Family Office Risk Management: How One Capital Call Exposes Three Risks

Family office risk management is the work of identifying what could interrupt a family's decisions, payments or records, then assigning someone to detect and act before the loss occurs. An investment-risk report alone cannot do that job. A capital call, for example, may expose a cash shortfall, a changed wire instruction and an inaccurate family report at the same time.

This guide uses one fictional family office to show how those three risks travel through a common register. The figures and roles are illustrative. Actual authority, legal duties and tolerances depend on the office's entities, contracts and policies.

01What belongs in a family-office risk register?

The register should make decisions possible, not merely name threats. Cover at least six connected domains:

• Investments: concentration, leverage, manager exposure, valuations and mandate breaches.
• Liquidity: capital calls, taxes, operating cash, collateral and assets that cannot be sold by the due date.
• Operations and cyber: payment instructions, access rights, data integrity, vendor failure, backups and continuity.
• Legal and tax: entity obligations, filing dates, contracts, insurance terms and professional-adviser escalation.
• People and governance: key-person dependence, delegated authority, conflicts, succession and family decision deadlock.
• Physical and reputational exposure: personal security, privacy, property events and public disclosure.

These are categories, not equal-priority risks. For each material scenario record the affected entity, exposure, likelihood and impact assumptions, owner, leading indicator, control, stop rule, response owner, review date and evidence. Mark unknown exposure as unknown, not zero. A family may accept a risk after an authorized decision that states the exposure and review date. A missing owner or untested control is not acceptance.

EY's family-office risk discussion emphasizes the framework and its ongoing maintenance. A register that is reviewed only at annual planning cannot govern a payment due next week.

02One capital call, three decisions

Assume a fictional office has US$4.0 million of available cash in one paying entity. For this example, that same entity owes the call and tax payment and is subject to the stated reserve; its cash is legally and operationally usable for both payments. A private fund calls US$1.8 million next week. A tax payment of US$1.2 million follows in the same planning window. The office's approved minimum operating reserve is US$1.5 million. Assume no other cash inflows, investment sales, borrowing, transaction costs or timing changes until those obligations settle. In a real office, run the bridge by paying entity. Cash in another trust or company is not available without valid transfer or loan authority and settlement timing.

The fund notice also gives a receiving bank account different from the office's approved record. The office has not independently verified the change. Its draft family report still shows the old cash forecast.

The three gates must not be collapsed into one green status. A verified beneficiary and funded reserve can permit an authorized payment while the stale report stays on hold; report release is a separate decision. Even if a sale settles and covers the US$0.5m shortage, the changed instruction is still unverified. Conversely, a genuine bank account does not create liquidity or make an unreconciled report fit for release.

The FBI's business-email-compromise advisory describes criminals' use of changed payment instructions and recommends a secondary verification channel. As a practical office control, obtain the fund administrator's confirmation through a pre-existing phone number or approved portal, independently check beneficiary details and document who approved the final instruction. An email reply in the same compromised thread is not independent verification.

03A three-row register for the event

Use the same field order for each row: affected entity; trigger and status; owner; held action; approval; closure evidence; next review. The last field is the actual decision or review date in a real office, left open here because this case is fictional.

1. Liquidity: paying entity; US$4.5m required against US$4m usable cash — fail; treasury; hold payment release until the funding gap is resolved under authority; delegated finance/investment approver; dated cash bridge, authorized sale or credit draw, settled cash and reserve reconciliation; review before the call deadline and after settlement.
2. Beneficiary: paying entity; changed account details — unknown; payment controller; hold the changed wire instruction; separate authorized payment approver; independent administrator confirmation, approved beneficiary record and matched paid-bank record; review before any wire release.
3. Family report: reporting entity; call omitted from forecast — stale; reporting lead; hold final report release, not an otherwise properly approved payment; delegated reporting approver; dated forecast, ledger/fund reconciliation and final issued version; review before family distribution.

Replace the fictional role labels, reserve and deadlines with each office's actual mandate. The record does not authorize moving another entity's cash simply because consolidated wealth is sufficient.

