vaayaa Inclusive Education
Professional risk assessment

Real Estate and Property Management Risk Assessment: Safety, Service and Financial Controls

A worked example of how a property management team finds, scores and controls risks to tenants, buildings, rent income, records and reputation across a mixed residential and commercial portfolio.

Updated November 2026 8 hazards assessed Review every 6 months Highest risk: Critical to Medium
See the Real Estate and Property Management course

Executive summary

This assessment shows how a small property management team can find, rate and control the risks that matter most to tenants, buildings, income and reputation. Eight risks were chosen because they are plausible in everyday letting, maintenance and tenant work. Building safety check failures carry the highest inherent score because harm to people can be serious and permanent. Most risks fall to Medium or Low once existing and added controls are in place, but building safety remains High because a missed check can still cause injury. The first actions are a dated safety check calendar, a contractor verification step, a handover checklist for managers and a tested backup of the lettings records. Every score illustrates method rather than a real organization, and the team should seek qualified advice for any real safety or legal matter.

Focus area
Real estate and property management
Setting
Property management team for a mixed residential and commercial portfolio of rented buildings
Method
Five by five likelihood and impact risk register

Scope

This assessment covers the day to day management of rented residential and commercial buildings, including leasing, rent collection, repairs, safety checks, contractors, tenant communication and records. It does not cover property purchase, valuation or investment advice. Jurisdiction, building age, tenure type and systems are not specified, so they are treated as assumptions for teaching.

Context

The example team has a property manager, two leasing officers, a maintenance coordinator, an accounts assistant and an IT support contact. Tenants report faults through an online form and by phone. Rent is collected by bank transfer and a card portal, with spreadsheets used for arrears tracking. Contractors carry out repairs under short agreements. Each risk is scored before controls to show its natural level, then again after existing and added controls.

Objectives, assets and stakeholders

The objective is to keep tenants safe and housed, keep buildings compliant and in good repair, collect rent accurately, and protect the trust of owners and residents. The assets in scope are the buildings and common areas, rent and deposit accounts, tenancy and maintenance records, contractor relationships and tenant personal data. Stakeholders include tenants, owners, contractors, the accounts team, local authorities and insurers. Every risk has one owner role, and the property manager reviews the register with the owner each quarter and after any serious incident.

Risk matrix: before and after controls

Each cell shows hazard numbers placed by likelihood and impact. Compare the two grids to see how controls move each hazard.

Before controls

Inherent risk

Risk before controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely Likelihood 4, impact 3, score 12, high: H03 Likelihood 4, impact 5, score 20, critical: H01
3 Possible Likelihood 3, impact 3, score 9, medium: H04 H06 Likelihood 3, impact 4, score 12, high: H02 H05 H07
2 Unlikely Likelihood 2, impact 3, score 6, medium: H08
1 Rare

After controls

Residual risk

Risk after controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely
3 Possible Likelihood 3, impact 2, score 6, medium: H03
2 Unlikely Likelihood 2, impact 2, score 4, low: H04 H06 Likelihood 2, impact 3, score 6, medium: H02 H05 H07 Likelihood 2, impact 4, score 8, medium: H01
1 Rare Likelihood 1, impact 3, score 3, low: H08
  • Low 1 to 4
  • Medium 5 to 9
  • High 10 to 16
  • Critical 17 to 25

Hazard register

A summary first, then the detail for each hazard.

Summary of hazards with scores before and after controls
No.HazardBeforeAfterOwner
H01 Building safety check failure 20 Critical 8 Medium Property manager
H02 Tenancy agreement and legal compliance error 12 High 6 Medium Leasing manager
H03 Maintenance backlog and service interruption 12 High 6 Medium Maintenance coordinator
H04 Rent collection and financial leakage 9 Medium 4 Low Accounts assistant
H05 Contractor competence and supplier dependency 12 High 6 Medium Maintenance coordinator
H06 Handover failure between property managers 9 Medium 4 Low Property manager
H07 Technology outage and tenant data loss 12 High 6 Medium IT support contact
H08 Poor complaint handling and reputational harm 6 Medium 3 Low Property manager
H01

Building safety check failure

Safety Before 20 After 8

Required safety checks for gas, electrics, lifts, fire systems or water are missed, late or poorly recorded, so a hazard goes unseen in a let building.

