vaayaa Inclusive Education
Professional risk assessment

Executive Assistant Services Risk Assessment: Confidentiality, Workload and Access Controls

A worked example of how an executive assistant service finds, scores and controls the risks that affect confidential information, schedules, workload, money and continuity of support for senior leaders.

Updated November 2026 8 hazards assessed Review every 6 months Highest risk: Critical to Medium
See the Executive Assistant Services course

Executive summary

This assessment shows how an executive assistant service can find, rate and control the risks that matter most to confidentiality, accuracy, money, wellbeing and continuity of support. Eight risks were chosen because they are plausible in everyday work with senior leaders. Disclosure of confidential papers is the most serious, scoring Critical before controls, while account compromise and diary conflicts are also significant. Each risk is scored before controls and again after existing and added controls. Most risks fall to Medium or Low once additional controls are in place. The first actions are a written sensitivity rule for board papers, multi-factor sign in for executive accounts, a single booking route and a workload limit for each assistant. The service is a teaching example, so every score illustrates method, not a real organization.

Focus area
Executive assistant services and administrative support
Setting
Executive support team serving senior leaders in a mid-sized organization with shared calendars, email and travel
Method
Five by five likelihood and impact risk register

Scope

This assessment covers the work of an executive assistant service, including diary management, correspondence, meeting preparation, travel, expenses, confidential papers and handovers. It looks at risks to confidentiality, accuracy, wellbeing and continuity. It does not cover legal, tax or employment advice. Jurisdiction, organization size, systems and contract terms are assumptions made for teaching only.

Context

The service has an assistant lead, three executive assistants and a shared inbox. Each assistant supports two or three senior leaders, using shared calendars, a document store, a travel booking tool and an expense system. Board papers and personnel matters are handled regularly. Each risk is scored before controls to show its natural level, then again after existing controls and the additional controls that should be added.

Objectives, assets and stakeholders

The objective is to protect confidential information, keep executive diaries accurate, manage money and travel responsibly, support assistant wellbeing and ensure work continues when people or systems are unavailable. The assets in scope are board papers, personnel records, executive email and calendars, travel and expense data, the gifts register, handover notes and the time of the assistant team. Stakeholders include the executives, board members, assistants, colleagues who receive their messages, finance and IT staff, suppliers and external guests. Clear roles matter: every risk has one owner role, and the assistant lead keeps the register current and reports to the executive team each quarter.

Risk matrix: before and after controls

Each cell shows hazard numbers placed by likelihood and impact. Compare the two grids to see how controls move each hazard.

Before controls

Inherent risk

Risk before controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain Likelihood 5, impact 4, score 20, critical: H01
4 Likely Likelihood 4, impact 3, score 12, high: H02 H03
3 Possible Likelihood 3, impact 3, score 9, medium: H05 H07 Likelihood 3, impact 4, score 12, high: H08 Likelihood 3, impact 5, score 15, high: H04
2 Unlikely Likelihood 2, impact 4, score 8, medium: H06
1 Rare

After controls

Residual risk

Risk after controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely
3 Possible Likelihood 3, impact 2, score 6, medium: H03
2 Unlikely Likelihood 2, impact 2, score 4, low: H05 H07 Likelihood 2, impact 3, score 6, medium: H02 H08 Likelihood 2, impact 4, score 8, medium: H01 H04
1 Rare Likelihood 1, impact 4, score 4, low: H06
  • Low 1 to 4
  • Medium 5 to 9
  • High 10 to 16
  • Critical 17 to 25

Hazard register

A summary first, then the detail for each hazard.

Summary of hazards with scores before and after controls
No.HazardBeforeAfterOwner
H01 Disclosure of confidential board and personnel information 20 Critical 8 Medium Assistant lead
H02 Diary conflicts and missed commitments 12 High 6 Medium Senior executive assistant
H03 Workload overload and assistant burnout 12 High 6 Medium Assistant lead
H04 Compromised executive accounts and devices 15 High 8 Medium IT manager
H05 Errors in expenses, travel and payments 9 Medium 4 Low Finance business partner
H06 Gifts, hospitality and conflicts of interest 8 Medium 4 Low Compliance officer
H07 Miscommunication and poor handovers 9 Medium 4 Low Senior executive assistant
H08 Loss of continuity and key person dependence 12 High 6 Medium Assistant lead
H01

Disclosure of confidential board and personnel information

Technology and data Before 20 After 8

Board papers, personnel matters or executive travel plans are sent to the wrong recipient, left on a shared printer or stored in a folder with wider access than intended, so sensitive information reaches people who should not see it.

