Most developed capabilities

Our study shows family offices are prioritizing three main areas: investment risks, legal/regulatory risks and financial risks.

Investment risks, such as performance and illiquidity, are unsurprisingly a key area of focus. Respondents from SFOs point to investment risks as the most developed component of their risk management processes (57% well-developed) and the area they are most focused on improving (60% very focused). These risks are also the second-most flagged area by risk or legal advisors (39% frequently flagged).

Similarly, processes around legal/regulatory risks and financial risks rate highly in terms of being well-developed (both 45%), frequently flagged (40% and 30%, respectively) and a focus of improvement (39% and 31%, respectively).

There is a clear interrelationship among these assessment criteria. Those areas most flagged by advisors tend to be more developed from a risk management perspective and the main focus of improvement. This suggests that the more family offices understand a certain category of risk, the more they can identify elements in need of improvement.

While legal/regulatory risks and investment risks are most proactively flagged globally, regional variations emerge. More SFOs in Europe (42%) and Asia (40%) say legal/regulatory risks are frequently monitored compared to those in the Middle East (33%). In addition, offices in Asia (50%) and North America (43%) are more likely to point to investment risks being flagged than in Europe (33%) and the Middle East (33%).   

Underdeveloped capabilities

Beyond the high-priority areas, fundamental sectors such as cyber risks, operational risks and reputational risks are underdeveloped and underreported. Inefficient processes, lack of adequate controls and reliance on manual systems increase the potential for operational failures, errors and fraud. For instance, 19% of SFOs have no risk management processes in place for reputational risks.

Furthermore, geopolitical risks, developing technology risks and environmental hazards rank even lower in terms of risk protocols, monitoring frequency and targeted improvement.

Half of SFOs say their organization has no risk management processes for climate change/natural disasters (50%), geopolitical risks including wars and terrorism (49%), and emerging technology risks such as artificial intelligence (53%).  

For SFOs, risk management capabilities around emerging technologies are linked to the age of organizations. More family offices established over a decade ago lack any processes in this area compared to newer offices set up within the last 10 years (64% vs. 38%). This suggests mature SFOs are less equipped to deal with threats posed by new technologies.  

MFOs, on the whole, have more advanced risk management practices. For all areas under review, a higher proportion of MFOs say they have well-developed programs compared to SFO peers.