Who or what is affected: Tenants, visitors, contractors and neighbors

Causes

Calendar held in a spreadsheet, reliance on one person and contractors whose qualifications are not confirmed.

Consequences

Injury or death, enforcement action, insurance dispute and loss of tenant trust.

Existing controls

  • Gas and electrical checks are booked each year by the maintenance coordinator.
  • Fire alarms are tested by a contractor on a monthly schedule.

Control gaps

Checks are recorded, but nobody confirms that defects found were fixed.

Additional controls

  • Prevent: Keep a single safety calendar with a named qualified contractor and a backup for each check.
  • Detect: Review check records monthly and inspect common areas after each contractor visit.
  • Respond: Isolate any unsafe system at once and inform tenants and the qualified engineer the same day.
Likelihood 4 x impact 5 before; 2 x 4 after Owner: Property manager Target: Within 30 days Early warning: Safety checks overdue by more than 7 days on any building.
H02

Tenancy agreement and legal compliance error

Legal and compliance Before 12 After 6

Tenancy terms, deposit handling, notice periods or entry rights are wrong or out of date, so the team acts unlawfully or cannot enforce a lease.

Who or what is affected: Tenants, owners and staff

Causes

Templates copied from old files and local rules that change without notice.

Consequences

Unlawful action, claims, fines, lost rent and damaged reputation.

Existing controls

  • Standard agreement templates are reviewed each year by a legal adviser.
  • Deposits are recorded and held as the agreement states.

Control gaps

Templates are not checked when local rules change, and no one tracks updates.

Additional controls

  • Prevent: Check each agreement against a template checklist before the tenant signs.
  • Respond: Stop any eviction or deposit step and take legal advice before acting.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Leasing manager Target: Within 60 days Early warning: A tenancy file missing a signed agreement or a dated notice.
H03

Maintenance backlog and service interruption

Operational Before 12 After 6

Repairs queue for weeks, heating, water or lifts fail in cold weather, and tenants lose use of their home for longer than the agreement allows.

Who or what is affected: Tenants, neighbors and maintenance staff

Causes

Few contractors, no spare capacity and seasonal peaks in demand.

Consequences

Tenant distress, complaints, rent withheld and a poor record with owners.

Existing controls

  • Repairs are logged in a shared spreadsheet with a priority code.
  • Emergency repairs are passed to an on call contractor after hours.

Control gaps

Priority codes are applied inconsistently, and nobody checks the list against agreed times.

Additional controls

  • Prevent: Set response times by priority and agree them with two contractors in writing.
  • Detect: Review the open repair list each week and flag any item older than the agreed time.
  • Recover: Offer temporary heating or alternative accommodation and record the cost.
Likelihood 4 x impact 3 before; 3 x 2 after Owner: Maintenance coordinator Target: Within 45 days Early warning: Repair requests open for more than 28 days without a scheduled visit.
H04

Rent collection and financial leakage

Financial Before 9 After 4

Rent is missed, arrears grow unseen, deposits are misallocated or payments are diverted through false bank details, so income falls short of what is due.

Who or what is affected: Owners, accounts staff and tenants

Causes

Late payment, unclear ledgers and changes to payee details requested by email.

Consequences

Lost income, unpaid bills, write-offs and loss of owner confidence.

Existing controls

  • Rent is due by bank transfer on a fixed day each month.
  • Arrears are listed in a monthly report to the property manager.

Control gaps

Ledger matching is monthly, so small gaps build up before anyone checks.

Additional controls

  • Prevent: Confirm all payee bank detail changes by call back to a known contact.
  • Detect: Match rent and deposit receipts to the tenancy ledger each week.
Likelihood 3 x impact 3 before; 2 x 2 after Owner: Accounts assistant Target: Within 30 days Early warning: Rent arrears above one month for any tenancy.
H05

Contractor competence and supplier dependency

Supplier Before 12 After 6

A contractor lacks insurance, qualification or capacity, or a single supplier fails, so work is unsafe, delayed or left unfinished.

Who or what is affected: Tenants, contractors' staff and owners

Causes

Reliance on one supplier, low rates and urgent jobs given out without checks.

Consequences

Injury, failed work, extra cost and delays in letting empty units.

Existing controls

  • Contractors give written quotes and a copy of their public liability cover.
  • Major works are signed off by the property manager.