Who or what is affected: Executives, board members, staff named in papers and the organization

Causes

Auto-complete in email, rushed sending, printing left unattended and folders shared more widely than needed.

Consequences

Breach of confidence, disciplinary action, legal complaint and loss of trust in the executive team.

Existing controls

  • Shared folders for board papers are restricted to named groups.
  • Assistants are trained to check recipients before sending confidential files.

Control gaps

Access reviews happen only when a folder owner changes, and email warnings are often ignored.

Additional controls

  • Prevent: Apply sensitivity labels and block external forwarding of board papers by default.
  • Detect: Review access logs for confidential folders each month and report unexpected viewers.
Likelihood 5 x impact 4 before; 2 x 4 after Owner: Assistant lead Target: Within 30 days Early warning: A confidential file is opened or forwarded by a user outside the agreed distribution list.
H02

Diary conflicts and missed commitments

Operational Before 12 After 6

Double bookings, missed time zone changes or late updates to shared calendars cause executives to miss meetings, arrive unprepared or give conflicting commitments to others.

Who or what is affected: Executives, meeting attendees and external partners

Causes

Parallel requests from many sources, time zone errors and changes made by phone without updating the calendar.

Consequences

Lost time, embarrassment, damaged relationships and missed decisions.

Existing controls

  • A shared calendar is maintained for each executive.
  • Weekly diary reviews are held with each executive.

Control gaps

Changes made verbally are not always recorded, and no one checks the diary across all leaders.

Additional controls

  • Prevent: Require all meeting requests to pass through one agreed booking route with a conflict check.
  • Detect: Run a daily check of the next three days for overlaps, travel gaps and missing briefs.
Likelihood 4 x impact 3 before; 2 x 3 after Owner: Senior executive assistant Target: Within 30 days Early warning: Two or more overlapping entries for one executive within a single working day.
H03

Workload overload and assistant burnout

People Before 12 After 6

Peak periods, unplanned travel and urgent requests from several leaders push assistants beyond sustainable hours, reducing accuracy and leading to stress, sickness or early departure.

Who or what is affected: Executive assistants, the assistant lead and colleagues who cover absences

Causes

Unclear priorities, too many executives per assistant and a culture of always being available.

Consequences

Errors, sickness absence, staff turnover and loss of institutional knowledge.

Existing controls

  • Leave is booked through a shared system.
  • Assistants can ask the lead to rebalance work.

Control gaps

Workload is not measured, so rising pressure is noticed only after a complaint or absence.

Additional controls

  • Prevent: Set a written workload limit per assistant and agree which tasks can be deferred or delegated.
  • Respond: Hold a short wellbeing check in each one to one meeting and act on any concerns within a week.
Likelihood 4 x impact 3 before; 3 x 2 after Owner: Assistant lead Target: Within 60 days Early warning: An assistant working more than the agreed hours in two consecutive weeks.
H04

Compromised executive accounts and devices

Technology and data Before 15 After 8

Phishing, reused passwords or shared logins allow an outsider to read email, change calendar entries or approve payments under an executive name.

Who or what is affected: Executives, assistants, suppliers and clients

Causes

Fake invoices and urgent requests, password reuse and delegated access granted too broadly.

Consequences

Fraudulent payments, data theft, reputational damage and regulatory questions.

Existing controls

  • Executive accounts require a password and are monitored for sign in alerts.
  • Staff complete phishing awareness training each year.

Control gaps

Delegate access is granted by request without a regular review of who still holds it.

Additional controls

  • Prevent: Require multi-factor sign in and remove shared passwords from all executive accounts.
  • Respond: Provide a single reporting route for suspicious messages and lock an account within one hour of a report.
Likelihood 3 x impact 5 before; 2 x 4 after Owner: IT manager Target: Within 30 days Early warning: Unexpected sign in alerts or new mail forwarding rules on an executive account.
H05

Errors in expenses, travel and payments

Financial Before 9 After 4

Travel bookings, expense claims or supplier payments are made for the wrong amount, to the wrong party or outside policy, so money is lost or spent without approval.

Who or what is affected: Executives, finance team and the organization

Causes

Rushed bookings, unclear delegated limits and receipts that are missing or late.

Consequences

Financial loss, audit queries, policy breaches and strained supplier relations.

