vaayaa Inclusive Education
Finance risk assessment

Wealth Management Services Risk Assessment: Mandate, Access, Conflicts and Data Controls

A worked example of how a wealth management team finds, scores and controls the risks that threaten client portfolios, from mandate breaches and fraud to conflicts, valuation errors, tax reporting and cyber exposure.

Updated November 2026 8 hazards assessed Review every 6 months Highest risk: Critical to Medium
See the Wealth Management Services course

Executive summary

This assessment shows how a wealth management team can find, rate and control the risks that matter most to client assets, suitable advice and trust. Eight risks were chosen because they are plausible in everyday advisory, portfolio and operations work. Market concentration and mandate breaches carry the highest natural scores, while fraud, cyber exposure and access weaknesses are less likely but can cause serious harm. Each risk is scored before controls and again after existing and added controls. Most risks fall to Medium or Low once controls are in place, but market exposure stays at Medium because the potential losses are large. The first actions are automated mandate limits, call backs for new payees, separated approval rights and multi-factor sign in. The team is a teaching example, so every score illustrates method, not a real firm.

Focus area
Wealth management, investment advice and client asset administration
Setting
Advisory and portfolio management team serving private clients, with custody held by a separate third party
Method
Five by five likelihood and impact risk register

Scope

This assessment covers an advisory and portfolio management team serving private clients, from onboarding and suitability through investment decisions, trading, valuation, client reporting and tax summaries. It looks at risks to client assets, suitability, accurate reporting, legal duties and trust. It does not give investment, tax or legal advice for any real client. Jurisdiction, client base, custody arrangements and systems are assumptions made for teaching and are stated in the assumptions section.

Context

The team has a chief investment officer, portfolio managers, advisers, an operations team, a valuation and reporting analyst, a compliance officer and an IT security manager. Client mandates are recorded in a portfolio system, trades are placed through brokers, and assets are held by an independent custodian. Spreadsheets are used for some forecasts and tax summaries. Each risk is scored before controls to show its natural level, then again after the existing controls and the additional controls that should be added.

Objectives, assets and stakeholders

The objective is to act in each client's best interest, protect client assets and records, deliver accurate reports, meet legal and tax duties, and keep the confidence of clients, regulators and staff. The assets in scope are client portfolios and cash, the portfolio and reporting systems, client personal and tax data, valuation records and the firm's reputation. Stakeholders include clients, advisers, portfolio managers, operations and valuation staff, the custodian, brokers, product providers, regulators and the board. Each risk has one owner role, and the chief investment officer reports the register to the board each quarter.

Risk matrix: before and after controls

Each cell shows hazard numbers placed by likelihood and impact. Compare the two grids to see how controls move each hazard.

Before controls

Inherent risk

Risk before controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain Likelihood 5, impact 4, score 20, critical: H05
4 Likely Likelihood 4, impact 4, score 16, high: H01 H08
3 Possible Likelihood 3, impact 3, score 9, medium: H06 Likelihood 3, impact 4, score 12, high: H04 H07 Likelihood 3, impact 5, score 15, high: H02 H03
2 Unlikely
1 Rare

After controls

Residual risk

Risk after controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely
3 Possible Likelihood 3, impact 3, score 9, medium: H05
2 Unlikely Likelihood 2, impact 2, score 4, low: H06 Likelihood 2, impact 3, score 6, medium: H01 H02 H04 H07 Likelihood 2, impact 4, score 8, medium: H03 H08
1 Rare
  • Low 1 to 4
  • Medium 5 to 9
  • High 10 to 16
  • Critical 17 to 25

Hazard register

A summary first, then the detail for each hazard.

Summary of hazards with scores before and after controls
No.HazardBeforeAfterOwner
H01 Mandate breach and unsuitable portfolio allocation 16 High 6 Medium Chief investment officer
H02 Weak access control and segregation of duties 15 High 6 Medium Head of operations
H03 Misappropriation of client assets and fraudulent instructions 15 High 8 Medium Compliance officer
H04 Conflicts of interest and product steering 12 High 6 Medium Conduct risk lead
H05 Market, concentration and liquidity exposure in client portfolios 20 Critical 9 Medium Chief investment officer
H06 Valuation and performance reporting errors 9 Medium 4 Low Valuation and reporting manager
H07 Tax and regulatory reporting failures for clients 12 High 6 Medium Tax and reporting manager
H08 Cyber exposure and client data leakage 16 High 8 Medium IT security manager
H01

Mandate breach and unsuitable portfolio allocation

Legal and compliance Before 16 After 6

Client portfolios drift outside the agreed mandate or risk profile, or an investment is recommended that does not suit the client's needs, objectives or capacity for loss.

