How family offices can broaden their risk mindset in a volatile time

Amid fears of losing capital and experiencing sudden downturns, family offices have understandably moved more toward cash, but these efforts reflect a narrow portfolio-focused view of how to respond to risk. When the economy is booming and markets return capital, investment and operational risk management often grows lax. This lack of rigor is suddenly exposed when the economy flips and returns contract.

Actions to consider:

• Identify and implement a technology platform for portfolio performance and risk that provides transparency into the liquidity of your family office’s portfolio, including an ability to model cash flows and investment commitments and support related planning. There are several such platforms on the market today.
• Rebalance your portfolio at set allocation points instead of a date on a calendar. More family offices say they rebalance their portfolios annually (30.4%) than quarterly (29%), but regardless of the recurring time period, a calendar-driven approach creates the risk of rebalancing needlessly and incurring unnecessary transaction costs or investment fees. Ensure the operating model is supported by processes and controls that deliver real-time, accurate reporting enabled through technology. This positions a family office to set asset allocation targets, establish percentage variances from them that meet investment objectives, and then pursue rebalancing once those variances are exceeded.

Historically, family offices have relied significantly on outsourcing to minimize these key person risks and talent gaps. But the 2022 survey shows that the number of professional staff members has increased, reflecting the trend to internalize activities such as risk management.

Actions to consider:

• When evaluating whether to hire staff or outsource to a service provider, consider several factors, including privacy, cost and expertise. There is no one-rule-fits-all approach, and it’s often driven by a family’s ability to govern external processes and attract talent in a specific location, or by the desire for a family to keep information within its four walls. What is key, however, is that employees and service providers both need to be culturally aligned with the family in terms of goals, values and risk tolerance. To mitigate risk, it’s crucial to conduct a diligent selection process when choosing a provider or hiring staff. Family offices often use consultants for this purpose, given the specialist nature of the search and selection process.
• For internal hires, support risk management through succession planning and documented roles and responsibilities. For those elements still being outsourced, put a vendor management program in place that periodically evaluates vendors against predetermined KPIs (from a service delivery standpoint). And because outsourced functions expand your information footprint and increase risk — cited as a key concern in the survey — you should also understand what key controls these service providers have to preserve confidentiality.

Cybersecurity gets limited attention with respect to in-house expertise. On average, family offices employ an average of 4.6 IT professionals, but less than 1 is a cybersecurity specialist — even though half of respondents believe that if a breach does occur it will be somewhat costly, whether financially or reputationally.

With cybersecurity in mind, it’s revealing that family offices rely heavily on email (93%) to send information to family clients and family members rather than via a website or intranet site (31%), and just 36% provide online access to accounts to family members for reporting purposes. Email is also prioritized for family office personnel and external vendors.

This information is also quite personal. More than 90% of respondents report that their family offices share at least some detailed investment data with family members, while 70% believe that this includes at least some detailed information about general activities. It not only includes the amount of the family members’ wealth but also their tax positions, who lives with them, perhaps political donations — all information that creates possible reputation risk if revealed.

Actions to consider:

• Define what you need to keep private and create segments in whom you communicate that information to internally. What is it you’re protecting? Does the family care if anyone finds out what they invested in, for example? And who’s in the circle of trust for that information — all the family executives or all the family members? Or none?
• When looking at outside IT vendors, use separate resources for managed services and cybersecurity. The latter is too important for one entity to also handle without the external validation. Also ensure that vendors have accredited cyber and data security protocols, with either ISO or SOC accreditation through a creditable auditor.

As noted, family offices often have limited headcount, in which the responsibilities flow upward to these committees, with mostly detective controls to be enforced at a lower level. To some families, this is a solution: they are the final safety check. But a lack of strong preventive controls as part of operating governance is its own problem because problems are left to grow until eventually they are escalated to the management committee level. For example, a small family office may not be able to separate cash disbursement from bank reconciliation from accounts payable entries. In this case, they shift check-signing up to the president or family members themselves.
 

Actions to consider
 

• Ensure that the management committee is empowered to set strategic direction on risk holistically for the family office. Their priorities should be inserted into the culture and enabled through preventive and detective controls, breaking down silos, with compensation set accordingly.
• Put in place a framework to evaluate risk throughout the family office that measures results with scorecards (annually or biannually, for instance). Also ensure there is separation of duties between those designing and monitoring the risk framework and the family office staff executing it. Is risk going up or down, accounting for the areas we’ve discussed, across all functions?
• If the family office is large or complex enough, consider forming a risk committee (which 30% of survey respondents have) with the remit of ensuring compliance for the issues we’ve raised above.