Existing controls

  • Expense claims need a manager approval.
  • Travel bookings follow a preferred supplier list.

Control gaps

Limits are set in conversation, not recorded, and monthly comparison is not done.

Additional controls

  • Prevent: Set spending limits for each delegate and require a second approver above a fixed value.
  • Detect: Compare booked travel with approved itineraries and review claims monthly for duplicates.
Likelihood 3 x impact 3 before; 2 x 2 after Owner: Finance business partner Target: Within 45 days Early warning: A claim or booking above the delegated limit without a second approval.
H06

Gifts, hospitality and conflicts of interest

Legal and compliance Before 8 After 4

Assistants or executives accept gifts, hospitality or favors from suppliers or candidates, or hold personal links to a supplier, which can distort decisions and breach anti-bribery rules.

Who or what is affected: Executives, assistants, suppliers and the organization

Causes

Gifts offered during busy periods, close relationships with suppliers and unclear thresholds.

Consequences

Disciplinary action, legal exposure, loss of trust and a weakened procurement process.

Existing controls

  • A gifts and hospitality register is kept by the assistant lead.
  • Staff sign a conflicts declaration on joining.

Control gaps

Declarations are not compared against supplier lists or recent bookings.

Additional controls

  • Prevent: Require pre approval for any gift or hospitality above the agreed low value.
  • Respond: Refer any unclear case to the compliance officer and record the outcome in the register.
Likelihood 2 x impact 4 before; 1 x 4 after Owner: Compliance officer Target: Within 60 days Early warning: A gift or hospitality entry recorded after the event without prior approval.
H07

Miscommunication and poor handovers

Reputational Before 9 After 4

Instructions are misunderstood, messages are sent in the wrong tone or key facts are not passed on when an assistant is absent, so decisions are delayed or made on partial information.

Who or what is affected: Executives, colleagues, external guests and the assistant team

Causes

Verbal instructions, unclear ownership of tasks and no shared record of open actions.

Consequences

Missed deadlines, embarrassment, damaged relationships and repeated work.

Existing controls

  • Meeting notes are stored in a shared folder.
  • Executives are asked to confirm key instructions in writing.

Control gaps

Handover notes are optional, and tone guidance is informal.

Additional controls

  • Prevent: Use a standard handover template for each executive with open actions and key contacts.
  • Detect: Ask the executive to confirm a sample of drafted messages before sending during high risk periods.
Likelihood 3 x impact 3 before; 2 x 2 after Owner: Senior executive assistant Target: Within 45 days Early warning: Two or more actions reopened in a month because the original instruction was unclear.
H08

Loss of continuity and key person dependence

Operational Before 12 After 6

Knowledge of contacts, routines and preferences sits with one assistant, and a system outage or absence stops the diary, travel and document flow for an executive.

Who or what is affected: Executives, the assistant team and external partners

Causes

Personal knowledge kept in notebooks, single points of contact and reliance on one platform.

Consequences

Missed meetings, delayed travel, lost information and strain on the remaining team.

Existing controls

  • Documents are stored in a shared cloud folder.
  • A backup assistant is named for each executive.

Control gaps

The backup assistant has not been trained on each executive's preferences, and manual procedures are not written down.

Additional controls

  • Prevent: Keep a current contacts and preferences record that more than one assistant can update.
  • Recover: Test a manual diary and travel process twice a year so the team can work during an outage.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Assistant lead Target: Within 60 days Early warning: A single assistant is the only person able to complete a routine task for an executive.

Rating method and evaluation

Each risk is rated on two five-point scales. Likelihood runs from Rare to Almost certain, and impact runs from Insignificant to Catastrophic. Multiplying the two gives a score from 1 to 25, which falls into one of four bands: Low from 1 to 4, Medium from 5 to 9, High from 10 to 16 and Critical from 17 to 25. The score is a guide for ordering work, not a precise measurement. Inherent risk is the score before any controls. Residual risk is the score after the existing and added controls. Impact is judged on harm to people, breach of confidence, money lost, time lost to executives and damage to trust. A confidentiality or personal risk is never rated down only because it has not happened yet. Anything still High needs senior attention and a dated plan, anything Medium needs routine controls with a named owner, and anything Low is accepted and watched. Assistants and executives should challenge the ratings, and the register is reviewed whenever an indicator reaches its threshold.

