Risk management for a family office: a map of the main exposures

What does risk management mean for a family office?

Risk is the chance that something reduces the family’s wealth or limits its plans. Risk management makes risk visible, sets limits the family accepts and prepares a response before an event. A family office is well placed to do this because it sees all assets, entities and advisers in one view. The office also holds the documents, so a response can start from facts.

The process has 4 steps: identify the exposures, rank them, assign an owner and a response, then review on a calendar. The steps are the same for a small office and a large one. Only the depth changes, with more tests and more people as the estate grows.

Which exposures belong on a family office risk map?

The map lists 10 exposures. Market and concentration risk cover prices and dominant assets. Liquidity and currency risk cover cash and exchange rates. Counterparty risk covers banks, custodians and managers. Legal and tax risk cover rules and changes in them. Operational and cyber risk cover errors and attacks. Each line names the asset, the entity or the person affected.

Key person and health risk cover the people who hold knowledge or authority. Reputation and family risk cover public image and disagreement among members. A family adds exposures that belong to its situation, such as a business, a relocation or a dependent. The map is a living list, and each line receives an entry. Entries stay short, with a date and a name, so the list remains useful.

How does a family office rank its risks?

Ranking uses 2 questions: how likely is the event, and how large is the damage? Each answer is low, medium or high, which gives a 3-by-3 grid with 9 cells. Risks in the high-high corner receive attention first. Risks in the low-low corner are watched without action. A shared scale keeps the discussion of a dull risk and a dramatic one on equal terms.

The grid is a conversation tool, not a calculation. A family office adds facts to each placement, such as the amount at stake and the time to react. 2 risks in the same cell can differ in urgency, so the office sorts them by speed of impact as a second step. The result is an ordered list that the family council can read in minutes.

Who owns each risk in a family office?

Each risk has a named owner, a limit, a trigger and a response. The owner may be a family member, an office executive or an outside adviser. The limit says how much exposure is accepted. The trigger says when the owner must act. The response says what the owner does first. Plain wording matters, because an owner under pressure follows what is written.

Owners report to the family council on a calendar. Clear ownership turns a shared worry into a task. When an event happens, the map already carries the name of the person responsible and the first action. A new owner receives the map with the responsibility, so continuity holds when roles change.

Where does insurance fit in family office risk management?

Insurance transfers part of a risk to an insurer for a premium. Families use life, health, property, liability, cyber and key person cover, among others. The office checks what each policy covers, the amounts, the exclusions, the insurer’s standing and the renewal date, and keeps the documents in one register. The register includes the broker, the claim contact and the dates of every renewal.

Risks that the family retains are recorded as decisions. A family may accept a deductible or leave a small risk uninsured because the premium exceeds the loss it would absorb. The policy states which risks are transferred and which are retained on purpose, and who approved that choice.

How does a family office manage cyber and fraud exposure?

Payments, passwords and personal data open the door to fraud. The office sets controls: 2 people approve each payment, a call-back confirms any new bank detail, devices receive updates, and access is limited to what each person needs. These controls are simple and they stop many attempts. A written rule that new payees need a second confirmation by phone is one example.

Training matters as much as tools. Family members and staff practise recognising a false instruction, a forged invoice or a message that pretends to come from a bank. The office keeps a written plan for an incident, with contacts and the first steps, and tests it once a year. The test shows who is reachable, which accounts can be frozen and which adviser leads the response.

How often should a family office review its risk map?

The risk map is reviewed on a calendar, often each quarter for the top risks and each year for the full list, and after events such as a sale, a death, a move or a change of adviser. Each review records what changed, which limits were crossed and which responses worked. The record shows the family council how the exposures changed over the year.

For continuous monitoring, Estate Sentinel on the EQOS Asia private page re-measures an estate each month and raises threshold alerts, from US$1,100 per month on a 6-month minimum (EQOS Asia private page, 2026). This page is general information, not legal, tax or investment advice.

Frequently asked questions

About the author

Stéphane Jambu

President, EQOS Forecast Asia

Stéphane Jambu leads EQOS Forecast Asia and works as a consultant in e-commerce, search visibility, and AI. LinkedIn profile