vaayaa Inclusive Education
Finance risk assessment

Financial Planning and Wealth Management Risk Assessment: Advice, Conflicts, Client Money and Data Controls

A worked example of how a small wealth planning practice finds, scores and controls risks that affect client outcomes, from unsuitable advice and conflicts of interest to valuation errors, fraudulent instructions, fee mistakes and data exposure.

Updated November 2026 8 hazards assessed Review every 6 months Highest risk: High to Medium
See the Financial Planning and Wealth Management course

Executive summary

This assessment shows how a small wealth planning practice can find, rate and control the risks that matter most to client outcomes, client assets and trust. Eight risks were chosen because they are plausible in everyday planning, portfolio and administration work. Unsuitable advice, conflicts of interest and data exposure carry the highest inherent scores, while fraudulent instructions and fee errors are less frequent but still costly. Each risk is scored before controls and again after existing and added controls. Most risks fall to Medium or Low once added controls are in place, but market exposure stays at Medium because clients cannot control markets. The first actions are a suitability checklist, a conflicts register, call back checks on instructions and a tested data recovery plan. The practice is a teaching example, so every score illustrates method rather than a real firm.

Focus area
Financial planning and wealth management
Setting
Independent wealth planning practice advising individual and family clients on savings, investments, retirement and estate planning
Method
Five by five likelihood and impact risk register

Scope

This assessment covers a small wealth planning practice, from client onboarding and fact finding through advice, portfolio implementation, fee billing, client reporting and review meetings. It looks at risks to client outcomes, client assets and records, professional duties and trust. It does not give investment, tax or legal advice for any real client. Jurisdiction, product range, firm size and systems are assumptions made for teaching.

Context

The practice has a lead planner, two advisers, an operations manager who handles administration and billing, an IT manager who supports client systems, and a compliance lead who keeps the risk register and advice records. Client assets are held with an independent custodian, and the practice does not hold client cash directly. Client records are kept in a planning and relationship system, with spreadsheets used for cash flow models and some fee calculations. Fees are charged as a percentage of assets under management plus planning fees for specific projects. Each risk is scored before controls to show its natural level, then again after the existing controls and the controls that should be added.

Objectives, assets and stakeholders

The objective is to give suitable advice, protect client assets and records, report results accurately, bill fees correctly, meet professional duties and keep the trust of clients and referrers. The assets in scope are client portfolios held with the custodian, client records and identity data, cash flow models, fee and billing records, and the reputation of the practice. Stakeholders include clients and their families, advisers, the operations and IT teams, the custodian and other suppliers, and the supervising body. Clear roles matter: every risk has one owner role, and the compliance lead keeps the register current and reports to the partners each quarter.

Risk matrix: before and after controls

Each cell shows hazard numbers placed by likelihood and impact. Compare the two grids to see how controls move each hazard.

Before controls

Inherent risk

Risk before controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely Likelihood 4, impact 2, score 8, medium: H05 Likelihood 4, impact 3, score 12, high: H03
3 Possible Likelihood 3, impact 4, score 12, high: H02 H07 Likelihood 3, impact 5, score 15, high: H01 H06
2 Unlikely Likelihood 2, impact 4, score 8, medium: H08 Likelihood 2, impact 5, score 10, high: H04
1 Rare

After controls

Residual risk

Risk after controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely
3 Possible Likelihood 3, impact 3, score 9, medium: H07
2 Unlikely Likelihood 2, impact 2, score 4, low: H05 Likelihood 2, impact 3, score 6, medium: H02 H03 H08 Likelihood 2, impact 4, score 8, medium: H01 H06
1 Rare Likelihood 1, impact 5, score 5, medium: H04
  • Low 1 to 4
  • Medium 5 to 9
  • High 10 to 16
  • Critical 17 to 25

Hazard register

A summary first, then the detail for each hazard.

Summary of hazards with scores before and after controls
No.HazardBeforeAfterOwner
H01 Unsuitable advice and failure to meet client needs 15 High 8 Medium Compliance lead
H02 Conflicts of interest in product selection and fees 12 High 6 Medium Compliance lead
H03 Misstated valuations and performance reporting 12 High 6 Medium Operations manager
H04 Misappropriation through fraudulent client instructions 10 High 5 Medium Head of operations
H05 Fee calculation and billing errors 8 Medium 4 Low Operations manager
H06 Cyber exposure and client data breach 15 High 8 Medium IT manager
H07 Market and liquidity shock on client portfolios 12 High 9 Medium Lead planner
H08 Custodian or platform supplier failure 8 Medium 6 Medium Head of operations
H01

Unsuitable advice and failure to meet client needs

Legal and compliance Before 15 After 8

Recommendations are made without a full fact find, or do not match the client's goals, capacity for loss, tax position or time horizon, so the client holds products that do not fit their needs.

