Family Office Risk Framework: Board Action in 90 Days

Adopt one integrated, board-owned risk framework that covers every risk domain, and start by commissioning an interdependency risk scan and updating your risk register within 30 days. This follows the Basel Committee's third-party principles, Swiss expectations on operational resilience, and Deloitte's cyber findings on how exposed family offices remain.

TL;DR:

• Boards should receive quarterly risk reports and heatmaps, refresh risk appetite and dependency maps annually, and review lessons after every incident.
• Track providers through all six life cycle stages, record criticality, replaceability, data location, and subcontractors, then stress test shared dependencies and arrange fallback providers.
• Deloitte reports that about 31% of family offices lack an incident response plan, while around half lack disaster recovery plans; exercise both annually.
• Swiss law requires a DPIA when processing is likely to pose high risks to people’s rights; sensitive data and cross border sharing are common triggers.

Marmot Finance

Make Informed Investment Decisions

Marmot Finance supports women and families in Switzerland with tailored investment strategies, personal consultations and digital tools.

Visit Marmot Finance

What does an integrated family office risk framework cover?

A workable framework treats risk as one connected system, not a set of separate checklists. For a family office, the principal domains are:

• Strategic: decisions on asset allocation, succession and new ventures.
• Market, credit and liquidity: price moves, counterparty failure and the ability to fund commitments.
• Operational: people, processes and systems that run daily activity.
• Cyber and ICT: attacks on, and failures of, technology and data.
• Legal and compliance: regulatory duties and contractual obligations.
• Reputational: how the family and the office are perceived.
• Third-party and supply chain: custodians, administrators, advisers and software providers.
• ESG: environmental, social and governance exposures in the portfolio.

The value lies in how these connect. Take a phishing attack that locks your email: operations stall, a payment is delayed, a counterparty notices, and word reaches the press. One cyber event has become an operational and a reputational problem. Or take a custodian outage: you cannot move cash, a capital call goes unmet, and what began as a vendor failure turns into a liquidity issue.

Several artefacts hold the framework together, and you should ask your management team for each of them:

• A written risk appetite that states how much loss or disruption the family will accept.
• A risk register that names each risk, its owner, its rating and its mitigation.
• A dependency map that shows which people, systems and providers each critical service relies on.
• Incident playbooks that say who does what in the first hours of a crisis.

Who should own risk, and how often should the board hear about it?

The board, or the family council acting as one, owns risk. It approves the risk appetite and oversees management against it. This mirrors the BIS guidance, which advises boards to approve the third-party risk strategy and to align it with governance and risk appetite.

Management then runs the framework day to day. We recommend a small cross-functional risk committee, drawing on investments, operations, legal and technology, that meets before each board cycle. Reporting should follow a steady rhythm:

1. Quarterly: a risk report to the board covering the register, changes in rating and open actions.
2. Quarterly: a review of the heatmap by the risk committee, with exceptions escalated.
3. Annually: a refresh of the risk appetite and a full review of the dependency map.
4. After any incident: a short written lessons-learned note to the board.

Three artefacts make these meetings useful: a heatmap that ranks risks by likelihood and impact, an exception report for anything outside appetite, and a RACI chart that shows who is responsible, accountable, consulted and informed for each major risk.

Pro Tip: Ask for the same one-page heatmap every quarter, so the board sees movement rather than a fresh format each time.

How should a family office manage third-party risk?

Most family offices outsource a great deal: custody, reporting, tax, IT, even payroll. That makes third-party risk management a core discipline. The Basel Committee says it should follow the whole life cycle of a provider arrangement and sit inside the wider operational risk framework, which is how concentration and supply-chain weaknesses come to light.

The life cycle runs in six steps: risk assessment, due diligence, contracting, onboarding, ongoing monitoring and termination. At each step you ask a different question, from "do we need this provider at all?" through to "how do we leave without losing data or service?".

The BIS also describes registers of third-party arrangements as a core tool. A useful register records:

• How critical each service is to the office.
• How easily the provider could be replaced.
• Where the data and the service are physically located.
• Any contingent providers the vendor itself relies on.
• A legal entity identifier (LEI), where the provider has one.

Concentration risk appears when several critical services lean on the same provider, often without anyone noticing. To manage it, map those shared dependencies, stress test what happens if one provider fails, and line up a fallback provider for your most critical services before you need one.

What cyber measures should a family office put in place first?

Family offices hold large sums, sensitive family information and often modest security teams, which makes them attractive targets. The gaps are well documented. Deloitte's family office cybersecurity research finds that many offices lack advanced protections. Multi-factor authentication and backups are common, but incident planning and vendor checks lag behind. Phishing is the most frequent attack, and one-third of attacked offices suffered loss or damage.

