controls are in place, although data and maintenance risks remain Medium because they depend on systems and partners outside direct control. The first actions are a risk based maintenance backlog review, a verified asset register, tested data recovery and a documented handover standard. The organization is a teaching example, so every score illustrates method rather than describing a real operation.

Focus area
Asset management strategy and lifecycle control
Setting
Finance and operations function of a mid-sized organization that owns and maintains physical and financial assets
Method
Five by five likelihood and impact asset risk register

Scope

This assessment covers the asset management function of a mid-sized organization that owns and maintains plant, equipment, vehicles and buildings, from strategy and planning through acquisition, maintenance, disposal and reporting. It considers risks to service continuity, asset value, safety, legal duties and stakeholder trust. Jurisdiction, sector, asset types and systems are not specified, so they are treated as assumptions for teaching purposes.

Context

The organization owns plant, vehicles and buildings that deliver a regular service to customers. Its asset manager sets the strategy, the maintenance team carries out inspections and repairs, and finance approves budgets and reports asset values. Asset data sits in a single register and a maintenance system, with spreadsheets used for some forecasts. Contractors support specialist repairs, and the board receives condition and cost reports each quarter. Each hazard is scored before controls to show its natural level, then again after existing controls and added controls.

Objectives, assets and stakeholders

The objective is to keep assets safe, available and affordable over their lives, to report their condition and value accurately, and to meet legal and stakeholder expectations. The assets in scope are physical plant, equipment, vehicles and buildings, the asset register and condition data, maintenance records, spare parts, contracts with suppliers and the cash committed to renewal and disposal. Stakeholders include the asset manager, operations and maintenance staff, finance, the board, customers who depend on the service, contractors, regulators where they apply, insurers and the public. Every hazard has one owner role, and the asset manager keeps the register current and reports to the board each quarter.

Risk matrix: before and after controls

Each cell shows hazard numbers placed by likelihood and impact. Compare the two grids to see how controls move each hazard.

Before controls

Inherent risk

Risk before controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely Likelihood 4, impact 3, score 12, high: H02 H06 Likelihood 4, impact 4, score 16, high: H01 Likelihood 4, impact 5, score 20, critical: H05
3 Possible Likelihood 3, impact 3, score 9, medium: H04 H08 Likelihood 3, impact 4, score 12, high: H03
2 Unlikely Likelihood 2, impact 5, score 10, high: H07
1 Rare

After controls

Residual risk

Risk after controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely
3 Possible Likelihood 3, impact 3, score 9, medium: H01 H05
2 Unlikely Likelihood 2, impact 2, score 4, low: H06 H08 Likelihood 2, impact 3, score 6, medium: H02 H03 H04
1 Rare Likelihood 1, impact 5, score 5, medium: H07
  • Low 1 to 4
  • Medium 5 to 9
  • High 10 to 16
  • Critical 17 to 25

Hazard register

A summary first, then the detail for each hazard.

Summary of hazards with scores before and after controls
No.HazardBeforeAfterOwner
H01 Maintenance backlog and deferred renewal 16 High 9 Medium Asset manager
H02 Inaccurate asset register and valuation 12 High 6 Medium Financial controller
H03 Fraud and leakage in procurement and disposals 12 High 6 Medium Internal auditor
H04 Supplier and contractor dependency 9 Medium 6 Medium Procurement manager
H05 Technology outage and loss of asset data 20 Critical 9 Medium IT manager
H06 Handover failure and loss of asset knowledge 12 High 4 Low Operations manager
H07 Asset failure causing injury or harm 10 High 5 Medium Health and safety manager
H08 Non-compliance and misreported asset condition 9 Medium 4 Low Compliance officer
H01

Maintenance backlog and deferred renewal

Operational Before 16 After 9

Planned maintenance and renewal work is postponed to protect short-term budgets, so assets degrade faster than the plan assumes and failures rise across the portfolio.

Who or what is affected: Operations staff, service users and the finance team

Causes

Tight budgets, a reactive culture and renewal plans based on age rather than condition.

Consequences

Unplanned outages, higher repair costs, shortened asset life and lost service.