Who or what is affected: Clients, families and the advice team

Causes

Pressure to close sales, reliance on standard model portfolios and incomplete fact finds.

Consequences

Client losses, complaints, redress payments and loss of professional standing.

Existing controls

  • Advisers complete a written fact find before any recommendation.
  • A second adviser reviews recommendations above a set value.

Control gaps

Reviews focus on new clients, so older recommendations are rarely revisited when circumstances change.

Additional controls

  • Prevent: Use a suitability checklist that records goals, risk profile, capacity for loss and tax position.
  • Detect: Sample past recommendations each quarter against the client file and record any gaps.
Likelihood 3 x impact 5 before; 2 x 4 after Owner: Compliance lead Target: Within 60 days Early warning: A client review that shows a change in goals or capacity for loss with no new recommendation recorded.
H02

Conflicts of interest in product selection and fees

Reputational Before 12 After 6

Advisers are paid more or receive benefits when they recommend certain products, platforms or funds, and these incentives are not declared or managed, so advice may favour the practice over the client.

Who or what is affected: Clients and the practice owners

Causes

Product panels with incentives, targets tied to sales and informal gifts.

Consequences

Biased advice, client complaints, regulatory attention and reputational damage.

Existing controls

  • Advisers declare outside interests when they join.
  • Commission received is shown on client statements.

Control gaps

Declarations are collected once and not compared with product lists or sales data.

Additional controls

  • Prevent: Maintain a conflicts register and remove or disclose incentives before advice is given.
  • Respond: Pause related recommendations and review affected clients when a conflict is found.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Compliance lead Target: Within 45 days Early warning: A cluster of recommendations to one provider or platform in a single month.
H03

Misstated valuations and performance reporting

Financial Before 12 After 6

Client statements, valuations or performance figures are wrong because prices, transactions or income are recorded late or incorrectly, so clients make decisions on figures that do not reflect their holdings.

Who or what is affected: Clients, advisers and reviewers of client reports

Causes

Manual data entry, late corporate actions and different price feeds.

Consequences

Wrong advice, client complaints, correction costs and loss of trust.

Existing controls

  • Portfolio values are checked against the custodian report each month.
  • Performance reports are reviewed by a senior adviser before release.

Control gaps

Corporate actions are posted by hand and not checked against a second source.

Additional controls

  • Prevent: Reconcile holdings and cash to the custodian statement before any client report is issued.
  • Detect: Compare valuation movements with market prices and investigate differences above an agreed tolerance.
Likelihood 4 x impact 3 before; 2 x 3 after Owner: Operations manager Target: Within 30 days Early warning: Unreconciled holdings differences older than 10 working days.
H04

Misappropriation through fraudulent client instructions

Financial Before 10 After 5

A fake instruction, a changed bank detail or an adviser acting outside authority moves client money or assets to an unauthorised account, often before anyone notices.

Who or what is affected: Clients, the practice and the custodian

Causes

Phishing of clients, weak verification and adviser authority that is not limited.

Consequences

Direct client loss, compensation claims, legal action and loss of trust.

Existing controls

  • Withdrawals above a set value need a call back to the client.
  • Advisers cannot release payments to new bank accounts without approval.

Control gaps

Call backs are sometimes made to numbers supplied on the same request, so a fraudster can answer.

Additional controls

  • Prevent: Require written and verified bank detail changes with a call to a known client contact before the first payment.
  • Recover: Keep a documented process to recall funds and notify the custodian and client at once.
Likelihood 2 x impact 5 before; 1 x 5 after Owner: Head of operations Target: Within 30 days Early warning: A withdrawal request that changes the bank account within the same message.
H05

Fee calculation and billing errors

Operational Before 8 After 4

Ongoing percentage fees and planning fees are calculated on the wrong asset value, period or agreed rate, so clients are overcharged or undercharged and records do not match the engagement letter.

Who or what is affected: Clients, the finance team and the practice

Causes

Manual rate changes, mid-quarter client changes and copied spreadsheet formulas.