Likelihood, impact and rating bands

Likelihood

  • 5 Almost certain: Expected to happen in most circumstances.
  • 4 Likely: Will probably happen in many circumstances.
  • 3 Possible: Could happen at some time.
  • 2 Unlikely: Not expected, but it could happen.
  • 1 Rare: Only in exceptional circumstances.

Impact

  • 1 Insignificant: No lasting effect. Handled within routine work.
  • 2 Minor: Small effect that is quickly corrected.
  • 3 Moderate: Noticeable effect that needs managed effort to correct.
  • 4 Major: Serious effect on people, delivery or reputation.
  • 5 Catastrophic: Severe or lasting effect that threatens the whole activity.

Bands (likelihood x impact)

  • Low (1 to 4): Accept and monitor.
  • Medium (5 to 9): Manage with routine controls.
  • High (10 to 16): Senior attention and a treatment plan.
  • Critical (17 to 25): Act first. Do not proceed until reduced.

Monitoring, escalation and review

Review this assessment every 6 months, and sooner when an indicator below reaches its threshold.

Early-warning indicators and escalation thresholds
Indicator to watchEscalate when
Confidential files opened or forwarded outside the agreed distribution list.Escalate to the assistant lead at once, and to the compliance officer if the file contains personnel or board material.
Overlapping diary entries for one executive within a single working day.Escalate to the senior executive assistant when found, and to the assistant lead if not resolved before the next morning.
Assistants working above agreed hours in two consecutive weeks.Escalate to the assistant lead within a week, and to the head of the executive office if the pattern continues for a month.
Unexpected sign in alerts or new mail forwarding rules on executive accounts.Escalate to the IT manager immediately and lock the account until the cause is confirmed.
Gifts or hospitality recorded after the event without prior approval.Escalate to the compliance officer within two working days, and to the executive concerned if the value is above the agreed limit.

Contingency arrangements

If a serious event occurs, such as a confirmed disclosure of board papers, an account compromise or a missed critical meeting, the assistant lead stops related sharing, preserves the record and informs the executive concerned. The IT manager locks affected accounts and restores files from the latest tested backup. Legal, compliance and data protection contacts are made through the head of the executive office as the relevant law requires. Missed meetings are rebooked with an apology prepared by the executive, and the affected people are told what they need to know early and plainly.

Prioritized action plan

  1. Apply sensitivity labels and restrict board paper sharing, owner assistant lead, within 30 days.
  2. Require multi-factor sign in and remove shared passwords on executive accounts, owner IT manager, within 30 days.
  3. Introduce one booking route with a daily conflict check, owner senior executive assistant, within 30 days.
  4. Set written workload limits and a monthly wellbeing check, owner assistant lead, within 60 days.
  5. Agree a gifts pre approval rule and a delegated spending limit for each executive, owner compliance officer, within 60 days.

Conclusion

Reliable executive support depends on a few steady habits: controlled access to confidential papers, one booking route, written handovers, agreed workload limits and multi-factor sign in. The highest scores sit with disclosure, account compromise and diary conflicts, and each has actions that bring the residual score down. Treat the register as a living record, review it on the stated cycle, and seek qualified advice for any real legal, employment or data protection question.

Assumptions and limitations

Assumptions

  • The organization operates under one national legal framework and has a written data protection and gifts policy.
  • Assistants use managed laptops, phones and shared cloud tools provided by the employer.
  • Executives delegate authority in writing, and no assistant signs contracts unless a delegation is recorded.

Limitations

  • The scores are examples for learning and do not describe any real organization or person.
  • Privacy, employment and anti-bribery rules differ by country and change over time, so specialist review is needed.
  • This is educational content and is not legal, HR or professional advice.

Related frameworks to study

  • Hierarchy of controls
  • Three lines model of risk ownership
  • Principles of records management and information security

Professional Risk Assessment

China, India, United States, Indonesia, Pakistan, Nigeria, Brazil, Bangladesh, Russia, Japan, Mexico, Philippines, Vietnam, Egypt, Turkey, Germany, United Kingdom, France, Italy, Canada, South Korea, Australia, Spain.

For Learning Reference Only: This assessment demonstrates how risk assessment principles are applied in a practical setting, providing a useful reference for learning and understanding. Actual assessments may be adapted to suit specific site conditions and circumstances.

Keep learning

Study the subject behind this assessment.

Executive Assistant Services course Read the best practices for this course

More Professional risk assessments

Hourly Active: 39,499 Learners