Existing controls

  • A maintenance schedule is kept for critical assets.
  • Monthly reports list overdue work orders.

Control gaps

Deferrals are approved by budget holders without a risk view of each asset.

Additional controls

  • Prevent: Rank deferred work by risk to service and safety before any budget cut is approved.
  • Detect: Review backlog age and condition scores each month and flag assets past their threshold.
Likelihood 4 x impact 4 before; 3 x 3 after Owner: Asset manager Target: Within 60 days Early warning: Overdue critical work orders older than 30 days.
H02

Inaccurate asset register and valuation

Financial Before 12 After 6

Asset records are incomplete, duplicated or carried at values that no longer reflect condition, so reports and disposal decisions rest on wrong information.

Who or what is affected: Finance team, board and auditors

Causes

Manual entry, missed disposals and assets moved between sites without notice.

Consequences

Misstated balance sheet, poor renewal decisions and failed audit queries.

Existing controls

  • The asset register is updated when new items are purchased.
  • An annual valuation review is carried out by the finance lead.

Control gaps

Physical checks are sampled only at the main site, so remote assets are rarely verified.

Additional controls

  • Prevent: Tag each asset with a unique reference linked to its location and owner.
  • Detect: Reconcile the register to purchase records and carry out physical checks on a sample each quarter.
Likelihood 4 x impact 3 before; 2 x 3 after Owner: Financial controller Target: Within 60 days Early warning: Register differences above a set tolerance after reconciliation.
H03

Fraud and leakage in procurement and disposals

Financial Before 12 After 6

Fake suppliers, inflated invoices or asset disposals sold below value take money from the organization, often in small repeated amounts over long periods.

Who or what is affected: Owners, finance staff and contract partners

Causes

Trust placed in one person, weak checks on supplier changes and pressure to clear surplus stock.

Consequences

Direct loss, legal action, reduced budgets and damaged trust.

Existing controls

  • Purchase orders need budget holder approval.
  • Disposals are recorded in the asset register.

Control gaps

Disposal values are agreed by one manager without an independent check.

Additional controls

  • Prevent: Verify new suppliers and changes to bank details through a call to a known contact.
  • Detect: Compare disposal prices with independent valuations and review repeated small invoices.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Internal auditor Target: Within 45 days Early warning: A disposal sold below the independent valuation with no recorded reason.
H04

Supplier and contractor dependency

Supplier Before 9 After 6

A single contractor or spare parts supplier fails, is delayed or cannot provide specialist skills, so repairs stop and the organization cannot maintain its assets as planned.

Who or what is affected: Maintenance crews, service users and the asset manager

Causes

Single sourcing, long lead times and contracts that do not test performance.

Consequences

Extended downtime, emergency pricing and failed service commitments.

Existing controls

  • Key contractors are listed with agreed response times.
  • Critical spare parts are held on site for the most important assets.

Control gaps

Supplier performance is reviewed only after a failure, not against agreed measures.

Additional controls

  • Prevent: Qualify a second supplier for critical parts and skills before the first one is needed.
  • Respond: Activate the agreed emergency contract when a primary supplier misses its response time.
Likelihood 3 x impact 3 before; 2 x 3 after Owner: Procurement manager Target: Within 90 days Early warning: A critical supplier that misses agreed response times in two consecutive months.
H05

Technology outage and loss of asset data

Technology and data Before 20 After 9

Asset management software, sensor feeds or backups fail or become corrupted, so condition data, maintenance history and renewal plans cannot be used when they are needed.

Who or what is affected: Maintenance staff, finance, service users and suppliers who rely on the data

Causes

Software faults, weak access controls, unpatched systems and a single backup location.

Consequences

Lost maintenance history, delayed repairs, poor decisions and questions from regulators.

Existing controls

  • The asset system is backed up each night.
  • Access to the system needs a named user login.

Control gaps

Restores have never been tested, and backups are kept only in the same building.

Additional controls

  • Prevent: Enable multi-factor sign in and limit editing rights to named roles only.
  • Recover: Test a full restore of the asset register and maintenance history each quarter.
Likelihood 4 x impact 5 before; 3 x 3 after Owner: IT manager Target: Within 30 days Early warning: A failed nightly backup or a restore test that does not complete.
H06

Handover failure and loss of asset knowledge

People Before 12 After 4

When staff move, retire or change roles, critical knowledge about asset condition, contracts and workarounds is not passed on, so decisions are made on incomplete information.

