The real threat to family offices is what happens after a cyberattack
Perhaps an even greater operational risk is the business disruption that could occur as a result of a cyberattack or data breach. Regardless of FO size, respondents ranked business disruption as their next biggest concern after a data breach or cyberattack (53% for smaller FOs, 46% for midsize FOs, 39% for large FOs).
Interestingly, the newer the FO, the lower the perceived risk of business disruption for respondents (35% for FOs founded between 2015 and 2023, 39% for those founded between 2005 and 2014, 43% for those founded between 1990 and 2004, and 50% for those founded in the 1970s and 1980s). A possible explanation is that FOs of more recent vintage and with newer infrastructure feel better prepared for a cyberattack than perhaps smaller FOs with fewer resources and/or older technology.
As further proof of this point, “failure to upgrade technology” tied as the second biggest operational risk at 39% for FOs founded between 2005 and 2014. Meanwhile, FOs founded between 2015 and 2023 ranked it a much lower concern at 20%.
When asked what measures their FOs have in place to mitigate operational risk, most SFO respondents said backup servers (79%), followed by data security policies (53%) and business continuity plans (51%).
Again, in terms of preparation, data security policies are much more prevalent among larger FOs and less so for smaller FOs (61% in place for larger FOs, 51% for midsize FOs and 38% for smaller FOs). The same goes for backup servers (86% in place for larger FOs, 77% for midsize FOs and 71% for smaller FOs).
Often, in tandem with conversations on cybersecurity and operational risks, there is a focus on processes and controls surrounding cash movement. Remarkably, 71% of midsize and larger FOs surveyed noted that dual authorization of payments was not currently in place at their organization. This number was slightly lower for smaller FOs, at 65%.