vaayaa Inclusive Education
Finance risk assessment

Investment Banking and Capital Markets Risk Assessment: Trading, Valuation and Control Risks

A worked example of how a deal and trading team finds, scores and controls the risks that threaten accurate transactions, sound valuations, market and counterparty exposure, and trust in capital markets activity.

Updated November 2026 8 hazards assessed Review every 6 months Highest risk: Critical to High
See the Investment Banking and Capital Markets course

Executive summary

This assessment shows how an investment banking and capital markets team can find, rate and control the risks that matter most to deals, trading and trust. Eight risks were chosen because they are plausible in advisory, underwriting and trading work. Market and liquidity exposure is the most serious inherent risk, while transaction errors and valuation misstatement are the most likely. Each risk is scored before controls and again after existing and added controls. Most risks fall to Medium or Low once the added controls are in place, but market exposure stays at High because a sharp move can cause losses faster than controls respond. The first actions are daily exception reports, liquidity based position limits, independent model review and a split of booking and approval rights. The team is a teaching example, so every score illustrates method, not a real organization.

Focus area
Investment banking and capital markets
Setting
Advisory, underwriting and trading activity of a mid-sized investment bank operating in capital markets
Method
Five by five likelihood and impact risk register

Scope

This assessment covers an investment banking team that advises on mergers and capital raising, underwrites new securities, and trades in a limited range of listed instruments. It covers deal processing, valuation, market and counterparty exposure, access controls, conduct, reporting and cyber risk. It does not cover any real institution or regulator. Jurisdiction, product range, systems and size are assumptions made for teaching only.

Context

The team has a managing director for coverage, analysts and associates who build valuation models, a trading desk that holds a small inventory of securities, and an operations group that settles trades and reconciles accounts. Deal documents and models are shared through a document system and spreadsheets, while trades are booked in a dedicated trading platform. A risk function sets limits, a compliance function monitors personal dealing and information barriers, and an external auditor reviews the accounts each year. Each risk is scored before controls to show its natural level, then again after existing controls and the additional controls proposed here.

Objectives, assets and stakeholders

The objective is to execute transactions accurately, value securities and mandates reliably, manage market and counterparty exposure within agreed limits, and keep the trust of clients, investors and regulators. The assets in scope are trading inventory, settlement cash, deal documents and valuation models, client data, the trading platform and the reputation of the team. Stakeholders include the deal and trading staff, the risk and compliance functions, senior management and the board, clients, counterparties, the external auditor and the relevant regulators. Clear roles matter: every risk has one owner role, and the risk function reports exposure and open actions to the board each quarter.

Risk matrix: before and after controls

Each cell shows hazard numbers placed by likelihood and impact. Compare the two grids to see how controls move each hazard.

Before controls

Inherent risk

Risk before controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely Likelihood 4, impact 4, score 16, high: H01 Likelihood 4, impact 5, score 20, critical: H03
3 Possible Likelihood 3, impact 3, score 9, medium: H07 Likelihood 3, impact 4, score 12, high: H02 H04 Likelihood 3, impact 5, score 15, high: H05
2 Unlikely Likelihood 2, impact 4, score 8, medium: H08 Likelihood 2, impact 5, score 10, high: H06
1 Rare

After controls

Residual risk

Risk after controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely
3 Possible Likelihood 3, impact 4, score 12, high: H03
2 Unlikely Likelihood 2, impact 2, score 4, low: H04 Likelihood 2, impact 3, score 6, medium: H01 H02 H05 H07
1 Rare Likelihood 1, impact 3, score 3, low: H08 Likelihood 1, impact 4, score 4, low: H06
  • Low 1 to 4
  • Medium 5 to 9
  • High 10 to 16
  • Critical 17 to 25

Hazard register

A summary first, then the detail for each hazard.

Summary of hazards with scores before and after controls
No.HazardBeforeAfterOwner
H01 Transaction processing and reconciliation errors 16 High 6 Medium Head of operations
H02 Valuation and forecasting misstatement 12 High 6 Medium Valuation control manager
H03 Market and liquidity exposure in trading inventory 20 Critical 12 High Treasury and market risk lead
H04 Counterparty and credit exposure 12 High 4 Low Credit risk officer
H05 Access control and segregation of duties 15 High 6 Medium IT manager
H06 Conflicts of interest, insider information and misconduct 10 High 4 Low Compliance officer
H07 Cyber attack and deal data leakage 9 Medium 6 Medium Chief information security officer
H08 Tax, reporting and regulatory governance failures 8 Medium 3 Low Head of regulatory reporting
H01

Transaction processing and reconciliation errors

Operational Before 16 After 6

Trade tickets, settlement instructions or deal fees are keyed incorrectly, booked to the wrong account or date, or left unmatched between the trading platform and the accounts, so positions and cash balances are wrong.