Who or what is affected: New and departing staff, maintenance teams and service users

Causes

Informal knowledge held by one person, short notice resignations and no shadowing period.

Consequences

Repeated mistakes, missed inspections and disputes over contracts.

Existing controls

  • Staff sign a handover note when they leave.
  • Key maintenance procedures are written down.

Control gaps

Handover notes are optional and rarely checked by the next owner.

Additional controls

  • Prevent: Keep a structured handover checklist for every asset owner role with a named successor.
  • Detect: Review open actions and contract notes at each role change before the post is closed.
Likelihood 4 x impact 3 before; 2 x 2 after Owner: Operations manager Target: Within 45 days Early warning: An asset role changes without a signed handover note.
H07

Asset failure causing injury or harm

Safety Before 10 After 5

Equipment, structures or vehicles fail because inspections are missed, faults are ignored or work is done by untrained people, so staff or members of the public are injured.

Who or what is affected: Maintenance staff, operators and members of the public near assets

Causes

Missed inspections, deferred repairs and untrained workers.

Consequences

Injury, fatality, legal action where applicable, closure of the asset and loss of the right to operate.

Existing controls

  • Inspection schedules are kept for safety critical assets.
  • Operators report defects through a logged form.

Control gaps

Defect reports are not tracked to closure, so open faults can be forgotten.

Additional controls

  • Prevent: Restrict safety critical work to trained and authorized staff and check competence each year.
  • Respond: Isolate any asset with a known hazard and tag it out of service until a competent person clears it.
Likelihood 2 x impact 5 before; 1 x 5 after Owner: Health and safety manager Target: Within 30 days Early warning: An open safety defect older than the agreed response period.
H08

Non-compliance and misreported asset condition

Legal and compliance Before 9 After 4

Reports to the board, regulators or insurers present asset condition or compliance status more favorably than the evidence supports, and required permits or certificates lapse unnoticed.

Who or what is affected: Board, regulators, insurers and the public

Causes

Unclear duties, optimistic reporting and permits that lapse without warning.

Consequences

Penalties, loss of trust and forced shutdown of assets.

Existing controls

  • Compliance records are kept for each asset class.
  • The board pack is reviewed by the finance lead before issue.

Control gaps

Reports are reviewed for presentation, not checked against source records.

Additional controls

  • Prevent: Keep a permit and certificate calendar with an owner and a backup owner for each item.
  • Detect: Test a sample of board reports against the register and inspection records twice a year.
Likelihood 3 x impact 3 before; 2 x 2 after Owner: Compliance officer Target: Within 60 days Early warning: A permit or certificate due within 30 days with no named owner.

Rating method and evaluation

Each hazard is rated on two five-point scales. Likelihood runs from Rare to Almost certain, and impact runs from Insignificant to Catastrophic, with each level described in words for the asset portfolio. Multiplying the two gives a score from 1 to 25, which falls into one of four bands: Low from 1 to 4, Medium from 5 to 9, High from 10 to 16 and Critical from 17 to 25. Inherent risk is the score before any controls, judged as if nothing is in place. Residual risk is the score after existing controls and the additional controls that are planned, and it must never be higher than the inherent score. Impact is judged on service loss, safety harm, money lost, effect on reported values and damage to trust, and a risk is never rated down only because it has not happened yet. Critical and High risks need senior attention and a dated plan, Medium risks need routine controls with a named owner, and Low risks are accepted and watched. The scores are challenged by the people who do the work, by the internal auditor and by the owner who must carry the residual risk. Ratings are revisited whenever an early warning indicator reaches its threshold or a major asset, supplier or system changes.

Likelihood, impact and rating bands

Likelihood

  • 5 Almost certain: Expected to happen in most circumstances.
  • 4 Likely: Will probably happen in many circumstances.
  • 3 Possible: Could happen at some time.
  • 2 Unlikely: Not expected, but it could happen.
  • 1 Rare: Only in exceptional circumstances.

