Safety Norms: Asset and Portfolio Management

1Purpose, Scope, and Safety Principles

These norms apply to anyone who plans, approves, executes, monitors, or reports on the management of financial assets, real assets, or portfolios of either. This includes portfolio managers, analysts, operations and settlement staff, risk and compliance teams, valuation staff, property or site managers, contractors, and temporary workers who access firm systems or holdings.

The guiding principles are simple. Client interests come first, authority is limited to what has been formally delegated, information is handled on a need-to-know basis, and every control has a named owner. Where a rule is marked mandatory, it must be followed without exception unless an authorized person has approved a documented deviation. Recommendations describe good practice that teams should adopt unless a documented reason exists not to.

• Mandatory: act only within the investment mandate, limits, and delegated authority in force.
• Mandatory: report suspected breaches, errors, or security events the same working day they are identified.
• Recommended: keep decisions traceable so a reviewer can reconstruct the reasoning without asking the author.

2Roles, Competence, and Accountability

The investment committee or equivalent governance body approves the investment policy, risk limits, and permitted instruments. The portfolio manager is responsible for executing decisions within mandate and for documenting the rationale. The risk function monitors exposures and limit usage independently of the portfolio team. Compliance interprets regulatory obligations and tests controls. Operations is responsible for accurate booking, reconciliation, and settlement. Information security owns access rules and incident response for systems. Each property or physical asset has a designated site manager who is accountable for site safety.

Competence is confirmed before authority is granted. Professional qualifications, licenses, and certifications required for a role must be verified against current registers or official sources. Authority to trade, approve payments, or sign valuations is granted in writing and reviewed when roles change. Contractors working on physical assets must show evidence of insurance, qualifications, and safe-work arrangements before access.

• Mandatory: no one trades, moves money, or changes client data without written delegated authority.
• Mandatory: verify licenses and registrations where a role requires them, and keep evidence on file.
• Recommended: name a deputy for every approval role so decisions are not delayed by absence.

3Course-Specific Hazards and Risk Assessment

The most common hazards in asset and portfolio management are not physical. They include mandate breaches, concentration and liquidity risk, leverage that exceeds policy, errors in trade instructions such as wrong size, direction, or instrument, valuation errors, counterparty failure, and misleading client reporting. Information hazards include leakage of material non-public information, disclosure of client identities or holdings, and loss of confidential investment research. Cyber hazards include phishing aimed at payment instructions, credential theft, and ransomware affecting dealing or valuation systems. Environmental and physical hazards arise mainly from owned or managed real assets, such as structural defects, fire, electrical faults, asbestos-containing materials in older buildings, flooding, and contractor injury on site.

Each hazard should be scored for likelihood and impact using the firm's approved risk matrix. A practical rating scale is low, medium, high, and critical. Any critical risk requires an owner, a documented mitigation plan, and escalation to the risk committee. High risks require management sign-off and a review date set by the risk owner. Low risks are monitored through routine controls. Risk registers must be updated when a new product, market, system, or property is introduced, and before the first live transaction or occupation.

• Mandate and limit breach: high impact, reviewed daily through pre-trade and post-trade checks.
• Trade instruction error: high impact, controlled through four-eyes confirmation above set thresholds.
• Phishing for payment changes: high likelihood, controlled through call-back verification to a known number.
• Physical site hazard: impact depends on asset type, assessed by a qualified building or safety professional.

4Preventive Controls and Safe Working Practices

Preventive controls should stop errors and harmful actions before they occur. Pre-trade compliance checks must confirm that proposed trades fit the mandate, concentration limits, liquidity requirements, and restricted lists before orders are released. Trade tickets above defined thresholds require independent approval by someone other than the originator. Payment instructions and bank detail changes must be verified through a second channel using contact details held on file, not those supplied in the request. Valuations of hard-to-price assets should be reviewed by a function independent of the portfolio team, with the method and key inputs documented.

Information barriers protect confidentiality. Staff working on sensitive transactions or research should be placed on restricted lists, and access to project folders should be limited to named individuals. Personal trading by staff must follow the firm's pre-clearance and holding period rules. Conflicts of interest, including gifts, outside directorships, and related-party deals, must be declared in a register and managed by compliance. Staff must not use personal messaging applications for firm business unless the firm has approved them and retention rules apply.

For physical assets, safe working practices include a current asset inspection schedule, a permit-to-work process for maintenance or alterations, documented lone-working arrangements for site visits, and insurance and method statements for contractors. Site visits should be planned with the site manager, and visitors should follow site induction and any protective requirements such as hard hats or hi-vis clothing in active work areas. No one should enter plant rooms, roofs, or excavations without authorization and proper equipment.