Who or what is affected: Operations staff, traders, clients and the finance team

Causes

Manual keying, high volume at period end and reliance on a few people who know the platform.

Consequences

Failed settlements, client claims, misstated positions and costly corrections.

Existing controls

  • Trades are matched to confirmations each morning.
  • Bookings above a set value need a second check by a supervisor.

Control gaps

Small bookings are not checked, and unmatched items can sit over a weekend without review.

Additional controls

  • Prevent: Use standard templates for settlement instructions and block free text fields for account details.
  • Detect: Run daily exception reports for unmatched, late or aged trades and escalate them the same day.
Likelihood 4 x impact 4 before; 2 x 3 after Owner: Head of operations Target: Within 45 days Early warning: Unmatched trades or settlement breaks older than two business days.
H02

Valuation and forecasting misstatement

Financial Before 12 After 6

Valuation models for transactions, fairness views or held securities rely on optimistic growth, discount rate or comparable assumptions that are not tested, so reported values and deal recommendations are overstated or understated.

Who or what is affected: Clients, deal committee members, investors and the finance team

Causes

Pressure to win mandates, reliance on one data source and assumptions that are rarely revisited.

Consequences

Poor advice, disputed valuations, client loss and regulatory attention.

Existing controls

  • Models are reviewed by a senior associate before release.
  • Key assumptions are recorded in the deal file.

Control gaps

Models are rarely reviewed by someone outside the deal team, so bias goes unseen.

Additional controls

  • Prevent: Require an independent review of model inputs and a sensitivity range before any valuation is shared.
  • Detect: Compare forecast outcomes with actual results each quarter and record the size of each difference.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Valuation control manager Target: Within 60 days Early warning: A valuation change above the usual range without a documented reason.
H03

Market and liquidity exposure in trading inventory

Financial Before 20 After 12

Positions held in the trading inventory lose value when prices move sharply, or cannot be sold quickly at a fair price, so losses grow beyond limits and funding for settlement becomes strained.

Who or what is affected: Shareholders, lenders, traders and the risk team

Causes

Concentrated holdings, thin markets and limits that are not linked to how quickly positions can be sold.

Consequences

Large trading losses, forced sales, capital strain and reputational harm.

Existing controls

  • Position limits are set by the risk function and checked daily.
  • Traders must report large positions before taking them.

Control gaps

Limits are checked only at the close of the day, so intraday moves are missed.

Additional controls

  • Prevent: Set liquidity based limits on each instrument and reduce any position that exceeds its exit capacity.
  • Respond: Agree a stop loss and an exit plan for each position before it is opened.
Likelihood 4 x impact 5 before; 3 x 4 after Owner: Treasury and market risk lead Target: Within 30 days Early warning: A position that is larger than the agreed exit capacity for its instrument.
H04

Counterparty and credit exposure

Financial Before 12 After 4

A client, bank or counterparty fails to pay, deliver securities or meet collateral calls, leaving the team with unpaid exposure or a failed trade that must be unwound at a loss.

Who or what is affected: Trading desk, finance team, shareholders and other counterparties

Causes

Concentration in a few counterparties, long settlement periods and slow review of changes in their position.

Consequences

Unrecovered amounts, write-offs, failed settlements and funding pressure.

Existing controls

  • Counterparties are approved by a credit committee.
  • Collateral is called when exposure passes an agreed threshold.

Control gaps

Exposure to indirect counterparties is not added up, so hidden concentrations go unnoticed.

Additional controls

  • Prevent: Set counterparty limits by name and review them after every change in rating or news.
  • Detect: Report exposure to each counterparty daily and flag any that approach the limit.
Likelihood 3 x impact 4 before; 2 x 2 after Owner: Credit risk officer Target: Within 45 days Early warning: Exposure to one counterparty that exceeds its limit or rises sharply in a week.
H05

Access control and segregation of duties

Technology and data Before 15 After 6

One person can create a counterparty, book a trade and release a payment, or holds wider access to the trading platform than the role needs, so errors and misuse go unseen.

Who or what is affected: Operations staff, traders, finance team and clients

Causes

Small teams, shared logins and rights that are added during busy periods and never removed.

Consequences

Undetected error or misuse, loss of funds and failed audit findings.