Consequences

Refunds, complaints, reputational harm and the need to restate client records.

Existing controls

  • Fees are calculated in a spreadsheet and checked each quarter.
  • Clients receive a fee statement with each invoice.

Control gaps

Recalculation covers a sample of new clients, so long-standing errors can be missed.

Additional controls

  • Prevent: Hold each fee rate in the client system with the engagement letter reference and effective date.
  • Detect: Recalculate a sample of fees each quarter and compare them with the invoiced amount.
Likelihood 4 x impact 2 before; 2 x 2 after Owner: Operations manager Target: Within 45 days Early warning: A fee rate that differs from the engagement letter for the same client.
H06

Cyber exposure and client data breach

Technology and data Before 15 After 8

Phishing, weak passwords or unprotected spreadsheets expose client identity, bank and tax records, and an attacker or careless staff member copies or alters the data.

Who or what is affected: Clients, advisers and the administration team

Causes

Phishing, reused passwords and spreadsheets copied between people.

Consequences

Stolen data, identity fraud, client claims and a regulator notice.

Existing controls

  • Client systems require a password and are backed up each day.
  • Staff are told not to send client files by unsecured email.

Control gaps

Spreadsheets holding cash flow models sit outside the access controls.

Additional controls

  • Prevent: Enable multi-factor sign in for all client systems and encrypt laptops and removable storage.
  • Respond: Keep a written incident plan with named contacts for the regulator and affected clients.
Likelihood 3 x impact 5 before; 2 x 4 after Owner: IT manager Target: Within 30 days Early warning: Repeated sign in attempts from an unusual location or a staff report of a payment request scam.
H07

Market and liquidity shock on client portfolios

Financial Before 12 After 9

Sharp falls in asset prices or a freeze on fund dealing leave clients with losses or unable to reach cash when needed, and plans built on expected returns no longer hold.

Who or what is affected: Clients, dependants and advisers

Causes

Concentration in one sector, leveraged funds and short time horizons.

Consequences

Client losses, forced sales, missed goals and complaints.

Existing controls

  • Portfolios are built to a documented risk profile and spread across asset classes.
  • Cash needed for the next two years is held in low risk holdings.

Control gaps

Stress tests use past data only and are not refreshed when holdings change.

Additional controls

  • Prevent: Stress test each plan with a low return case and a delayed withdrawal case.
  • Respond: Keep a client contact plan and review portfolios within five working days of a major market move.
Likelihood 3 x impact 4 before; 3 x 3 after Owner: Lead planner Target: Within 60 days Early warning: Client portfolio fall beyond the drawdown limit set in the risk profile.
H08

Custodian or platform supplier failure

Supplier Before 8 After 6

A custodian, platform or fund manager fails, changes terms or suffers an outage, so client assets cannot be accessed, valued or traded for a period, and the practice must explain the position to clients.

Who or what is affected: Clients, the practice and its suppliers

Causes

Supplier financial strain, system upgrades and outsourced services with limited visibility.

Consequences

Delayed access to funds, service failure, client complaints and extra costs.

Existing controls

  • Client assets are held in each client's name with an independent custodian.
  • The practice reviews the custodian's service reports each year.

Control gaps

The exit plan has not been tested and service reports are reviewed only once a year.

Additional controls

  • Prevent: Keep a supplier register with due diligence and a second provider for critical platforms.
  • Recover: Keep an exit plan that moves client records and holdings to another provider within a set period.
Likelihood 2 x impact 4 before; 2 x 3 after Owner: Head of operations Target: Within 90 days Early warning: A supplier outage or change in terms reported in two consecutive monthly reports.

Rating method and evaluation

Each risk is rated on two five-point scales. Likelihood runs from Rare to Almost certain, and impact runs from Insignificant to Severe. Multiplying the two gives a score from 1 to 25, which falls into one of four bands: Low from 1 to 4, Medium from 5 to 9, High from 10 to 16 and Critical from 17 to 25. The score is a guide for ordering work, not a measurement. Inherent risk is the score before any controls. Residual risk is the score after the existing and added controls. Impact is judged on client loss, time to correct, effect on client goals, regulatory attention and harm to trust, and a risk is never rated down only because it has not yet happened. Anything still High needs senior attention and a dated plan, anything Medium needs routine controls with a named owner, and anything Low is accepted and watched. Advisers and operations staff should challenge the ratings, and each risk is reviewed whenever an indicator reaches its threshold.