Deloitte's research finds that about 31% of family offices have no cyber incident response plan, and around half have no disaster recovery plan. The plans that would limit the damage are often the ones that are missing.

Priorities, in rough order:

• Multi-factor authentication on every account that touches money or data.
• Identity and access management, so people see only what they need.
• Tested backups stored outside your main systems.
• Regular staff training, with simulated phishing.
• Penetration tests of critical systems.
• A written incident response plan, exercised at least once a year.

For cadence, run a cyber maturity assessment each year and review critical systems more often. If you have no in-house security expertise, a managed security service provider can monitor round the clock. Treat that provider as a third party, with its own entry in your register.

How do you build operational resilience and business continuity?

Operational resilience is the ability to keep delivering critical services through disruption. It sits across ICT, business continuity management (BCM) and third-party management, which is why we treat it as one connected effort. Swiss supervisory expectations point the same way. As of 2026, institutions in supervisory categories 1 to 3 must coordinate their resilience framework with operational risk, ICT and cyber risk, BCM and third-party management. That guidance also discusses incident reporting for breaches affecting client assets or market integrity. A family office may sit outside those categories, but the logic is a sound benchmark.

Two recovery targets turn the idea into something testable:

• Recovery time objective (RTO): how long you can be without a service before the damage becomes unacceptable.
• Recovery point objective (RPO): how much recent data you can afford to lose.

Set both for each critical service by asking the people who use it. Payment approval may need a shorter RTO than reporting, depending on the service and its users. Then test the plan, because an untested continuity plan is a guess.

When does a DPIA apply, and what should it produce?

A data protection impact assessment (DPIA) is a structured look at the risks a data activity poses to the people whose data you hold. Since 1 September 2023, the revised Swiss data protection act requires one where processing is likely to result in a high risk to a person's personality or fundamental rights. The assessment must describe the planned processing, evaluate the risks and set out protective measures.

A short test helps you decide whether you need one:

1. Does the activity involve sensitive data, such as health, finances of family members or minors?
2. Is the processing new, large in scale or based on new technology?
3. Will the data be shared with, or hosted by, an outside provider or sent across borders?
4. Could a breach seriously harm an individual or the family?

If you answer yes to any of these, run a DPIA. Then use its findings: log the risks in your register, build the mitigation measures into technical controls, and write them into third-party contracts. Be aware that some cantons add stricter duties, so federal compliance alone may not be enough, especially for cross-border transfers.

What does a practical 90-day implementation look like?

Start small and sequence the work. Here is a plan most offices can follow:

1. Days 1 to 30: run the interdependency scan, create or update the risk register, appoint a named risk lead and complete a quick cyber maturity check.
2. Days 31 to 60: stand up basic third-party processes, starting with your top five providers, and run DPIAs where the test above says they apply.
3. Days 61 to 90: test the incident response plan and one continuity scenario, then start remediating the highest-rated gaps.
4. Beyond 90 days: move to the quarterly reporting rhythm and a yearly refresh.

On resourcing, balance three options: internal effort from existing staff, temporary specialist hires for the set-up work, and retained outside providers for ongoing tasks such as monitoring or testing. The main cost drivers are the size and complexity of your structure, the number of critical providers, how much of the technology you run yourself, and how often you test.

Pro Tip: Give the risk lead a regular slot with the principal. Momentum fades fastest when nobody is asked for progress.

How do you manage financial risk across CHF, EUR and USD?

Many family portfolios hold assets and liabilities in Swiss francs, euros and US dollars, so currency is a risk in its own right. A strong franc can reduce the value of foreign holdings when you report in CHF, while a family that spends in euros but holds mostly dollar assets carries a mismatch that no single investment decision will reveal.

Start by defining your base currency and the currencies in which your future spending and liabilities fall. Then compare them with where the assets sit. The gaps are your real exposure. From there, set a hedging policy in writing: which currencies you hedge, how much, with what instruments and who may approve changes. Without that policy, hedging tends to happen ad hoc, usually after a currency move has already cost you.

Liquidity needs attention too. Keep enough cash or near-cash in each currency to meet obligations such as capital calls, tax payments and property costs, so you never have to convert at a bad moment. Finally, watch counterparty exposure. Holding cash and hedges with a single bank concentrates credit risk, and it connects directly to your third-party register. Review the currency picture at each quarterly meeting and record any breach of appetite as an exception.

Which compliance and regulatory risks matter for Swiss and European family offices?