Existing controls

  • Users sign in with individual accounts.
  • Payments above a set limit need a second approval.

Control gaps

Access rights are reviewed only when someone leaves the team.

Additional controls

  • Prevent: Map roles to permissions and remove any combination that lets one person book and approve a payment.
  • Recover: Keep a tested process to revoke access and reverse unauthorised entries within one day.
Likelihood 3 x impact 5 before; 2 x 3 after Owner: IT manager Target: Within 30 days Early warning: A user who holds both booking and approval rights for the same type of payment.
H06

Conflicts of interest, insider information and misconduct

Reputational Before 10 After 4

Staff trade on material non-public information, share deal details with connected parties, or favour a client or personal interest, and misappropriate funds or records, which weakens market integrity and trust.

Who or what is affected: Clients, investors, colleagues and the wider market

Causes

Access to sensitive information, personal financial pressure and unclear rules on gifts and hospitality.

Consequences

Enforcement action, loss of client trust, disciplinary action and damage to the firm's standing.

Existing controls

  • A code of conduct is signed each year.
  • Staff declare outside interests and holdings when they join.

Control gaps

Declarations are collected but not compared with current deals or restricted lists.

Additional controls

  • Prevent: Keep restricted lists and wall off deal teams, and check personal dealing against them before each trade.
  • Detect: Review personal trading and communication records for unusual timing around announced deals.
  • Respond: Provide a confidential route to raise concerns and record how each one was handled.
Likelihood 2 x impact 5 before; 1 x 4 after Owner: Compliance officer Target: Within 30 days Early warning: Personal trades in a security shortly before a related deal is announced.
H07

Cyber attack and deal data leakage

Technology and data Before 9 After 6

Phishing, weak passwords or unprotected spreadsheets expose confidential deal documents, client data and valuation models, and attackers may use stolen details to alter payment instructions.

Who or what is affected: Clients, deal teams, suppliers and the public markets

Causes

Phishing, reused passwords and files copied to personal devices.

Consequences

Leaked deal details, false payment instructions, client claims and regulatory notice.

Existing controls

  • Document systems need a password and are backed up daily.
  • Staff are told not to share deal files through public links.

Control gaps

Spreadsheets holding valuation inputs sit outside the document access controls.

Additional controls

  • Prevent: Enable multi-factor sign in and restrict deal folders to named members of each team.
  • Respond: Keep a written incident plan that covers client notice, regulator contact and system isolation.
Likelihood 3 x impact 3 before; 2 x 3 after Owner: Chief information security officer Target: Within 30 days Early warning: Repeated phishing reports or a change to payment instructions received by email alone.
H08

Tax, reporting and regulatory governance failures

Legal and compliance Before 8 After 3

Regulatory returns, tax treatments or disclosures are missed or misapplied, and the board or senior management does not receive the information needed to oversee the business.

Who or what is affected: Senior management, the board, regulators and investors

Causes

Rules that differ by jurisdiction, a small team and filings prepared close to the deadline.

Consequences

Penalties, restated results, reputational harm and loss of supervisor confidence.

Existing controls

  • A calendar lists the main filing dates.
  • Management information is shared with the board each quarter.

Control gaps

Jurisdiction is assumed, and no one confirms current rules before a filing.

Additional controls

  • Detect: Ask a qualified reviewer to test a sample of filings against the rules that apply each year.
  • Prevent: Keep a compliance calendar with a named owner and a backup owner for every duty.
Likelihood 2 x impact 4 before; 1 x 3 after Owner: Head of regulatory reporting Target: Within 60 days Early warning: A filing due within ten days that has no preparer or reviewer named.

Rating method and evaluation

Each risk is rated on two five-point scales. Likelihood runs from Rare to Almost certain, and impact runs from Insignificant to Catastrophic. Multiplying the two gives a score from 1 to 25, which falls into one of four bands: Low from 1 to 4, Medium from 5 to 9, High from 10 to 16 and Critical from 17 to 25. The score is a guide for ordering work, not a precise measurement. Inherent risk is the score before any controls. Residual risk is the score after existing and added controls, and it must never be higher than the inherent score. Impact is judged on money lost, time to correct, the effect on reported results, client harm and damage to market trust. A risk is never rated down only because it has not yet happened. Anything Critical or High needs senior attention and a dated plan, anything Medium needs routine controls with a named owner, and anything Low is accepted and watched. Owners and staff who do the work should challenge every rating, and each rating is reviewed whenever an indicator reaches its threshold or the business changes.