• Mandatory: second-person approval for trades and payments above the thresholds set in the delegation matrix.
• Mandatory: verify bank detail changes through a known contact number before processing.
• Mandatory: keep restricted list and insider lists current and enforce them in the order management system.
• Recommended: run a quarterly simulated phishing exercise and review results with the operations team.
• Mandatory: no unescorted access to hazardous areas of a property without site-manager authorization.

5Information, Systems, Equipment, and Physical Safeguards

Information security is a core safety requirement. Access to portfolio management, order management, custody, and valuation systems must follow least privilege, with unique user accounts and multi-factor authentication for remote and privileged access. Access rights must be removed promptly when a person leaves or changes role. Client data must not be copied to removable media or personal devices. Screens in open-plan areas should be locked when unattended, and confidential documents must be shredded or disposed of through approved secure containers.

Physical equipment and environments also need safeguards. Workstations should be set up to reduce strain during long periods of screen work, and staff who report symptoms should be referred to occupational health. Server rooms and document storage must be access controlled. For real assets, fire detection, emergency lighting, electrical testing, and lift inspections must be kept current according to the applicable local codes and manufacturer instructions, which must be verified with the relevant authority or a qualified engineer. Hazardous materials such as asbestos or refrigerants should be managed only by licensed specialists under the relevant regulations.

• Mandatory: enforce multi-factor authentication for remote and privileged system access.
• Mandatory: remove or disable access within the timeframe set by the access control procedure once a role ends.
• Recommended: maintain an asset register for hardware and encrypted storage for mobile devices.

6Incident Reporting, Emergency Response, and Escalation

Every incident, near miss, and suspected breach must be reported promptly to the named incident owner and, where relevant, to compliance or information security. Examples include a trade executed outside mandate, a misdirected client report, a suspected credential compromise, an erroneous payment, or a slip injury on a managed property. Reporters should not attempt to fix serious issues alone or delete evidence. Correct the immediate cause only where it is safe and authorized, and preserve logs, emails, and records.

Emergency response for physical sites follows the building's approved emergency plan. Fire, medical, gas, flood, or structural emergencies require calling local emergency services first, then informing the site manager. Staff must not enter a fire or collapse zone or attempt to handle hazardous materials. For cyber incidents, the information security team leads containment, which may include isolating devices, suspending affected accounts, or pausing trading. Regulatory notification duties and time limits vary by jurisdiction and must be confirmed with legal and compliance advisers as soon as possible. Clients and counterparties are informed only through approved channels.

• Mandatory: report incidents to the named owner the same working day, even if the impact is uncertain.
• Mandatory: call emergency services for life-threatening situations before internal escalation.
• Mandatory: do not delete logs, emails, or files related to an incident.
• Recommended: rehearse the cyber and trading-error escalation path at least once each reporting cycle.

7Records, Training, Monitoring, and Review

Decisions, approvals, valuations, risk assessments, and incident records must be retained according to the firm's records policy and applicable legal retention requirements, which vary by jurisdiction and should be confirmed with compliance or legal counsel. Records should show who decided what, when, on what evidence, and under which authority. Training is required before access to trading, payment, client data, or site systems is granted, and refresher training should cover new threats, procedure changes, and lessons from incidents.

Monitoring should be continuous for critical controls such as limit checks and access logs, and periodic for others such as site inspections and valuation reviews. Key performance indicators for safety might include the number of limit breaches, the number of reported near misses, overdue inspections, and training completion. Review the norms after any significant incident, system change, regulatory change, or organizational change, and at a regular interval set by the governance body. Findings should lead to named actions with owners and completion steps, and actions should be tracked to closure.

• Mandatory: complete required training before access to trading, payment, or client data systems.
• Mandatory: keep an auditable trail for every trade, payment, and valuation change.
• Recommended: review lessons learned from near misses with the wider team, without blame, to improve controls.

Implementation checklist

• Confirm your delegated authority and mandate limits before acting.
• Obtain second-person approval for any trade or payment above threshold.
• Verify bank detail changes through a known contact number.
• Keep restricted lists and conflict registers current.
• Use multi-factor authentication and never share credentials.
• Report incidents, near misses, and suspected breaches the same working day.
• Call emergency services first for life-threatening situations at any site.
• Keep records intact and do not delete incident evidence.
• Complete required training before accessing trading or client systems.
• Confirm legal, regulatory, and licensing requirements with qualified professionals in your jurisdiction.