Compliance risk is the chance of breaching a rule you did not know applied, or knew about and failed to track. For family offices spanning Switzerland and the EU, the picture is layered: Swiss federal law, cantonal differences, and EU rules that can reach you through family members, assets or service providers located there.

A few areas deserve a standing place in your register. Data protection comes first, because the Swiss act and EU rules can both apply to the same activity, and cross-border transfers add duties. Financial regulation is next: whether your structure, or any service you provide, needs a licence or falls under supervision depends on what you actually do and for whom, so take specialist advice rather than assuming. Tax and reporting duties follow, particularly for families with members in several countries.

Practical habits matter more than clever structures. Keep a regulatory calendar with owners and dates. Assign one person to track changes in each jurisdiction where you have presence. Record each obligation in the register alongside the control that satisfies it. And when you onboard a provider, ask how they handle the rules that affect you, since a provider's breach can become yours. Where the law turns on your specific facts, confirm the position with a qualified adviser in the relevant country.

How can a family office protect its reputation?

Reputation is built slowly and lost quickly, and for a family office it is personal. A data leak, a disputed investment or a careless public remark can damage the family's standing and the trust of partners long before any financial loss appears.

The best protection is prevention through the other domains. Strong cyber controls, careful vendor choices and clear conduct standards remove most reputational triggers. Add specific measures. Agree who may speak for the family and the office, and who may not. Set social media guidelines for family members and staff, especially on travel, property and wealth. Screen counterparties, investees and philanthropic partners before associating the family name with them.

Prepare for the bad day as well. Write a short crisis communication plan that names the decision-makers, the first-hour steps and a holding statement you can adapt. Rehearse it as part of your incident exercises, because a leak is usually a cyber, legal and reputational event at once. Afterwards, hold a review and update the register. Reputational risk is hard to quantify, so use simple ratings and track near misses, such as unwanted press enquiries, as early warnings.

How should a family office run scenario analysis and stress tests?

A family office rarely needs the models of a large bank, but it does need to know what happens when several things go wrong together. Scenario analysis asks "what if?" in plain terms and measures the impact on cash, liquidity and the family's ability to meet its commitments.

Pick scenarios that reflect your real exposures. Good candidates include a sharp equity fall combined with a stronger franc, a custodian outage lasting several days, a successful phishing attack on payment approvals, and a key person becoming unavailable. For each, follow the chain: what breaks first, what it triggers, how long recovery takes and what it costs. Your dependency map and third-party register make this far easier, because they show where one failure spreads.

Add a reverse stress test: start from an outcome you cannot accept, such as being unable to fund obligations for an extended period, and work backwards to the combinations that would cause it. That tends to surface risks no forward-looking list reveals.

Keep the output short and decision-oriented. Show the board the loss or disruption estimate, whether it sits within appetite, and the action you propose. Refresh scenarios yearly, and whenever the structure, the portfolio or the threat picture changes materially.

A prioritisation note on what matters most

In my view, executives lose more by building endless checklists than by missing an item. Focus on interdependencies: the places where one failure spreads. Do not treat cyber as an IT matter, because it belongs in board-level governance alongside everything else. Aim for staged progress with milestones the board can measure, and keep the board engaged from the outset.

How we can support your risk governance

We work with women and families in Switzerland and Europe, and can offer a discreet alternative to building everything in-house. We help you set up governance routines, keep your register current and shape regular reporting, within the scope of our wealth management and coaching services. Explore our wealth management services and pricing, or get in touch to discuss what fits your office.

• Governance and reporting support aligned with your wealth management mandate.
• Financial coaching for principals and family members.
• Educational webinars and community events for capability building.

This article is general information, not a substitute for advice from a qualified financial advisor. Consult a qualified financial professional about your own circumstances before acting on anything here.

FAQ

What is a family office risk framework?

It is a structured way to identify, rate and manage the risks a family office faces, across domains such as market, cyber, operational and reputational. It rests on a risk appetite, a risk register and a dependency map, and it is overseen by the board.

Who is responsible for risk in a family office?

The board or family council owns risk and approves the risk appetite, in line with BIS expectations. Management runs the framework day to day, usually through a small cross-functional risk committee.

When does a family office need a DPIA?

A DPIA is needed when data processing is likely to create a high risk to people's personality or fundamental rights, under the revised Swiss data protection act. Sensitive data, new technology and cross-border sharing are common triggers.

How often should a family office review its risks?

Report to the board quarterly, review the risk appetite and dependency map annually, and update the register after any incident or material change. Critical systems deserve more frequent checks.

Sources

• Rpcs
• Orx
• Factsheet on the data protection impact assessment (DPIA) in accordance with Articles 22 and 23 FADP (August 2023)

‍