Control gaps

Insurance certificates are filed but not checked for expiry dates.

Additional controls

  • Prevent: Check insurance, qualification and references for each contractor before any work starts.
  • Respond: Keep a list of two backup contractors for each trade and invoke it when a supplier fails.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Maintenance coordinator Target: Within 45 days Early warning: Contractor insurance certificate expiring within 30 days with no renewal on file.
H06

Handover failure between property managers

People Before 9 After 4

Keys, tenancy files, open repairs and tenant promises are not passed on when a manager leaves or changes role, so commitments are lost.

Who or what is affected: Tenants, staff and owners

Causes

Short notice departures, personal task lists and no shared system of record.

Consequences

Missed repairs, duplicate keys, lost trust and broken promises to tenants.

Existing controls

  • Managers keep a personal list of open tasks.
  • Keys are recorded in a register kept by reception.

Control gaps

Handovers are verbal, and nobody checks the files afterwards.

Additional controls

  • Prevent: Use a handover checklist covering keys, files, open repairs and tenant promises.
  • Detect: Audit a sample of files after each handover and record any gaps.
  • Recover: Contact affected tenants within two working days to confirm open commitments.
Likelihood 3 x impact 3 before; 2 x 2 after Owner: Property manager Target: Within 45 days Early warning: Open repairs or key records with no named owner after a staff change.
H07

Technology outage and tenant data loss

Technology and data Before 12 After 6

Lettings, rent or maintenance systems fail or are attacked, and tenant personal data is lost, exposed or cannot be used to run the portfolio.

Who or what is affected: Tenants, owners, staff and payment partners

Causes

Phishing, shared logins and reliance on one cloud provider.

Consequences

Lost records, missed rent, data protection action and distress for tenants.

Existing controls

  • Records are backed up each night to a separate location.
  • Staff accounts need a password and are removed when they leave.

Control gaps

The restore process has never been tested, and spreadsheets holding tenant data sit outside access controls.

Additional controls

  • Prevent: Enable multi-factor sign in for all staff and limit access to tenant files by role.
  • Recover: Test a full restore each quarter and keep a printed list of key tenant contacts.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: IT support contact Target: Within 30 days Early warning: Repeated phishing reports from staff or a backup job that fails twice in one week.
H08

Poor complaint handling and reputational harm

Reputational Before 6 After 3

Tenant complaints are ignored, answered slowly or handled inconsistently, so disputes escalate to public reviews, legal claims or reports to local authorities.

Who or what is affected: Tenants, owners and staff

Causes

Poor record keeping, high workload and unclear rules on how to respond.

Consequences

Public complaints, lost tenants, dispute costs and owner dissatisfaction.

Existing controls

  • Complaints are logged in a shared form.
  • The property manager signs off each formal reply.

Control gaps

Complaint log entries are not linked to repair records, so patterns are missed.

Additional controls

  • Prevent: Set a response time for each complaint type and publish it to tenants.
  • Detect: Review complaint logs monthly for repeated issues in the same building.
Likelihood 2 x impact 3 before; 1 x 3 after Owner: Property manager Target: Within 60 days Early warning: Tenant complaints about the same issue received more than three times in a month.

Rating method and evaluation

Each risk is rated on two five point scales. Likelihood runs from 1, rare, to 5, almost certain. Impact runs from 1, minor, to 5, severe, and covers harm to people, cost, loss of service, legal exposure and reputation. Multiplying the two gives a score from 1 to 25, which falls into one of four bands: Low from 1 to 4, Medium from 5 to 9, High from 10 to 16 and Critical from 17 to 25. Inherent risk is the score before any controls. Residual risk is the score after existing and added controls are working as described, and it must never be higher than inherent risk. Where inherent risk is 10 or more, the residual score must be lower. Anything Critical needs immediate action by the property manager. High risks need a named owner and a dated plan. Medium risks need routine controls and checks. Low risks are accepted and watched. Ratings are challenged by the maintenance coordinator, the accounts assistant and a tenant representative where possible, and each rating is reviewed whenever an early warning indicator reaches its threshold or after a serious incident. Scores guide the order of work and are not a measurement of any real building.

