Family offices have identified cultural weaknesses and staffing issues as their top risk management challenges. Poor human capital management is at the root of risk management vulnerabilities. 

Attracting and retaining staff

Key person turnover risk, cited by more than half (54%), is seen as the biggest risk when it comes to internal staff. This shows that family offices need to implement succession planning and knowledge sharing to mitigate the impact of critical employees departing. Absence of a robust succession plan can disrupt operations in the case of key personnel departures or unforeseen events, jeopardizing continuity and stability.

Attracting and retaining talent, cited by 38%, is the third-biggest risk. Such concerns are justified, given that the same percentage say they've had increasing difficulty retaining employees over the last two years.

All of this culminates in family offices left with inadequate staffing levels, which is understandable given the current market battle for family office talent. Three in 10 (29%) are currently short-staffed in key positions, with the biggest gaps occurring in critical areas including IT/cybersecurity (39%), risk management (37%) and investment management (32%). Such gaps are rendering family offices more vulnerable to cyberattack, with nearly half (45%) pointing to cyber and data security management as a key internal risk.

Family offices acknowledge the impacts of these staffing problems. A third (32%) point to limited staff as the joint top risk management challenge. Despite this, only 20% use an outside risk management professional. Awareness of challenges is not translating into a readiness to solve them.

Inadequate staffing reflects the ineffectiveness of internal programs designed to keep employees on board. Nearly half claim to have established robust employee retention programs to minimize staff turnover (49%) and mitigate key person risk (44%). Nonetheless these efforts are failing to bear fruit, indicating a need for competitive compensation packages and other benefits to reduce staff attrition.

Training and Insider Threat Programs

While family offices are struggling to attract and keep talent, existing staff are under-resourced, in part due to inadequate levels of training and development. Just a small majority (54%) say all staff participate in risk mitigation and security training, and among those taking part, most (59%) do so only annually.

Family members are also seen as the biggest source of reputational risk (36%).

Family offices continue to fall short in terms of monitoring employees' security profiles and developing effective insider threat programs. Just 37% periodically reassess the security profile of employees, although this is up from 19% in 2020. More positively, four in five (80%) conduct pre-employment background checks on all staff members compared to about two in three (68%) in 2020. 

Poor staff knowledge presents a further hurdle. Nearly three in 10 (28%) cite inadequate knowledge due to a lack of ongoing professional development as a top risk. This challenge is more acute in Asia (42%) and the Middle East (50%). These findings suggest low levels of staff development are contributing to high turnover.

Family offices therefore are suffering from a talent and skills shortage, which is creating holes in risk management defenses. Staff shortages are exerting additional pressure on existing employees who are poorly trained and lack development paths. As a result, retaining hard-to-find and experienced employees is becoming increasingly difficult in what appears to be a self-perpetuating human resources crisis.

On the one hand, due to their size and often easily traceable connection to the founder, large family offices are more vulnerable to a multitude of attacks. Their size should (relatively speaking) allow for a more holistic security risk management approach, and allocation of resources to accomplish mitigation. Frequent assessments, focused on both cyber and physical security, need to be ongoing as the threat landscape evolves.

On the other hand, smaller family offices lacking the resources or structure to absorb dedicated personnel to manage security risk would benefit from a fractional Chief Security Officer (CSO) model. Rather than going with the typical former/retired senior federal employee, now CSO, these smaller family offices may be better served by a fractional CSO service provided by agile boutique risk management companies. This approach would likely present a strong value option in terms of pricing and hours dedicated to the family office. It allows for someone to coordinate the security needs with intimate familiarity, rather than having security as an add-on duty for an already existing family office staff member.

The lessons are clear. To improve their risk management profiles and to attract top talent, family offices must strengthen insider threat programs and improve recruitment efforts, as well as provide better training, support and benefits to existing employees in order to keep them.