Impact

  • 1 Insignificant: No lasting effect. Handled within routine work.
  • 2 Minor: Small effect that is quickly corrected.
  • 3 Moderate: Noticeable effect that needs managed effort to correct.
  • 4 Major: Serious effect on people, delivery or reputation.
  • 5 Catastrophic: Severe or lasting effect that threatens the whole activity.

Bands (likelihood x impact)

  • Low (1 to 4): Accept and monitor.
  • Medium (5 to 9): Manage with routine controls.
  • High (10 to 16): Senior attention and a treatment plan.
  • Critical (17 to 25): Act first. Do not proceed until reduced.

Monitoring, escalation and review

Review this assessment every 6 months, and sooner when an indicator below reaches its threshold.

Early-warning indicators and escalation thresholds
Indicator to watchEscalate when
Overdue critical work orders older than 30 days.Escalate to the asset manager when any critical order is overdue, and to the board if the backlog grows for two months.
Register differences above tolerance after reconciliation.Escalate to the financial controller at once, and to the internal auditor if differences persist after 30 days.
A failed nightly backup or a restore test that does not complete.Escalate to the IT manager the same day, and to the operations manager if the system is unavailable for a full shift.
A critical supplier missing agreed response times.Escalate to the procurement manager after one miss, and activate the emergency contract after a second.
An open safety defect older than the agreed response period.Escalate to the health and safety manager at once and isolate the asset until a competent person clears it.

Contingency arrangements

If a serious event occurs, such as a failed critical asset, a data loss or a suspected fraud, the asset manager stops related work and isolates the affected asset or account. The IT manager restores systems from the latest tested backup, and the financial controller preserves records for review. Safety incidents are reported to the health and safety manager at once, and regulators or insurers are contacted through the compliance officer where required. Service users are told early what to expect, and temporary capacity is arranged through the emergency supplier contract.

Prioritized action plan

  1. Re-rank deferred maintenance by risk to safety and service, owner asset manager, within 30 days.
  2. Enable multi-factor sign in and test a full restore of the asset register, owner IT manager, within 30 days.
  3. Reconcile the asset register to purchase records and verify remote assets, owner financial controller, within 60 days.
  4. Introduce a structured handover checklist and check open actions at each role change, owner operations manager, within 45 days.
  5. Qualify a second supplier for critical parts and skills, owner procurement manager, within 90 days.

Conclusion

Sound asset management rests on a few steady habits: ranking maintenance by risk, keeping a verified register, testing recovery, qualifying more than one supplier and handing over knowledge properly. The highest scores sit with data loss and maintenance deferral, and each has actions that reduce the residual score. Treat the register as a living record, review it on the stated cycle, and seek qualified engineering, legal or financial advice for any real decision about assets.

Assumptions and limitations

Assumptions

  • The organization owns a mixed portfolio of plant, vehicles and buildings, and jurisdiction is not specified.
  • Asset data is held in one register and one maintenance system with named users.
  • Staff are trained for their roles, and safety critical work needs a recorded competence check.

Limitations

  • The scores are examples for learning and do not describe any real organization or asset portfolio.
  • Engineering, safety and legal duties vary by sector and place, so specialist review is needed.
  • This is educational content and does not replace a formal site-specific assessment or licensed advice.

Related frameworks to study

  • Lifecycle asset management planning
  • Risk register and risk appetite approach
  • Hierarchy of controls
  • Three lines model of risk ownership
  • Total cost of ownership analysis

Finance Risk Assessment

China, India, United States, Indonesia, Pakistan, Nigeria, Brazil, Bangladesh, Russia, Japan, Mexico, Philippines, Vietnam, Egypt, Turkey, Germany, United Kingdom, France, Italy, Canada, South Korea, Australia, Spain.

For Learning Reference Only: This assessment demonstrates how risk assessment principles are applied in a practical setting, providing a useful reference for learning and understanding. Actual assessments may be adapted to suit specific site conditions and circumstances.

Keep learning

Study the subject behind this assessment.

Asset Management Strategies course Read the best practices for this course

More Finance risk assessments

Hourly Active: 40,745 Learners