The Biggest Risks in Strata Are No Longer All Inside the Building

Risk no longer stops at the building envelope.

Good strata management will always protect the building. Water ingress must be investigated, fire systems maintained, lifts monitored, defects controlled and planned maintenance funded.

The wider lesson is that physical property is now only one part of the risk picture. A capable committee and strata manager should be able to look across five connected areas before deciding that a matter is routine.

• PROPERTY — safety, defects, maintenance and essential services
• PEOPLE — conduct, wellbeing, workload, conflict and communication
• MONEY — budgets, cash flow, insurance, invoices and payment controls
• INFORMATION — privacy, records, access, credentials and cyber security
• GOVERNANCE — authority, delegation, decisions, conflicts and accountability

1. PROPERTY — protect the physical asset.

Start with the familiar risks: active leaks, fire-safety deficiencies, lift failures, building defects, electrical or structural concerns and maintenance that has been deferred. Identify the immediate risk, arrange any authorised make-safe response, obtain appropriate technical advice and retain the evidence needed for the permanent decision.

Repeated failures should not remain isolated work orders forever. A pattern may require a broader inspection, funding plan, insurance review or building-wide maintenance decision.

2. PEOPLE — protect participation and professional wellbeing.

Strata brings residents, volunteers, managers, building staff, contractors and advisers into difficult conversations about homes, money and responsibility. Disagreement is normal. Threats, abuse, harassment, sustained unreasonable behaviour and unsafe workloads require a different response.

In a workplace context, psychosocial hazards can include poor role clarity, excessive demands, inadequate support, exposure to traumatic events and harmful behaviour. Not every difficult conversation is a psychosocial hazard, but the possibility should be recognised and managed through the applicable workplace safety, complaint and escalation processes.

Clear roles, respectful boundaries, realistic commitments and early escalation protect people without abandoning the underlying strata issue.

3. MONEY — protect funds before they move.

Financial risk includes more than an over-budget repair. It includes inadequate levies, unpaid creditors, timing gaps, unfunded commitments, unsuitable insurance, misunderstood excesses and decisions made without seeing the complete financial position.

It also includes cyber-enabled payment redirection. An invoice or email that changes bank details should be independently verified through a trusted contact method already held—not through the contact details supplied in the change request. Approval, verification and payment should leave a clear record and use the organisation's applicable dual-control process.

Insurance can transfer some loss, subject to the policy. It does not replace maintenance, cash-flow planning, authority or careful payment controls.

4. INFORMATION — protect what the scheme knows.

A strata file can contain names, contact details, financial information, correspondence, access credentials, security footage, reports and records about disputes or individual circumstances. The risk is not only a dramatic cyberattack. It can be an attachment sent to the wrong person, excessive access, a weak password, an unprotected spreadsheet or information kept without a clear reason.

Before collecting, sending, storing or releasing information, check identity, entitlement, relevance, authority and the safest delivery method. Access, retention, disclosure and any breach response should follow the law that applies, the scheme's records, contractual duties and organisational procedures.

5. GOVERNANCE — protect the decision and the trust around it.

Governance risk appears when nobody is certain who can decide, an informal instruction is treated as a resolution, delegated limits are overlooked, a conflict is not disclosed or the record cannot show why money was committed.

Trust and communication risk sits alongside authority. A technically defensible decision can still damage confidence when affected people receive silence, conflicting explanations or promises that are not kept. Useful communication explains what happened, why it matters, what is being done and when the next update will arrive.

The control is simple: identify the decision, confirm where authority sits, obtain and record the proper instruction, communicate the outcome appropriately and follow through.