vaayaa Inclusive Education
Professional risk assessment

Business and Management Consulting Risk Assessment: Advice Quality, Confidentiality and Delivery Controls

A worked example of how a small consulting practice identifies, scores and controls risks to advice quality, client confidentiality, independence, fee control, delivery continuity and reputation across its engagements.

Updated November 2026 8 hazards assessed Review every 6 months Highest risk: Critical to Medium
See the Business and Management Consulting course

Executive summary

This assessment shows how a small consulting practice can find, rate and control the risks that matter most to its advice, its clients and its own standing. Eight risks were chosen because they are plausible in everyday engagement work. Breaches of client confidentiality are rated highest before controls because client data is shared widely and often across devices. Unsupported recommendations, conflicts of interest, fee leakage, handover failure and supplier interruption form a second group of High risks. Each risk is scored before controls and again after existing and added controls. Most risks fall to Medium or Low once the added controls are in place, but confidentiality stays at Medium because the impact on clients remains serious. The first actions are restricted project folders, a written independence check, a handover template and a written change request process. The practice is a teaching example, so every score shows the method, not a real firm.

Focus area
Business and management consulting
Setting
Independent management consultancy of a small to mid-sized firm delivering client engagements on strategy, operations and organizational change
Method
Five by five likelihood and impact risk register

Scope

This assessment covers client engagements from proposal and scoping through analysis, recommendations, implementation support and close. It covers advice quality, confidentiality, independence, fee control, staffing and handover, supplier use, on-site safety and reputation. It does not cover the legal or financial position of any real firm or client. Jurisdiction, firm size, sector mix and systems are assumptions made for teaching and must be confirmed before any real use.

Context

The firm has a partner group, a small team of consultants and analysts, an operations manager and a finance lead. Work is delivered through shared document stores, analysis workbooks, video meetings and client portals. Some engagements require on-site workshops at client premises, and a few rely on specialist subcontractors for research or facilitation. Each risk is scored before controls to show its natural level, then again after the existing controls and the additional controls proposed here.

Objectives, assets and stakeholders

The objective is to give clients sound, evidence-based advice, protect their information, deliver agreed work within budget and on time, and keep the trust of clients, partners and the public. The assets in scope are client data and documents, analysis workbooks and models, engagement budgets, the reputation of the firm and its partners, and the people who deliver the work. Stakeholders include consultants, partners, operations and finance staff, clients and their customers, subcontractors and suppliers, and professional bodies. Every risk has one owner role, and the managing partner reviews the register with the partner group each quarter.

Risk matrix: before and after controls

Each cell shows hazard numbers placed by likelihood and impact. Compare the two grids to see how controls move each hazard.

Before controls

Inherent risk

Risk before controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain Likelihood 5, impact 4, score 20, critical: H02
4 Likely Likelihood 4, impact 3, score 12, high: H04 H05 Likelihood 4, impact 4, score 16, high: H01
3 Possible Likelihood 3, impact 4, score 12, high: H03 H06 Likelihood 3, impact 5, score 15, high: H08
2 Unlikely Likelihood 2, impact 4, score 8, medium: H07
1 Rare

After controls

Residual risk

Risk after controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely
3 Possible Likelihood 3, impact 2, score 6, medium: H04
2 Unlikely Likelihood 2, impact 3, score 6, medium: H01 H03 H05 H06 Likelihood 2, impact 4, score 8, medium: H02 H08
1 Rare Likelihood 1, impact 4, score 4, low: H07
  • Low 1 to 4
  • Medium 5 to 9
  • High 10 to 16
  • Critical 17 to 25

Hazard register

A summary first, then the detail for each hazard.

Summary of hazards with scores before and after controls
No.HazardBeforeAfterOwner
H01 Unsupported or inaccurate recommendations reach the client 16 High 6 Medium Engagement quality lead
H02 Breach of client confidentiality and data exposure 20 Critical 8 Medium Information security lead
H03 Conflict of interest and loss of independence 12 High 6 Medium Risk and compliance partner
H04 Scope creep and fee leakage 12 High 6 Medium Finance lead
H05 Handover failure and loss of key knowledge 12 High 6 Medium Operations manager
H06 Subcontractor, supplier or tool outage interrupts delivery 12 High 6 Medium Operations manager
H07 Injury during on-site workshops and client visits 8 Medium 4 Low Health and safety lead
H08 Reputational harm from misleading claims or poor client outcomes 15 High 8 Medium Managing partner
H01

Unsupported or inaccurate recommendations reach the client

Strategic Before 16 After 6

Analysis rests on thin or outdated data, weak assumptions or untested logic, so recommendations mislead the client and lead to poor investment or operational decisions.