Who or what is affected: Clients, advisers and the firm

Causes

Market movements left unchecked, weak suitability records and pressure to sell particular products.

Consequences

Client losses, complaints, redress payments and damage to the firm's standing with regulators.

Existing controls

  • A risk profile questionnaire is completed at onboarding.
  • Portfolio managers review holdings against the mandate each quarter.

Control gaps

Drift is checked quarterly, so breaches can run for months unnoticed.

Additional controls

  • Prevent: Set automated limits in the portfolio system that block trades outside the agreed mandate.
  • Detect: Run a monthly drift report and send exceptions to the investment committee.
Likelihood 4 x impact 4 before; 2 x 3 after Owner: Chief investment officer Target: Within 45 days Early warning: A portfolio holding outside its mandate band for more than 10 business days.
H02

Weak access control and segregation of duties

Operational Before 15 After 6

One person can enter a client instruction and also approve it, or holds wider system rights than the role needs, so errors and misuse go unseen.

Who or what is affected: Clients, operations staff and the firm

Causes

Small team size, shared credentials and access rights that are added but never removed.

Consequences

Unauthorized trades, undetected error, failed audit findings and client loss.

Existing controls

  • Users sign in with individual accounts.
  • Trade and payment instructions above a set value need a second approver.

Control gaps

Access rights are reviewed only when someone leaves the firm or raises a complaint.

Additional controls

  • Prevent: Map roles so that no one can both enter and approve a client instruction or payment.
  • Detect: Review user rights and approval logs each quarter and record any exceptions.
Likelihood 3 x impact 5 before; 2 x 3 after Owner: Head of operations Target: Within 60 days Early warning: A user who holds both entry and approval rights for client instructions.
H03

Misappropriation of client assets and fraudulent instructions

Financial Before 15 After 8

Fake instructions, impersonated clients or altered payee details move client money out of accounts, often in small amounts that are hard to spot in routine reports.

Who or what is affected: Clients, the custodian and advisers

Causes

Impersonation of clients, pressure on staff and too much trust placed in one adviser.

Consequences

Direct client loss, compensation claims, regulatory action and reputational harm.

Existing controls

  • Client money is held in separate accounts that are reconciled monthly.
  • Withdrawals to new bank details are confirmed by phone.

Control gaps

Call backs are not logged, so the checks cannot be evidenced after the event.

Additional controls

  • Prevent: Require a signed client instruction and a call back to a known contact for every new payee.
  • Respond: Freeze outgoing payments and notify the compliance officer at once when fraud is suspected.
Likelihood 3 x impact 5 before; 2 x 4 after Owner: Compliance officer Target: Within 30 days Early warning: Withdrawal requests to a payee that was added within the last 30 days.
H04

Conflicts of interest and product steering

Reputational Before 12 After 6

Advisers recommend products that pay them more or that favor the firm, or accept gifts from providers, so advice is not based on the client's best interest.

Who or what is affected: Clients, advisers and the firm

Causes

Incentives tied to sales, gifts from providers and unclear rules on disclosure.

Consequences

Unfair advice, client redress, censure and loss of trust in the firm.

Existing controls

  • Advisers declare personal interests at onboarding.
  • Fees and commission structures are published to clients.

Control gaps

Declarations are not compared with the products actually recommended.

Additional controls

  • Prevent: Restrict in-house product recommendations unless the conflict is disclosed and approved.
  • Detect: Sample recommendations each quarter to see whether a cheaper suitable option was ignored.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Conduct risk lead Target: Within 60 days Early warning: Recommendations of one provider's products above an agreed share of total sales.
H05

Market, concentration and liquidity exposure in client portfolios

Financial Before 20 After 9

A sharp market fall hits concentrated holdings, or illiquid assets must be sold under pressure, so client values drop and withdrawals cannot be met on time.

Who or what is affected: Clients, portfolio managers and the firm

Causes

Market shocks, concentrated holdings and illiquid assets chosen for higher returns.

Consequences

Large client losses, forced sales at poor prices, missed withdrawals and litigation.

