What Controls Should Prevent Unauthorized Trades or Transfers?

Prevent unauthorized trades and transfers by assigning authority in writing, separating initiation from approval, and reconciling completed activity to records held outside the person who entered it. The controls should cover the path from request to execution and make exceptions visible.

Assign Trade Authority

Maintain a current list of who may recommend or approve trades for each account, and who may enter or confirm them. Tie authority to the investment policy, account mandate, and any approval rules set by the family or investment committee. State what needs approval before execution, how approval is recorded, and who can act when the usual approver is unavailable.

For a trade outside the approved mandate, require documented review before it is entered. Ask the custodian or broker what user permissions exist and whether a user can both enter and release an order. Review access when responsibilities change or someone leaves. Keep a record of access grants and any changes or removals so an old login does not remain active unnoticed.

Separate Payment Duties

For cash movement, separate the person who requests a transfer from the person who approves and releases it. The person who can change beneficiary instructions should not be the only person able to approve a payment to those instructions. Record the purpose and destination, along with supporting documents and approvals. Confirm payment instructions through an independent callback using a known contact method, especially after a change.

Ask your bank or custodian how it handles dual approval and new beneficiaries, as well as instruction changes and emergency exceptions. Confirm who can see pending transfers and who receives transaction alerts. For outside managers, ask for the written control procedure and account authorization records showing which individuals hold each permission.

Reconcile and Test the Process

Have someone who did not enter the activity compare trade confirmations and bank activity with the office's records and account statements. Set a regular review schedule and define who follows up on unmatched transactions. A second reviewer should examine changes to account access and payment instructions. The operating plan should identify the owner and backup, plus the evidence retained and escalation path for each task. The single family office operational processes guide can help organize these recurring duties.

Walk through one trade and one transfer from request to final statement entry. Ask:

• "Who can start or approve this transaction, and who releases it?"
• "What record proves approval occurred before execution?"
• "Who checks a changed beneficiary using a known contact method?"
• "What would alert us to a trade or transfer outside the mandate?"

Look for shared logins, approvals added after a transaction, unreconciled differences, and frequent emergency exceptions. These are reasons to investigate the process and correct weaknesses. Keep a log of exceptions, the reviewer's findings, and the resolution. If the manager cannot show who controls an account or how it would detect an unauthorized movement, resolve that gap before granting access or funding. See the payment instruction security checks for a focused review of that risk.

Checklist

• Keep a written, current authority list for each account.
• Assign different people to request, approve, or release transactions.
• Require independent confirmation when payment instructions change.
• Review user access when roles change and remove access promptly.
• Reconcile trades and transfers to independent statements.
• Record exceptions, reviewer decisions, and corrective steps.

Read next: What internal controls should a family office have?

Financial controls are in place to prevent embezzlement, unauthorized investments, and style drift within an investment portfolio.

Sources: Family Office Club investor due diligence framework, How to Start a Family Office. Informational only, not financial, legal or tax advice.