Who or what is affected: Client executives, boards and staff affected by the proposed change

Causes

Tight deadlines, reliance on one analyst's model and limited peer challenge before issue.

Consequences

Wasted investment, failed change programmes, claims against the firm and loss of credibility.

Existing controls

  • Partner signs off every final client report before release.
  • Analysis workbooks are saved in the engagement folder with version notes.

Control gaps

Peer review is skipped on short engagements, and sources are not recorded in the final pack.

Additional controls

  • Prevent: Use a checklist requiring source references and a second analyst check of key numbers.
  • Detect: Run a short red team review of recommendations before each client presentation.
Likelihood 4 x impact 4 before; 2 x 3 after Owner: Engagement quality lead Target: Within 30 days Early warning: A recommendation issued without a logged source or a peer review record.
H02

Breach of client confidentiality and data exposure

Technology and data Before 20 After 8

Client files, personal data and commercially sensitive results are shared with the wrong people, stored insecurely or left on shared devices and behind public links.

Who or what is affected: Clients, their customers and the consultants handling the data

Causes

Public file links, personal email use, shared drives with broad access and laptops taken off site.

Consequences

Contract breach, regulator notice, loss of clients and serious reputational harm.

Existing controls

  • Client folders use named access and are backed up each night.
  • Staff sign confidentiality terms in their contracts.

Control gaps

Access to project folders is not reviewed after staff move between engagements.

Additional controls

  • Prevent: Restrict project folders to named team members and block public sharing links by default.
  • Respond: Run a written breach response with a contact order and a client notice template.
Likelihood 5 x impact 4 before; 2 x 4 after Owner: Information security lead Target: Within 30 days Early warning: A project folder shared with a user who is not on the engagement team list.
H03

Conflict of interest and loss of independence

Legal and compliance Before 12 After 6

A consultant has a personal, financial or commercial link to a client, competitor or supplier, or accepts gifts that bias advice or hide the relationship.

Who or what is affected: Clients, partners and the firm's professional reputation

Causes

Long client relationships, referral fees and unclear rules on gifts and hospitality.

Consequences

Biased advice, breach of professional duties, disciplinary action and lost trust.

Existing controls

  • Staff sign a code of conduct each year.
  • Partners declare shareholdings in clients when they are appointed.

Control gaps

Declarations are collected once a year and are not compared with current engagements.

Additional controls

  • Prevent: Run an independence check against the client list before each proposal is accepted.
  • Respond: Withdraw from the affected work and record the decision with a second partner approval.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Risk and compliance partner Target: Within 60 days Early warning: A declared interest linked to an open or proposed engagement.
H04

Scope creep and fee leakage

Financial Before 12 After 6

Clients request extra work outside the agreed scope, or time is spent without being recorded or billed, so fees fall below the margin the engagement needs.

Who or what is affected: Partners, finance staff and the firm's owners

Causes

Vague scope wording, goodwill toward clients and weak timesheet discipline.

Consequences

Margin loss, unpaid work, staff overload and disputes over invoices.

Existing controls

  • Engagement letters set out scope, fees and exclusions.
  • Timesheets are reviewed by the engagement manager each week.

Control gaps

Change requests are agreed verbally and are not logged against the engagement budget.

Additional controls

  • Prevent: Require a written change request with a fee estimate before any extra work starts.
  • Detect: Compare hours booked with budget each week and flag any overrun above a set margin.
Likelihood 4 x impact 3 before; 3 x 2 after Owner: Finance lead Target: Within 30 days Early warning: Hours booked on an engagement above 90 percent of budget before the midpoint.
H05

Handover failure and loss of key knowledge

People Before 12 After 6

A consultant leaves, changes project or goes on leave without a structured handover, so client context, decisions and open actions are lost or misunderstood.

Who or what is affected: Client teams, colleagues and the continuity of the engagement

Causes

Short notice departures, no standard handover template and knowledge held in personal notes.

Consequences

Repeated client questions, missed commitments, rework and damaged client confidence.