Existing controls

  • Portfolios are reviewed by the investment committee each month.
  • Single holding limits are set in the investment policy.

Control gaps

Stress tests are run on model portfolios only, not on individual client accounts.

Additional controls

  • Prevent: Set concentration and liquidity limits for each client and hold a cash buffer for withdrawals.
  • Respond: Run a stress test on the largest exposures and agree sell down steps for a sharp fall.
Likelihood 5 x impact 4 before; 3 x 3 after Owner: Chief investment officer Target: Within 30 days Early warning: Any holding above its concentration limit or any fund that suspends dealing.
H06

Valuation and performance reporting errors

Financial Before 9 After 4

Stale prices, manual adjustments or errors in complex holdings give wrong values and performance figures, so clients receive misleading reports and fees are charged on the wrong base.

Who or what is affected: Clients, the valuation team and the firm

Causes

Stale prices, manual adjustments and holdings that are hard to value.

Consequences

Misstated values, wrong fees, misleading performance figures and complaints.

Existing controls

  • Prices are taken from an independent pricing source each day.
  • Performance reports are checked by a second analyst before issue.

Control gaps

Hard to price holdings are valued by hand with no independent second check.

Additional controls

  • Detect: Compare valuations with an independent source and investigate any gap above an agreed tolerance.
  • Recover: Correct affected reports and inform clients with a clear and plain explanation.
Likelihood 3 x impact 3 before; 2 x 2 after Owner: Valuation and reporting manager Target: Within 90 days Early warning: Price gaps above tolerance on more than three holdings in a single month.
H07

Tax and regulatory reporting failures for clients

Legal and compliance Before 12 After 6

Client tax summaries or regulatory reports are late, incomplete or wrong because cost basis records are missing or the rules that apply are misread.

Who or what is affected: Clients, the tax team and regulators

Causes

Rules that differ by jurisdiction, gaps in cost basis records and client data that arrives late.

Consequences

Client penalties, restated reports, regulator enquiries and loss of client trust.

Existing controls

  • Annual tax summaries are prepared for each client.
  • A compliance calendar lists the main reporting dates.

Control gaps

The jurisdiction is assumed, and cost basis records are not checked before reports are issued.

Additional controls

  • Prevent: Keep a reporting calendar with a named owner and a backup owner for every client filing.
  • Detect: Have a qualified reviewer test a sample of tax summaries against the rules that apply.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Tax and reporting manager Target: Within 60 days Early warning: Client tax data still missing for a report due within 15 days.
H08

Cyber exposure and client data leakage

Technology and data Before 16 After 8

Phishing, reused passwords and client holdings copied into unprotected spreadsheets expose personal and financial data, or allow criminals to send false instructions.

Who or what is affected: Clients, advisers and the firm

Causes

Phishing, reused passwords and files copied to personal devices.

Consequences

Stolen client data, impersonation, regulator notice and loss of clients.

Existing controls

  • Client records are held in an encrypted system with individual logins.
  • Staff complete security awareness training each year.

Control gaps

Spreadsheets holding client positions sit outside the main access controls.

Additional controls

  • Prevent: Enable multi-factor sign in and block personal email for sending client files.
  • Recover: Test restoring client records from backup and keep a written recovery plan.
Likelihood 4 x impact 4 before; 2 x 4 after Owner: IT security manager Target: Within 30 days Early warning: Repeated phishing reports or sign ins from unfamiliar locations.

Rating method and evaluation

Each risk is rated on two five-point scales. Likelihood runs from Rare to Almost certain, and impact runs from Insignificant to Catastrophic. Multiplying the two gives a score from 1 to 25, which falls into one of four bands: Low from 1 to 4, Medium from 5 to 9, High from 10 to 16 and Critical from 17 to 25. The score is a guide for ordering work, not a measurement. Inherent risk is the score before any controls. Residual risk is the score after the existing and added controls. Impact is judged on client loss, time to correct, effect on reported figures, regulatory consequence and harm to trust. A risk is never rated down only because it has not yet happened. Anything Critical or High needs senior attention and a dated plan, anything Medium needs routine controls with a named owner, and anything Low is accepted and watched. Advisers, operations staff and the valuation team should challenge the ratings, and each rating is reviewed whenever a warning indicator reaches its threshold.