04Put an owner and stop rule on each risk

The register becomes useful when a trigger changes what people do. For the fictional call, the record could read:

1. Liquidity trigger: projected settled cash after known obligations is below the US$1.5m floor. Treasury produces a dated cash bridge, including funding source, settlement date, fees and a fallback. The authorized investment or finance lead approves any sale or borrowing under the actual mandate. Until the bridge is real, the call remains an unfunded obligation, not a reason to assume the reserve can be ignored.
2. Payment trigger: new beneficiary details differ from the approved record. The payment controller freezes the changed instruction, verifies it through a pre-existing phone number or secure portal, and retains the evidence. A separate authorized approver releases the wire. If the instruction cannot be verified before the deadline, promptly escalate the likely delay to the administrator and authorized office decision-maker. Record the consequences and response; do not bypass the control merely to appear on time.
3. Reporting trigger: a material cash event is missing from the family forecast. Finance updates the projection and reconciles it to bank, ledger and fund records. The reporting approver releases only a dated version whose assumptions and unresolved items are visible.

The fund's capital call is a cash obligation. Paying it reduces cash and generally changes paid-in and unfunded commitment records according to fund terms; it does not, by itself, authorize changing the fund's approved valuation. Keep the notice date, effective date, settlement date and valuation date distinct.

These roles may sit with a small in-house team or external providers, but the family office still needs a named decision owner and a working escalation route. A vendor's automated alert can support detection; it cannot decide who may override a reserve floor or send money to a new account.

05Prioritize risks by loss path, not a colored score

A heat map can focus discussion, but multiplying a subjective likelihood by impact does not establish a safe decision. Ask how quickly an event can cause loss, whether it is reversible, how much of the exposure is hidden and whether an existing control has actually been tested. A low-frequency wrong-wire event may deserve an immediate hard stop; a valuation discrepancy may need a documented report hold while the source is reconciled.

For each material scenario, test a negative path. Can a person submit changed bank details and still have a payment released without independent verification? Can a reserve breach disappear from a consolidated view because the tax payment belongs to another entity? Can a family report be issued while the source valuation is provisional? The evidence is the blocked transaction, exception log, approval trail and reconciled output—not a vendor's description of the feature.

NIST's Cybersecurity Framework 2.0 offers voluntary guidance to govern, identify, protect, detect, respond and recover from cyber risk. It can help structure access and incident response, but a family office must adapt it to its actual accounts, providers and authority. The SEC's family-office compliance guide describes a specific exclusion from the Investment Advisers Act definition under conditions. It is not a blanket waiver of other laws, contracts or duties, and this article does not decide any office's regulatory status.

06Review, escalate and recover

The risk owner should revisit a register entry when its inputs change: a new entity, bank, manager, signer, fund commitment, cyber incident or succession event. Set ordinary review dates, but let a breached trigger force immediate escalation. Record what was known, when, who decided and which evidence closed the issue.

In the fictional case, closure requires more than making the payment. Treasury must reconcile actual settled cash with the reserve and forecast, including any bridge financing and its repayment date. The controller must match the paid beneficiary to the independently verified instruction. Finance must reconcile the capital-call accounting and issue the corrected family report. If a control failed, retain the incident and change the process before the next call.

Insurance, diversification and outside advisers all matter, but each covers a different loss path. Insurance does not prove a wire was authorized. Diversification does not supply cash on a fixed date. An outside administrator does not remove the family's need to know who approves a report or payment. A useful risk program makes the owner, stop rule and proof of closure visible before a loss is absorbed.

07Frequently asked questions

1Who should own family-office risk management?

The governing body or family principal should set tolerance and delegate authority. A named executive or risk lead maintains the register; treasury, investment, finance, technology and external specialists own specific controls. Separate the preparer, verifier and approver when a loss could be material.

2How often should the risk register be reviewed?

Set a periodic review suited to the office's activity, plus event-driven reviews for new entities, commitments, signers, providers, incidents and breached thresholds. A dated annual document is not a substitute for a stop rule at the payment or reporting point.

3Is a family office exempt from risk-management requirements?

No single answer applies to every office. The SEC family-office rule concerns a particular Advisers Act exclusion under stated conditions. Other applicable obligations and contractual duties depend on the entities and activities. Counsel should assess the actual structure; the office still needs practical controls for its cash, data and decisions.