Existing controls

  • Each engagement has a named engagement manager.
  • Core documents are stored in the shared project folder.

Control gaps

Handover notes are optional and are rarely checked by the person taking over.

Additional controls

  • Prevent: Use a handover template listing open actions, contacts and decisions, signed by both people.
  • Recover: Hold a short client introduction meeting whenever a team member changes.
Likelihood 4 x impact 3 before; 2 x 3 after Owner: Operations manager Target: Within 45 days Early warning: A team change on an engagement with no handover note on file within two days.
H06

Subcontractor, supplier or tool outage interrupts delivery

Supplier Before 12 After 6

A specialist subcontractor, research supplier or key software provider fails, is late or changes terms, stopping analysis, workshops or reports for the client.

Who or what is affected: Clients, consultants and the agreed project schedules

Causes

Reliance on one specialist, no backup supplier and contracts without agreed service levels.

Consequences

Missed deadlines, service credits, cost increases and client dissatisfaction.

Existing controls

  • Subcontractors work under written terms that include confidentiality clauses.
  • Key software has a vendor support contract.

Control gaps

Supplier performance is not reviewed, and no fallback provider is approved in advance.

Additional controls

  • Prevent: Approve a second supplier for each specialist service and check its capacity each year.
  • Recover: Keep a continuity plan that lets the team deliver core outputs with internal staff.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Operations manager Target: Within 60 days Early warning: A supplier misses two agreed delivery dates within one quarter.
H07

Injury during on-site workshops and client visits

Safety Before 8 After 4

Consultants travel, use unfamiliar client sites or run workshops in rooms with poor access, trip hazards or unsafe equipment, leading to injury or illness.

Who or what is affected: Consultants, client staff and visitors to the site

Causes

Unfamiliar premises, long travel days and no site induction before the first visit.

Consequences

Injury, time off work, duty of care claims and reputational harm to the firm.

Existing controls

  • Consultants receive a basic travel and safety briefing.
  • Client sites are asked to provide an induction on arrival.

Control gaps

Site hazards are assumed rather than checked before the first visit.

Additional controls

  • Prevent: Complete a short site risk check before each visit and agree access and emergency arrangements.
  • Respond: Record incidents, arrange first aid and report to the operations manager the same day.
Likelihood 2 x impact 4 before; 1 x 4 after Owner: Health and safety lead Target: Within 30 days Early warning: A near miss, or a site visit made without a completed risk check.
H08

Reputational harm from misleading claims or poor client outcomes

Reputational Before 15 After 8

Marketing claims, case studies or results are overstated or shared without consent, or a failed recommendation becomes public, damaging the firm's standing.

Who or what is affected: The firm, its partners, current clients and future prospects

Causes

Pressure to win work, unapproved case studies and weak complaint handling.

Consequences

Lost clients, fewer referrals, formal complaints and difficulty recruiting good staff.

Existing controls

  • Partners approve major marketing claims before publication.
  • Clients are asked for feedback at the close of each engagement.

Control gaps

Case studies are published without a consent and accuracy check against the engagement record.

Additional controls

  • Prevent: Require written client consent and a fact check for every case study or named reference.
  • Respond: Run a complaint process with a response within five working days and a partner review.
Likelihood 3 x impact 5 before; 2 x 4 after Owner: Managing partner Target: Within 30 days Early warning: A complaint or public comment about the outcome of an engagement.

Rating method and evaluation

Each risk is rated on two five-point scales. Likelihood runs from Rare to Almost certain, and impact runs from Insignificant to Catastrophic. Multiplying the two gives a score from 1 to 25, which falls into one of four bands: Low from 1 to 4, Medium from 5 to 9, High from 10 to 16 and Critical from 17 to 25. The score is a guide for ordering work, not a measurement. Inherent risk is the score before any controls. Residual risk is the score after the existing and additional controls. Impact is judged on client harm, money lost, time to correct, damage to reputation and effect on professional duties, and a risk is never rated down only because it has not yet happened. Anything Critical or High needs partner attention and a dated plan, anything Medium needs routine controls with a named owner, and anything Low is accepted and watched. Staff who do the work should challenge every rating, and ratings are reviewed whenever an indicator reaches its threshold or an engagement changes.