Likelihood, impact and rating bands

Likelihood

  • 5 Almost certain: Expected to happen in most circumstances.
  • 4 Likely: Will probably happen in many circumstances.
  • 3 Possible: Could happen at some time.
  • 2 Unlikely: Not expected, but it could happen.
  • 1 Rare: Only in exceptional circumstances.

Impact

  • 1 Insignificant: No lasting effect. Handled within routine work.
  • 2 Minor: Small effect that is quickly corrected.
  • 3 Moderate: Noticeable effect that needs managed effort to correct.
  • 4 Major: Serious effect on people, delivery or reputation.
  • 5 Catastrophic: Severe or lasting effect that threatens the whole activity.

Bands (likelihood x impact)

  • Low (1 to 4): Accept and monitor.
  • Medium (5 to 9): Manage with routine controls.
  • High (10 to 16): Senior attention and a treatment plan.
  • Critical (17 to 25): Act first. Do not proceed until reduced.

Monitoring, escalation and review

Review this assessment every 6 months, and sooner when an indicator below reaches its threshold.

Early-warning indicators and escalation thresholds
Indicator to watchEscalate when
Unmatched trades or settlement breaks older than two business days.Escalate to the head of operations when any break is older than two business days, and to the chief operating officer after five days.
Positions larger than the agreed exit capacity for their instrument.Escalate to the treasury and market risk lead at once, and to the risk committee if the position is not reduced within one day.
Users who hold both booking and approval rights for the same payment type.Escalate to the IT manager when any such user is found, and remove one right within a week.
Personal trades in a security shortly before a related deal is announced.Escalate to the compliance officer at once, and hold further personal dealing in that security until the review is complete.
Valuation changes above the usual range without a documented reason.Escalate to the valuation control manager before the figure is shared, and to the deal committee if the change affects a live mandate.

Contingency arrangements

If a serious event occurs, such as a large trading loss, a failed settlement, a confirmed misuse of information or a suspected cyber intrusion, the head of trading stops new positions in the affected area and the head of operations freezes related payments. The IT manager isolates affected accounts and restores records from the latest tested backup. Compliance and legal contacts are made through the head of the business as required in the relevant jurisdiction. Funding is protected by a standby plan, and clients and counterparties are told what they need to know early and plainly.

Prioritized action plan

  1. Introduce daily matching of trades and a same day exception review, owner head of operations, within 30 days.
  2. Set liquidity based position limits and intraday checks for the trading inventory, owner treasury and market risk lead, within 30 days.
  3. Split booking and approval rights and review user access each quarter, owner IT manager, within 30 days.
  4. Require independent review of valuation models and a sensitivity range before release, owner valuation control manager, within 60 days.
  5. Maintain restricted lists, personal dealing checks and a compliance calendar with backup owners, owner compliance officer, within 30 days.

Conclusion

Sound capital markets work depends on a few steady habits: daily matching of trades, liquidity aware limits, independent review of valuations, split duties, restricted information lists and a calendar for each filing. The highest scores sit with market exposure, transaction errors and valuation risk, and each has actions that bring the residual score down. Treat the register as a living record, review it on the stated cycle, and seek qualified advice for any real trading, valuation, tax or regulatory question.

Assumptions and limitations

Assumptions

  • The team operates under one national regulatory regime, which is not named, and is subject to an annual external audit.
  • Staff are trained professionals who use managed computers and approved trading and document systems.
  • Trading is limited to listed instruments and a small inventory, with no complex derivatives assumed.

Limitations

  • The scores are examples for learning and do not describe any real bank, deal or market.
  • Capital markets rules, prudential requirements and accounting standards vary by jurisdiction and change over time, so specialist review is needed.
  • This is educational content and is not investment, legal, tax or regulatory advice.

Related frameworks to study

  • Three lines model of risk ownership
  • Internal control framework with control activities and monitoring
  • Hierarchy of controls
  • Risk register with inherent and residual scoring

Finance Risk Assessment

China, India, United States, Indonesia, Pakistan, Nigeria, Brazil, Bangladesh, Russia, Japan, Mexico, Philippines, Vietnam, Egypt, Turkey, Germany, United Kingdom, France, Italy, Canada, South Korea, Australia, Spain.

For Learning Reference Only: This assessment demonstrates how risk assessment principles are applied in a practical setting, providing a useful reference for learning and understanding. Actual assessments may be adapted to suit specific site conditions and circumstances.

Keep learning

Study the subject behind this assessment.

Investment Banking and Capital Markets course Read the best practices for this course

More Finance risk assessments

Hourly Active: 45,552 Learners