Safety Norms: Asset Management Strategies

1Purpose, Scope, and Safety Principles

Asset management strategies determine how money and other holdings are allocated, invested, monitored, and rebalanced for clients, funds, or an organization. In this subject, safety means protecting assets from loss, error, misconduct, and exposure beyond approved limits. It also means protecting the people, data, and systems that handle those assets. This document applies to portfolio managers, analysts, traders, operations staff, risk and compliance teams, and anyone with access to client data or trading platforms.

This is educational guidance. It is not investment, legal, or tax advice, and it does not replace professional licensing, formal training, approved firm policies, supervision by qualified personnel, or advice from a registered professional. Laws, regulator rules, and fiduciary standards vary by jurisdiction and must be verified with competent authorities or qualified counsel.

Five principles guide every norm in this document. Protect client interests before firm revenue. Act only within written authority. Document decisions before execution, not after. Verify data before relying on it. Escalate uncertainty rather than improvising a fix. When two norms conflict, the more protective norm applies until compliance clarifies the position.

• Mandatory: no strategy may take exposure beyond the approved mandate, risk budget, or client restrictions.
• Mandatory: every strategy must trace to a written investment policy statement approved by the governing body.
• Recommended: state each strategy's assumptions in plain language so reviewers can test them.

2Roles, Competence, and Accountability

Accountability must be named in writing. The board or investment committee approves the investment policy and risk tolerance. The chief investment officer or equivalent owns strategy design. Portfolio managers execute within mandate. Risk management measures exposure and tests limits independently. Compliance interprets rules and monitors conduct. Operations confirms settlement, custody reconciliation, and corporate actions. Information security protects systems and data.

Competence comes before authority. A person may make discretionary decisions only after documented training, supervised experience, and any required registration have been verified. Where a role requires a license under local law, confirm it with the relevant regulator before the person acts.

• Segregation of duties: the person who initiates a trade may not approve or reconcile it.
• Each strategy has one accountable owner who signs off on changes in writing.
• Authority limits are set by dollar exposure, instrument type, and counterparty, and are reviewed when products change.
• Staff must disclose personal holdings and conflicts before assignment, and update disclosures when circumstances change.

3Realistic Hazards and Risk Assessment

Asset management hazards are mostly financial, operational, informational, and conduct related. Common examples include market risk from sudden price moves, liquidity risk when a position cannot be sold without a large price concession, and concentration risk when a single issuer, sector, or currency dominates the portfolio. Counterparty risk arises when a broker or derivatives partner fails to perform. Leverage and derivatives can magnify losses beyond the amount invested.

Operational hazards include order entry errors such as wrong size or wrong ticker, failed settlements, stale prices used in valuation, and rebalancing scripts that run against outdated data. Information hazards include exposure of client identities, account balances, and trading intentions. Conduct hazards include front running, unfair allocation of trades, and undisclosed conflicts. Each hazard is rated for likelihood and impact on a documented scale using criteria set by risk management.

Risk assessment follows a simple cycle. Identify the hazard and the decision it affects, estimate likelihood and impact, assign a control owner, record the existing control, and decide whether residual risk is acceptable. Where residual risk is high or critical, the strategy change is paused until risk management approves a documented mitigation. Assessments are repeated when markets shift sharply, new instruments are added, or a material incident occurs.

• Low: small, reversible error with no client loss and no regulatory impact.
• Medium: correctable loss or breach within mandate, reported internally within the policy timeline.
• High: loss or limit breach outside mandate, or exposure of client data, requiring immediate escalation to risk and compliance.
• Critical: suspected fraud, system compromise, or a loss threatening client protection, requiring activation of the emergency response plan.

4Preventive Controls and Safe Work Practices

Controls should act before a decision is executed. Pre-trade checks confirm that an order fits the mandate, position limits, cash availability, restricted lists, and liquidity thresholds. For example, a rebalance order whose size exceeds a set share of average daily volume requires a documented liquidity review before release. Large or unusual orders require a second approver who did not prepare them.

Valuation and model controls prevent decisions based on wrong numbers. Prices come from approved sources, stale or missing prices trigger an exception report, and valuation models are validated by someone independent of their developer before use and after material change. Stress tests should consider liquidity shortfalls, correlated losses, and rate shocks, and their assumptions must be recorded.

Derivatives and leverage are used only where the mandate allows, with approved counterparties, documented collateral terms, and margin monitoring at the frequency set by policy. Personal trading by staff follows pre-clearance and blackout rules that prevent trading ahead of client orders. Gifts and hospitality above the threshold in firm policy are declined or reported.

