vaayaa Inclusive Education
Finance risk assessment

Investment Banking Analysis Risk Assessment: Valuation, Transaction and Conduct Controls

A worked example of how an investment banking analysis team finds, scores and controls risks in valuation models, deal processing, market exposure, confidential data and professional conduct.

Updated November 2026 8 hazards assessed Review every 6 months Highest risk: Critical to Medium
See the Investment Banking Analysis course

Executive summary

This assessment shows how an investment banking analysis team can find, rate and control the risks that matter most to valuation accuracy, transaction processing, confidential information and professional conduct. Eight risks were chosen because they are plausible in everyday deal work. Valuation errors, confidential information leaks and settlement mistakes carry the highest inherent scores, while conflicts and conduct failures carry serious consequences even when less likely. Each risk is scored before controls and again after existing and added controls. Most fall to Medium or Low once controls are in place, but cyber exposure stays at Medium because the impact stays serious. The first actions are an independent model review, a daily reconciliation routine, restricted deal data access and a conflicts check before each mandate. The team is a teaching example, so every score illustrates method, not a real organization.

Focus area
Investment banking analysis and transaction advisory
Setting
Analyst team supporting deal origination, valuation and transaction execution at a mid-sized advisory bank
Method
Five by five likelihood and impact risk register

Scope

This assessment covers an analyst team that builds valuation models, prepares pitch and deal materials, processes transactions and supports client work through closing. It looks at risks to accuracy, client funds, confidential information, legal duties and trust. Jurisdiction, deal size, systems and market conditions are assumed for teaching and are not stated in the brief.

Context

The team has a managing director sponsor, vice presidents who review models, analysts who build them, a middle office that settles and reconciles transactions, and an IT group that runs the deal and data systems. Models sit in spreadsheets linked to market data feeds and shared drives. Deals move from pitch to signing to closing, with each stage carrying different data and approval steps. Each risk is scored before controls to show its natural level, then again after existing controls and proposed additional controls.

Objectives, assets and stakeholders

The objective is to produce accurate valuations and analysis, process transactions correctly, protect client information and funds, meet professional and disclosure duties, and keep the trust of clients, colleagues and regulators. Assets in scope include valuation models, deal data and pitch materials, client confidential information, market data licences, transaction cash and settlement records, and the reputation of the team. Stakeholders include clients, deal teams, senior management, the compliance function, the middle office, external auditors, regulators and counterparties. Every risk has one owner role, and the managing director sponsor reviews the register each quarter with the compliance officer.

Risk matrix: before and after controls

Each cell shows hazard numbers placed by likelihood and impact. Compare the two grids to see how controls move each hazard.

Before controls

Inherent risk

Risk before controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely Likelihood 4, impact 3, score 12, high: H02 Likelihood 4, impact 4, score 16, high: H01 Likelihood 4, impact 5, score 20, critical: H06
3 Possible Likelihood 3, impact 3, score 9, medium: H08 Likelihood 3, impact 4, score 12, high: H05 Likelihood 3, impact 5, score 15, high: H03
2 Unlikely Likelihood 2, impact 4, score 8, medium: H04 Likelihood 2, impact 5, score 10, high: H07
1 Rare

After controls

Residual risk

Risk after controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely
3 Possible
2 Unlikely Likelihood 2, impact 2, score 4, low: H08 Likelihood 2, impact 3, score 6, medium: H01 H02 H05 Likelihood 2, impact 4, score 8, medium: H03 H06
1 Rare Likelihood 1, impact 3, score 3, low: H04 Likelihood 1, impact 4, score 4, low: H07
  • Low 1 to 4
  • Medium 5 to 9
  • High 10 to 16
  • Critical 17 to 25

Hazard register

A summary first, then the detail for each hazard.

Summary of hazards with scores before and after controls
No.HazardBeforeAfterOwner
H01 Valuation and forecasting model error 16 High 6 Medium Vice president valuation
H02 Transaction processing and reconciliation errors 12 High 6 Medium Middle office lead
H03 Market and counterparty exposure during deal work 15 High 8 Medium Risk manager
H04 Liquidity and funding shortfall before closing 8 Medium 3 Low Treasury lead
H05 Access control and segregation of duties on deal data 12 High 6 Medium IT manager
H06 Confidential information leakage and cyber intrusion 20 Critical 8 Medium Information security lead
H07 Conflicts of interest, insider information and misconduct 10 High 4 Low Compliance officer
H08 Tax, reporting and disclosure errors in pitch materials 9 Medium 4 Low Deal compliance lead
H01

Valuation and forecasting model error

Strategic Before 16 After 6

Formula errors, broken links or optimistic assumptions in valuation and forecast models produce figures that a client or committee relies on, leading to a wrong price or decision.