Likelihood, impact and rating bands

Likelihood

  • 5 Almost certain: Expected to happen in most circumstances.
  • 4 Likely: Will probably happen in many circumstances.
  • 3 Possible: Could happen at some time.
  • 2 Unlikely: Not expected, but it could happen.
  • 1 Rare: Only in exceptional circumstances.

Impact

  • 1 Insignificant: No lasting effect. Handled within routine work.
  • 2 Minor: Small effect that is quickly corrected.
  • 3 Moderate: Noticeable effect that needs managed effort to correct.
  • 4 Major: Serious effect on people, delivery or reputation.
  • 5 Catastrophic: Severe or lasting effect that threatens the whole activity.

Bands (likelihood x impact)

  • Low (1 to 4): Accept and monitor.
  • Medium (5 to 9): Manage with routine controls.
  • High (10 to 16): Senior attention and a treatment plan.
  • Critical (17 to 25): Act first. Do not proceed until reduced.

Monitoring, escalation and review

Review this assessment every 6 months, and sooner when an indicator below reaches its threshold.

Early-warning indicators and escalation thresholds
Indicator to watchEscalate when
Recommendations made without a completed fact find or suitability record.Escalate to the compliance lead at once, and hold further advice on the file until the record is complete.
Recommendations to one provider or platform above the agreed share in a month.Escalate to the compliance lead when the share is exceeded, and to the partners if it persists for a quarter.
Holdings differences with custodian statements older than 10 working days.Escalate to the operations manager after 10 days, and to the head of operations after 20 days.
Withdrawal or bank detail change not confirmed by a call back to a known contact.Escalate to the head of operations at once, and hold the payment until it is verified.
Supplier outage or change in terms reported in two consecutive monthly reports.Escalate to the head of operations when first seen, and to the partners if client access is delayed.

Contingency arrangements

If a serious event occurs, such as a fraudulent withdrawal, a data breach or a custodian outage, the lead planner informs affected clients promptly and plainly. The head of operations stops related payments, preserves records and contacts the custodian. The IT manager isolates affected systems and restores data from the latest tested backup. Legal and regulatory contacts are made through the compliance lead as required in the relevant jurisdiction. Client contact continues by phone and letter until services return.

Prioritized action plan

  1. Introduce a suitability checklist and file review cycle, owner compliance lead, within 45 days.
  2. Maintain a conflicts register and check it against product lists, owner compliance lead, within 45 days.
  3. Verify bank detail changes by call back to a known contact, owner head of operations, within 30 days.
  4. Enable multi-factor sign in and test a restore of client records, owner IT manager, within 30 days.
  5. Reconcile holdings to custodian statements before each client report, owner operations manager, within 30 days.

Conclusion

Sound wealth planning depends on steady habits: complete fact finds, declared conflicts, reconciled holdings, verified instructions, correct fee records, secure data and tested exit plans. The highest inherent scores sit with unsuitable advice, conflicts and data exposure, and each has actions that bring the residual score down. Treat the register as a living record, review it on the stated cycle, and seek qualified advice for any real investment, tax, estate or legal question.

Assumptions and limitations

Assumptions

  • The practice gives regulated advice to retail clients, and the supervising body is not named here.
  • Client assets are held by an independent custodian in each client's own name.
  • Clients include individuals and families with savings, pensions and investment portfolios of varying size.

Limitations

  • The scores are examples for learning and do not describe any real firm or client.
  • Advice, investment, tax and estate rules differ by place and change over time, so specialist review is needed.
  • This is educational content and is not financial, investment, tax or legal advice.

Related frameworks to study

  • Suitability and best interest assessment of client needs
  • Three lines model of risk ownership
  • Hierarchy of controls
  • Client asset safeguarding principles

Finance Risk Assessment

China, India, United States, Indonesia, Pakistan, Nigeria, Brazil, Bangladesh, Russia, Japan, Mexico, Philippines, Vietnam, Egypt, Turkey, Germany, United Kingdom, France, Italy, Canada, South Korea, Australia, Spain.

For Learning Reference Only: This assessment demonstrates how risk assessment principles are applied in a practical setting, providing a useful reference for learning and understanding. Actual assessments may be adapted to suit specific site conditions and circumstances.

Keep learning

Study the subject behind this assessment.

Financial Planning and Wealth Management course Read the best practices for this course

More Finance risk assessments

Hourly Active: 39,499 Learners