• Four-eyes rule: any order above the trading policy threshold needs independent approval before submission.
• Reconcile holdings between the portfolio system, custodian statement, and general ledger at the frequency set by operations, and investigate every break within the policy deadline.
• Rebalancing runs only from a signed trade list, and scripts are tested in a non-production environment before use.
• Do not rely on a single data source for prices or holdings when a decision would move material value; cross-check with a second approved source.
• Do not override a limit breach to complete a trade. Record the breach, notify risk, and wait for written approval.
• Keep trade rationale notes that reference the mandate so reviewers can test whether a decision was appropriate when made.
• Never use client information for personal benefit or for trading ahead of client orders.

5Equipment, Environment, Information, and Safeguards

Trading platforms, portfolio management systems, and spreadsheets used for valuation are controlled assets. Access requires unique user IDs, multi-factor authentication, and role-based permissions reviewed at the frequency set by security policy. Production changes follow documented change management with testing and rollback steps. Spreadsheets used for decisions must be version controlled, and critical formulas must be locked or independently checked.

Information safeguards apply to client data, account numbers, tax details, and trading intentions. Data is classified, encrypted in transit and at rest where supported, and shared only through approved channels. Public Wi-Fi is not used for trading or client files without an approved secure connection. Printed statements are shredded or stored in locked containers. Privacy obligations vary by jurisdiction and must be confirmed with privacy counsel.

Physical and remote environments need controls too. Trading areas restrict visitor access and require locked screens when unattended. Remote work requires a company-managed device, a clean desk, and no discussion of positions in shared spaces. Vendors and cloud providers undergo due diligence covering security, business continuity, and data location, and contracts specify breach notification duties. Backup and disaster recovery sites are tested at the frequency set by the continuity plan.

• Protective safeguards include multi-factor authentication, encrypted backups, and secure file transfer for client documents.
• Recommended: run a tabletop exercise for a ransomware or trading-system outage at least as often as the continuity plan requires.

6Incident Reporting, Emergency Response, and Escalation

An incident is any event that causes or could cause loss, client harm, regulatory breach, or data exposure. A near miss is an event caught before harm occurs, such as a mistyped order stopped by a check. Both must be reported. Anyone who discovers an incident stops further action on the affected item, preserves records, and notifies the designated risk or compliance contact immediately. Do not try to reverse trades, delete logs, or contact clients about the error without authorization.

Examples include a trade executed at the wrong size, a client report sent to the wrong recipient, a suspected account takeover, a valuation error reaching a client statement, and a platform outage during market hours. Each requires a documented timeline, owner, containment action, and decision on notification. Notification deadlines to clients and regulators are jurisdiction dependent and must be confirmed by compliance or counsel.

Emergencies involving physical danger, such as fire, flooding, or a threat to staff, are handled by calling local emergency services first and then following building procedures. For suspected fraud or cyber intrusion, isolate the affected account or system as the playbook directs, contact the information security lead, and involve law enforcement and the institution's bank through approved channels. Staff should not attempt personal recovery of funds from suspected scammers.

After any incident is contained, the incident owner prepares a factual timeline, avoids assigning blame during the initial review, and records lessons learned. Staff who report errors in good faith are protected under firm policy. Concealing an error is a conduct breach and must be reported through the independent channel described in the code of conduct.

• Report within the time set by firm policy, and record the report reference number.
• Conduct a root cause review for every high or critical incident, with corrective actions assigned an owner and due date.
• Test the business continuity plan so that alternate trading and communication methods are known to staff.

7Records, Training, Inspection, and Review

Records prove that norms were followed. Keep the investment policy statement, mandate, approvals, trade blotters, reconciliation logs, valuation files, incident reports, and training evidence. Retention periods depend on jurisdiction and firm policy and must be confirmed with compliance before disposal. Records must be accurate and timely, and they must not be altered after the fact. Corrections are made as attributed, dated entries.

Training covers this document, relevant regulations, information security, conduct rules, and incident reporting. Training is completed before trading authority is granted and refreshed at the frequency set by policy or after material change. Competence is checked through supervised work or assessment, not attendance alone.

Monitor leading indicators such as limit breaches, overdue approvals, reconciliation breaks, stale prices, failed logins, and open exception items. Review each strategy's performance and risk against its stated objectives. Independent audit or internal review tests whether controls operate as designed. Findings lead to corrective action plans with owners, deadlines, and verification. Update this norm set when law, products, or systems change.

Implementation checklist

• Confirm each strategy traces to a current, approved investment policy statement.
• Verify each trader's authority and registration before granting trading access.
• Run pre-trade checks and obtain independent approval for orders above threshold.
• Reconcile positions to custodian records and investigate every break on time.
• Stop, preserve, and report any incident or near miss immediately.
• Restrict system access to named users with multi-factor authentication.
• Protect client data by shredding paper and avoiding public networks for sensitive work.
• Document all decisions, exceptions, and approvals in the approved record system.
• Confirm jurisdiction-specific laws, notification deadlines, and retention periods with compliance or counsel.
• Schedule review of this norm set and the risk register after any material change.