Likelihood, impact and rating bands

Likelihood

  • 5 Almost certain: Expected to happen in most circumstances.
  • 4 Likely: Will probably happen in many circumstances.
  • 3 Possible: Could happen at some time.
  • 2 Unlikely: Not expected, but it could happen.
  • 1 Rare: Only in exceptional circumstances.

Impact

  • 1 Insignificant: No lasting effect. Handled within routine work.
  • 2 Minor: Small effect that is quickly corrected.
  • 3 Moderate: Noticeable effect that needs managed effort to correct.
  • 4 Major: Serious effect on people, delivery or reputation.
  • 5 Catastrophic: Severe or lasting effect that threatens the whole activity.

Bands (likelihood x impact)

  • Low (1 to 4): Accept and monitor.
  • Medium (5 to 9): Manage with routine controls.
  • High (10 to 16): Senior attention and a treatment plan.
  • Critical (17 to 25): Act first. Do not proceed until reduced.

Monitoring, escalation and review

Review this assessment every 6 months, and sooner when an indicator below reaches its threshold.

Early-warning indicators and escalation thresholds
Indicator to watchEscalate when
Safety checks overdue by more than 7 days on any building.Escalate to the property manager at once, and to the owner and a qualified engineer if still open after 14 days.
Repair requests open for more than 28 days without a scheduled visit.Escalate to the maintenance coordinator after 28 days, and to the property manager if still open after 42 days.
Rent arrears above one month for any tenancy.Escalate to the accounts assistant and property manager, and to the owner for a payment plan after 60 days.
Contractor invoices with changed bank details that are not confirmed by call back.Escalate to the property manager at once and hold the payment until it is confirmed.
Tenant complaints about the same issue received more than three times in a month.Escalate to the property manager, who reviews the issue within 5 working days.

Contingency arrangements

If a serious event occurs, such as a gas or electrical incident, a building fire, a flood or a data loss, the property manager makes the affected area safe and calls the emergency services where needed. Specialist engineers and insurers are informed at once, and tenants are told what to do and where to go. The IT support contact restores lettings and rent records from the latest tested backup. Rent is kept on track through a short plan that agrees payment dates with the owner. Regulators and legal advisers are contacted as the relevant jurisdiction requires.

Prioritized action plan

  1. Introduce a dated safety check calendar with a named qualified contractor for each item, owner property manager, within 30 days.
  2. Verify contractors for insurance and competence before any work starts, owner maintenance coordinator, within 30 days.
  3. Adopt a handover checklist for keys, tenancy files and open repairs, owner property manager, within 45 days.
  4. Confirm bank detail changes by call back and review rent arrears each week, owner accounts assistant, within 30 days.
  5. Test a restore of lettings records and set up a tenant contact plan for outages, owner IT support contact, within 60 days.

Conclusion

Safe, well run property depends on a few steady habits: dated safety checks, verified contractors, clear handovers, accurate rent records and tested backups. The highest scores sit with building safety and maintenance failures, and each has actions that bring the residual score down. Treat the register as a living record, review it on the stated cycle, and seek qualified engineering, legal and financial advice for any real property decision.

Assumptions and limitations

Assumptions

  • Buildings are let under written agreements, and the owner has delegated day to day management to the team.
  • Staff are trained in general property practice but are not qualified engineers or lawyers.
  • Jurisdiction is not specified, so legal and safety duties are described in general terms only.

Limitations

  • The scores are examples for learning and do not describe any real property or landlord.
  • Landlord, tenancy, safety and housing rules differ by place and change over time, so specialist review is needed.
  • This is educational content and is not legal, engineering or financial advice.

Related frameworks to study

  • Risk register with likelihood and impact scoring
  • Three lines model of risk ownership
  • Hierarchy of controls
  • Business continuity planning basics

Professional Risk Assessment

China, India, United States, Indonesia, Pakistan, Nigeria, Brazil, Bangladesh, Russia, Japan, Mexico, Philippines, Vietnam, Egypt, Turkey, Germany, United Kingdom, France, Italy, Canada, South Korea, Australia, Spain.

For Learning Reference Only: This assessment demonstrates how risk assessment principles are applied in a practical setting, providing a useful reference for learning and understanding. Actual assessments may be adapted to suit specific site conditions and circumstances.

Keep learning

Study the subject behind this assessment.

Real Estate and Property Management course Read the best practices for this course

More Professional risk assessments

Hourly Active: 45,552 Learners