Who or what is affected: Clients, deal teams and investment committees

Causes

Complex formulas, manual links to data and pressure to meet a pitch deadline.

Consequences

Mispriced deals, client loss, professional claims and damage to the team's reputation.

Existing controls

  • Models are built from a standard template with input checks.
  • A vice president reviews the final output before it is shared.

Control gaps

Review checks the output but not the underlying links or assumptions behind it.

Additional controls

  • Prevent: Require an independent model review against a checklist before any output reaches a client.
  • Detect: Compare model outputs with a second build and flag differences above an agreed tolerance.
Likelihood 4 x impact 4 before; 2 x 3 after Owner: Vice president valuation Target: Within 45 days Early warning: Model changes made after review sign-off without a new review record.
H02

Transaction processing and reconciliation errors

Operational Before 12 After 6

Settlement instructions, trade details or payment amounts are keyed or copied wrongly, and breaks between the deal record and the middle office record are not found in time, so cash moves incorrectly.

Who or what is affected: Middle office, clients and counterparties

Causes

Manual entry, time pressure at closing and instructions sent by email.

Consequences

Failed settlement, late payments, fees and client complaints.

Existing controls

  • Trades are matched to confirmations on the day.
  • Settlement instructions are checked by a second person.

Control gaps

Breaks are logged but not always traced to a root cause.

Additional controls

  • Prevent: Use standard instruction templates and lock fields that should not change after approval.
  • Detect: Reconcile settled transactions to the middle office record each day and log every break.
Likelihood 4 x impact 3 before; 2 x 3 after Owner: Middle office lead Target: Within 30 days Early warning: Unreconciled settlement items older than five working days.
H03

Market and counterparty exposure during deal work

Financial Before 15 After 8

Hedges, bridge loans or payment obligations taken on during a deal expose the bank to price moves and to a counterparty that may fail to pay, and the exposure grows faster than limits are checked.

Who or what is affected: Bank, clients and counterparties

Causes

Price moves, concentration in a few counterparties and hedges that are not updated.

Consequences

Losses on positions, failed hedges and credit losses on unpaid amounts.

Existing controls

  • Counterparty limits are set for each approved name.
  • Positions are marked to market at month end.

Control gaps

Limits are reviewed monthly, so a fast market move can exceed them for several days.

Additional controls

  • Prevent: Check every new counterparty against approved limits before a hedge or payment is agreed.
  • Detect: Report exposure daily against limits and flag any breach to the risk manager.
Likelihood 3 x impact 5 before; 2 x 4 after Owner: Risk manager Target: Within 60 days Early warning: Exposure above the agreed limit for two consecutive days.
H04

Liquidity and funding shortfall before closing

Financial Before 8 After 3

Client payments arrive late, fees fall due early or a financing condition is not met, and the deal cannot pay its obligations on the agreed closing date.

Who or what is affected: Deal team, clients and funding providers

Causes

Delayed client payments, unexpected fees and a financing condition that is not met on time.

Consequences

Missed closing date, penalty fees and damage to the client relationship.

Existing controls

  • A cash forecast is updated each week.
  • Committed facilities are reviewed each quarter.

Control gaps

The forecast is checked against actual cash only once a month.

Additional controls

  • Respond: Agree a standby funding route and a contact order for a closing shortfall.
  • Recover: Record lessons from any delayed closing and update the forecast template.
Likelihood 2 x impact 4 before; 1 x 3 after Owner: Treasury lead Target: Within 60 days Early warning: Forecast cash headroom below the agreed floor in a closing week.
H05

Access control and segregation of duties on deal data

Technology and data Before 12 After 6

Users keep access to deal folders after moving teams or leaving, or can both edit and approve figures, so improper viewing or changes go unseen.

Who or what is affected: Deal teams, clients and the IT team

Causes

Shared folders, rights that are added and never removed, and fast deal staffing.

Consequences

Improper access to deal data, insider information concerns and a breach of client trust.