Likelihood, impact and rating bands

Likelihood

  • 5 Almost certain: Expected to happen in most circumstances.
  • 4 Likely: Will probably happen in many circumstances.
  • 3 Possible: Could happen at some time.
  • 2 Unlikely: Not expected, but it could happen.
  • 1 Rare: Only in exceptional circumstances.

Impact

  • 1 Insignificant: No lasting effect. Handled within routine work.
  • 2 Minor: Small effect that is quickly corrected.
  • 3 Moderate: Noticeable effect that needs managed effort to correct.
  • 4 Major: Serious effect on people, delivery or reputation.
  • 5 Catastrophic: Severe or lasting effect that threatens the whole activity.

Bands (likelihood x impact)

  • Low (1 to 4): Accept and monitor.
  • Medium (5 to 9): Manage with routine controls.
  • High (10 to 16): Senior attention and a treatment plan.
  • Critical (17 to 25): Act first. Do not proceed until reduced.

Monitoring, escalation and review

Review this assessment every 6 months, and sooner when an indicator below reaches its threshold.

Early-warning indicators and escalation thresholds
Indicator to watchEscalate when
Project folders shared with users who are not on the engagement team list.Escalate to the information security lead at once, and to the managing partner if access is not removed within one working day.
Declared interests linked to open or proposed engagements.Escalate to the risk and compliance partner before the proposal is accepted, and hold work until the independence check is signed.
Hours booked on an engagement above 90 percent of budget before the midpoint.Escalate to the finance lead when the threshold is reached, and to the managing partner if the change request is not agreed within a week.
Team changes on an engagement with no handover note on file within two days.Escalate to the operations manager at once, and to the engagement partner if the note is still missing after five working days.
Complaints or public comments about the outcome of an engagement.Escalate to the managing partner within one working day, and to the risk and compliance partner if the complaint concerns advice quality or confidentiality.

Contingency arrangements

If a serious event occurs, such as a confirmed client data breach, a published error or a supplier failure during live delivery, the managing partner takes charge. The information security lead isolates affected folders and preserves logs. The engagement manager informs the client early and plainly, agrees a recovery plan and records each decision. Specialist legal and insurance advice is sought where the relevant jurisdiction requires it. Internal staff cover core outputs while a replacement supplier is brought in.

Prioritized action plan

  1. Restrict client project folders and block public sharing links, owner information security lead, within 30 days.
  2. Introduce a written independence check before each proposal is accepted, owner risk and compliance partner, within 60 days.
  3. Require a written change request with fee estimate before extra work, owner finance lead, within 30 days.
  4. Adopt a signed handover template for every team change, owner operations manager, within 45 days.
  5. Approve a second supplier for each specialist service and test a continuity plan, owner operations manager, within 60 days.

Conclusion

Trustworthy consulting depends on a few steady habits: sourced analysis, independence checks, restricted client folders, clear change requests, structured handovers and approved suppliers. The highest scores sit with confidentiality, unsupported recommendations and reputational harm, and each has actions that bring the residual score down. Treat the register as a living record, review it on the stated cycle, and seek qualified legal and professional advice for any real client matter.

Assumptions and limitations

Assumptions

  • The firm is independent, has no parent organization and delivers advice under signed engagement letters.
  • Consultants are experienced graduates working on managed laptops with company-approved tools.
  • Jurisdiction is not specified, so legal and data protection duties are described in general terms and must be confirmed locally.

Limitations

  • The scores are examples for learning and do not describe any real firm, client or engagement.
  • Professional, legal and data protection duties vary by country and sector, so specialist review is needed.
  • This is educational content and is not legal, financial or professional advice.

Related frameworks to study

  • Enterprise risk management with likelihood and impact scoring
  • Three lines model of risk ownership
  • Hierarchy of controls
  • Engagement quality review process

Professional Risk Assessment

China, India, United States, Indonesia, Pakistan, Nigeria, Brazil, Bangladesh, Russia, Japan, Mexico, Philippines, Vietnam, Egypt, Turkey, Germany, United Kingdom, France, Italy, Canada, South Korea, Australia, Spain.

For Learning Reference Only: This assessment demonstrates how risk assessment principles are applied in a practical setting, providing a useful reference for learning and understanding. Actual assessments may be adapted to suit specific site conditions and circumstances.

Keep learning

Study the subject behind this assessment.

Business and Management Consulting course Read the best practices for this course

More Professional risk assessments

Hourly Active: 39,047 Learners