Likelihood, impact and rating bands

Likelihood

  • 5 Almost certain: Expected to happen in most circumstances.
  • 4 Likely: Will probably happen in many circumstances.
  • 3 Possible: Could happen at some time.
  • 2 Unlikely: Not expected, but it could happen.
  • 1 Rare: Only in exceptional circumstances.

Impact

  • 1 Insignificant: No lasting effect. Handled within routine work.
  • 2 Minor: Small effect that is quickly corrected.
  • 3 Moderate: Noticeable effect that needs managed effort to correct.
  • 4 Major: Serious effect on people, delivery or reputation.
  • 5 Catastrophic: Severe or lasting effect that threatens the whole activity.

Bands (likelihood x impact)

  • Low (1 to 4): Accept and monitor.
  • Medium (5 to 9): Manage with routine controls.
  • High (10 to 16): Senior attention and a treatment plan.
  • Critical (17 to 25): Act first. Do not proceed until reduced.

Monitoring, escalation and review

Review this assessment every 6 months, and sooner when an indicator below reaches its threshold.

Early-warning indicators and escalation thresholds
Indicator to watchEscalate when
Portfolio holdings outside their mandate band for more than 10 business days.Escalate to the chief investment officer when any holding breaches its band for 10 business days, and to the investment committee if it stays open for a month.
Client withdrawals to payees added within the last 30 days.Escalate to the compliance officer at once and hold the payment until a call back confirms the instruction.
Users who hold both entry and approval rights for client instructions.Escalate to the head of operations when any such user is found, and remove one right within a week.
Holdings above concentration limits or funds that suspend dealing.Escalate to the chief investment officer on the day of the breach, and to the board if the breach is not cleared within 10 business days.
Client tax data missing for reports due within 15 days.Escalate to the tax and reporting manager when data is missing 15 days before a deadline, and to the compliance officer if it is still missing 5 days before.

Contingency arrangements

If a serious event occurs, such as confirmed client fraud, a large market fall or a data breach, the chief investment officer halts affected trading and withdrawals where the mandate allows, and the compliance officer preserves records and informs the board. The IT security manager isolates affected accounts and restores data from the latest tested backup. Regulators, custodians and affected clients are contacted through the compliance officer as required by the relevant jurisdiction. Clients are told what they need to know early and plainly.

Prioritized action plan

  1. Set automated mandate and concentration limits in the portfolio system, owner chief investment officer, within 30 days.
  2. Separate entry and approval rights for client instructions and review user access, owner head of operations, within 60 days.
  3. Require a call back to a known contact for every new payee, owner compliance officer, within 30 days.
  4. Enable multi-factor sign in and test a restore of client records from backup, owner IT security manager, within 30 days.
  5. Build a reporting calendar with a backup owner for each client filing, owner tax and reporting manager, within 60 days.

Conclusion

Sound wealth management depends on a few steady habits: mandate limits that block breaches, separated approvals, call backs on every change of payee, honest conflict disclosure, tested backups and a calendar for every client filing. The highest scores sit with market concentration, mandate breaches and cyber exposure, and each has actions that bring the residual score down. Treat the register as a living record, review it on the stated cycle, and seek qualified advice for any real investment, tax, legal or conduct question.

Assumptions and limitations

Assumptions

  • The team is regulated in one jurisdiction that is not named here, and advisers hold the appropriate authorizations.
  • Client assets are held by an independent custodian, and the team has trading and instruction rights only.
  • Staff use managed computers, and clients receive annual tax summaries prepared by the team.

Limitations

  • The scores are examples for learning and do not describe any real firm, client or portfolio.
  • Investment, tax and conduct rules differ by country and change over time, so specialist review is needed.
  • This is educational content and does not replace a formal site-specific assessment or licensed advice.

Related frameworks to study

  • Internal control framework with control activities and monitoring
  • Three lines model of risk ownership
  • Hierarchy of controls

Finance Risk Assessment

China, India, United States, Indonesia, Pakistan, Nigeria, Brazil, Bangladesh, Russia, Japan, Mexico, Philippines, Vietnam, Egypt, Turkey, Germany, United Kingdom, France, Italy, Canada, South Korea, Australia, Spain.

For Learning Reference Only: This assessment demonstrates how risk assessment principles are applied in a practical setting, providing a useful reference for learning and understanding. Actual assessments may be adapted to suit specific site conditions and circumstances.

Keep learning

Study the subject behind this assessment.

Wealth Management Services course Read the best practices for this course

More Finance risk assessments

Hourly Active: 35,661 Learners