Existing controls

  • Users sign in with individual accounts.
  • Deal folders are created by the IT group on request.

Control gaps

Access is reviewed only at deal close, so leavers may keep rights during a live deal.

Additional controls

  • Prevent: Assign access by deal team and remove any user who has left or changed roles.
  • Detect: Review access logs for each deal folder at each stage and record the outcome.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: IT manager Target: Within 30 days Early warning: A user with access to a deal folder outside their assigned team.
H06

Confidential information leakage and cyber intrusion

Technology and data Before 20 After 8

Phishing, reused passwords or documents copied to personal devices expose price-sensitive deal information to people outside the mandate, and the leak may move markets or harm a client.

Who or what is affected: Clients, deal teams and the wider market

Causes

Phishing, reused passwords and documents sent to personal devices or removable media.

Consequences

Leak of price-sensitive information, client claims and regulatory scrutiny.

Existing controls

  • Files are encrypted at rest and in transit.
  • Staff complete a security awareness session each year.

Control gaps

Deal documents are copied to laptops and removable media without a log.

Additional controls

  • Prevent: Enable multi-factor sign in and block personal email for deal files.
  • Respond: Isolate affected accounts and notify the compliance officer at once.
  • Recover: Test restoring deal files from a backup each quarter and record the result.
Likelihood 4 x impact 5 before; 2 x 4 after Owner: Information security lead Target: Within 30 days Early warning: Repeated phishing reports from deal team mailboxes in one month.
H07

Conflicts of interest, insider information and misconduct

Reputational Before 10 After 4

A team member holds a personal stake in a company being valued, or shares deal information informally to win a mandate, which weakens independence and trust in the bank.

Who or what is affected: Clients, colleagues and the bank

Causes

Personal interests in a company being valued, pressure to win mandates and informal sharing of information.

Consequences

Loss of client trust, disciplinary action and regulatory scrutiny.

Existing controls

  • Staff sign a code of conduct each year.
  • Personal trading must be pre-cleared by compliance.

Control gaps

Declarations are collected but not compared with live mandates.

Additional controls

  • Prevent: Run a conflicts and restricted list check before each mandate is accepted.
  • Respond: Provide a confidential route to report concerns and record how each one was handled.
Likelihood 2 x impact 5 before; 1 x 4 after Owner: Compliance officer Target: Within 60 days Early warning: A mandate accepted without a completed conflicts check on file.
H08

Tax, reporting and disclosure errors in pitch materials

Legal and compliance Before 9 After 4

Figures, tax treatments or disclosure statements in pitch and deal materials are copied from an outdated source or misapplied, so a client receives material that is misleading.

Who or what is affected: Clients, management and auditors

Causes

Rules that differ by country, last minute changes to figures and reused slide content.

Consequences

Misleading materials, restated figures, penalties and loss of trust.

Existing controls

  • A checklist lists the main disclosure dates and required statements.
  • Deal materials are reviewed by a second person before issue.

Control gaps

The checklist is not tied to the specific deal jurisdiction or to the current version of each figure.

Additional controls

  • Detect: Compare the figures in each pitch with the model and source data after final review.
  • Prevent: Keep a compliance calendar with an owner and a backup for each disclosure duty.
Likelihood 3 x impact 3 before; 2 x 2 after Owner: Deal compliance lead Target: Within 30 days Early warning: Figures in a pitch that differ from the model after final review.

Rating method and evaluation

Each risk is rated on two five-point scales. Likelihood runs from Rare to Almost certain, and impact runs from Insignificant to Catastrophic. Multiplying the two gives a score from 1 to 25, which falls into one of four bands: Low from 1 to 4, Medium from 5 to 9, High from 10 to 16 and Critical from 17 to 25. The score orders work and is not a measurement. Inherent risk is the score before any controls. Residual risk is the score after existing and added controls, and it must never be higher than the inherent score. Impact is judged on client loss, financial misstatement, legal exposure, time to correct and harm to reputation. A risk is never rated down only because it has not happened yet. Anything still High needs senior attention and a dated plan, anything Medium needs routine controls with a named owner, and anything Low is accepted and watched. Analysts, reviewers and the compliance function should challenge each rating, and the register is reviewed early whenever a monitoring indicator reaches its threshold.

Likelihood, impact and rating bands

Likelihood

  • 5 Almost certain: Expected to happen in most circumstances.
  • 4 Likely: Will probably happen in many circumstances.
  • 3 Possible: Could happen at some time.
  • 2 Unlikely: Not expected, but it could happen.
  • 1 Rare: Only in exceptional circumstances.

Impact

  • 1 Insignificant: No lasting effect. Handled within routine work.
  • 2 Minor: Small effect that is quickly corrected.
  • 3 Moderate: Noticeable effect that needs managed effort to correct.
  • 4 Major: Serious effect on people, delivery or reputation.
  • 5 Catastrophic: Severe or lasting effect that threatens the whole activity.

Bands (likelihood x impact)

  • Low (1 to 4): Accept and monitor.
  • Medium (5 to 9): Manage with routine controls.
  • High (10 to 16): Senior attention and a treatment plan.
  • Critical (17 to 25): Act first. Do not proceed until reduced.

Monitoring, escalation and review

Review this assessment every 6 months, and sooner when an indicator below reaches its threshold.

Early-warning indicators and escalation thresholds
Indicator to watchEscalate when
Valuation model changes made after independent review sign-off.Escalate to the vice president valuation at once, and hold the output until the change is reviewed.
Unreconciled settlement items older than five working days.Escalate to the middle office lead when any item is older than five working days, and to the managing director after ten.
Users with access to deal folders outside their assigned deal team.Escalate to the IT manager when such access is found, and remove it within two working days.
Mandates accepted without a completed conflicts check.Escalate to the compliance officer immediately, and pause further client work until the check is completed.
Counterparty or market exposure above the agreed limit for two consecutive days.Escalate to the risk manager on the first breach, and to the chief risk officer if the breach continues for a further day.

Contingency arrangements

If a serious event occurs, such as a model error found after a client has relied on it, a suspected leak of deal information or a failed settlement, the deal lead pauses related work and informs the compliance officer and managing director. The IT manager isolates affected systems and restores data from the latest tested backup. Legal and regulatory contacts are made through the compliance officer as required in the relevant jurisdiction. Clients are told early, plainly and accurately, and a corrected valuation is issued with a clear note of what changed.

Prioritized action plan

  1. Introduce independent review of every valuation model before it leaves the team, owner vice president valuation, within 45 days.
  2. Restrict deal data folders to named deal members and review access each quarter, owner IT manager, within 30 days.
  3. Run a daily reconciliation of every settled transaction against the middle office record, owner middle office lead, within 30 days.
  4. Require a conflicts and restricted list check before each new mandate is accepted, owner compliance officer, within 30 days.
  5. Set up a counterparty and market exposure limit with a daily report, owner risk manager, within 60 days.

Conclusion

Sound analysis depends on a few steady habits: independent model review, daily reconciliations, restricted deal data, conflicts checks before each mandate and clear sign-off at each deal stage. The highest scores sit with valuation errors, confidential information leaks and settlement mistakes, and each has actions that bring the residual score down. Treat the register as a living record, review it on the stated cycle, and seek qualified advice for any real valuation, legal, tax or regulatory question.

Assumptions and limitations

Assumptions

  • The team advises on public and private transactions under one recognized set of professional rules, with jurisdiction not specified.
  • Analysts use common spreadsheet and market data tools on managed computers with restricted shared drives.
  • Deal sizes and counterparties are illustrative and do not describe any real transaction.

Limitations

  • The scores are examples for learning and do not describe any real bank, deal or market.
  • Securities, banking, tax and conduct rules differ by country and change over time, so specialist review is needed.
  • This is educational content and is not investment, legal, tax or regulatory advice.

Related frameworks to study

  • Three lines model of risk ownership
  • Model risk governance with independent review
  • Hierarchy of controls
  • Internal control framework with control activities and monitoring

Finance Risk Assessment

China, India, United States, Indonesia, Pakistan, Nigeria, Brazil, Bangladesh, Russia, Japan, Mexico, Philippines, Vietnam, Egypt, Turkey, Germany, United Kingdom, France, Italy, Canada, South Korea, Australia, Spain.

For Learning Reference Only: This assessment demonstrates how risk assessment principles are applied in a practical setting, providing a useful reference for learning and understanding. Actual assessments may be adapted to suit specific site conditions and circumstances.

Keep learning

Study the subject behind this assessment.

Investment Banking Analysis course Read the best practices for this course

More Finance risk assessments

Hourly Active: 45,552 Learners