How to Manage People Risk

Your employees: They are your most important asset; but also your biggest risk. From individuals making risky or adverse decisions to organizations not quantifying the impact or retirement and knowledge loss. Learn what the 10 inherent people risks are and what you can do to control and prepare for them. 


Your employees are your organization's most important asset. At the same time they also represent your biggest risk. People Risk' is a topic that can span a whole range of issues for organizations — from individuals making risky or adverse decisions to organizations not quantifying the impact of retirement and knowledge loss. At an even broader level, firms face socio-economic risks like student debt and critical skills gaps. Finally, there are "black swan" events that cannot be easily predicted or controlled (the sudden death of your CEO), but can have a massive impact on organizations if risk mitigation and business continuity plans aren't in place.

In 2017, Aon Risk Solutions conducted a global study to identify top risks facing organizations now and in the near future. Interestingly, all the top risks identified through this survey of CEOs and senior business leaders contained, directly or indirectly, a people risk element, whether it is "damage to reputation/brand" or "failure to attract or retain top talent." Risk management is top of mind for most leaders right now.

So how do we unpack people risk? Employees face a variety of choices, circumstances and impulses during the workday, and their behaviors can either help build your organization — or introduce it to risks. There are two categories where people risk can stem: the overall composition of your workforce (i.e. demographic composition, location, tenure) or the behavior of your employees (i.e. their actions, engagement or managerial intent).

None of these risks can be eliminated, but they can be anticipated and mitigated with proper measures in place. This article will look at the 10 inherent people risks your organization faces (see graphic on next page) and detail how to be proactive about them. We'll look at specific examples and address how organizations can control, prepare for and respond to each kind of people risk.

People Risk: Who your employees are and how they behave

People Risk Strategy

  • Workforce Composition:
    • Hiring Risk – Bringing in new talent with incompatible skills & behaviors
    • Diversity & Inclusion Risk – Misinterpreting D&I issues and treating it as a “check the box” exercise
    • Digital Readiness – Underestimating the impact of technology and business changes on roles and skills
    • Retirement Risk – Not preparing for retirement related knowledge loss and lack of succession planning
  • Behavioral:
    • Attrition Risk – Employees in critical roles deciding to leave
    • Disengaged Workforce – Disengaged employees affecting productivity and morale
    • Risky Behavior – Employees acting in a manner detrimental to the organization
    • Safety Risk – Employees putting themselves and/or others at physical risk
    • Leadership Risk – Flawed leadership decisions or actions impacting employee and organizational performance
    • Flawed Incentives – Incentivizing suboptimal employee behaviors and actions

Risk #1: Digital Readiness

At many organizations, the way work is done is changing fundamentally. With the advent of Artificial Intelligence (Al) and Robotics, the pace of change has become much faster. Many jobs as we know them will cease to exist in a few years, while new jobs will be created. Today's workplace requires a different skill set than a few decades ago, and organizations that don't evolve and keep pace risk becoming irrelevant or losing out to the competition.

Look at examples from the recent past: Blockbuster's business model became completely irrelevant in the Netflix era. The entire line of business and related jobs disappeared. The same could happen in other sectors — sooner rather than later.

What Organizations Can Do: Plan for the Future of Work

Leaders at progressive organizations need to ask: What are the different job roles and skill sets we have in our organization now? And what skill sets will we need in our organization to move the strategy forward in the next three to five years? Which employee roles are going to be critical in the near future? How much of an impact will automation have on those roles?

We're talking more than basic headcount planning. Instead, think strategically and look at pivotal roles in the organization — now and for the future. Consider the roles from the supply side and the demand side, predict the coming workforce needs and supply shortfalls, and have strategic plans that enable you to fill the most critical skill gaps in the organization proactively instead of reacting to the changes.

HR Processes to Examine:

  1. Strategic Workforce Planning
  2. Organization Design & Structure

Leaders need to ask: What are the different job roles and skill sets we have in our organization now? And how much of an impact will automation have on those roles?

Risk #2: Hiring

Every day you may be opening your organization to a major risk simply by who you're bringing into it. Are new hires aligned to the objectives and culture of the organization? Or do they bring the potential for disruption? If you're not careful about who you're hiring and how they align with the organization, you risk productivity loss throughout the team. The impact is compounded where leadership hires are concerned. A toxic leader can cause attrition, productivity loss, and disengagement for the entire organization under him or her.

What Organizations Can Do: Make Sure You Hire the Right People

It sounds simple, but thoroughly assessing potential hires is one of the most important ways to mitigate risk in an organization. While every hire is important, leaders should identify the core roles that make the biggest impact on teams, and think carefully about how those roles are filled.

We recommend that organizations build a new-hire assessment that screens for overall cultural fit, with customized elements tailored for the individual job.

It's tempting, and perhaps easier, to focus on functional competencies. For example, Python programming skills — but in today's workplace it's just as important to assess behavioral competencies. Functional skill needs change quickly — tomorrow you might need a programmer With different technical skills — but What doesn't change are aspects such as learning agility and the ability to work collaboratively in teams. When you're assessing an employee, consider their long- lasting skills instead of simply focusing on their current functional competencies. Make sure the people who are coming into the organization are a cultural fit, and will be able to perform and stay.

HR Processes to Examine:

  1. New Hire Assessment
  2. Talent Acquisition
  3. Predictive Quality of Hire Modeling

Risk #3: Retirement

Are you facing a retirement cliff? Many industries, especially some manufacturing sectors, have experienced mass retirements in recent years, leaving major holes in organizations. If critical individuals retire without a succession pipeline already in place, they take their skills and institutional knowledge with them, which poses a deep risk for the organization. In our recent Top Companies nearly 30 percent of the firms surveyed didn't have an adequate succession pipeline, even at the CEO level.

Consider this example: Let's say you have 20 people with 25 years of experience each in your firm, and they're all retiring next year. This is a very real scenario for a lot of companies. That's 500 years of knowledge and experience moving out of the firm in a single year, which is a major problem if the organization doesn't have a way of capturing and transferring that knowledge

If you have a large population nearing retirement age, it's time to make a plan to mitigate the retirement risk.

What Organizations Can Do: Build Proper Succession Guidelines

First, understand and quantify your specific retirement risks. Map out the key skills loss you're likely to see over the next five years. How many collective years of experience do you stand to lose? Know when and where (at which sites or locations) your key employees are most likely to retire.

Establish a retirement scorecard that tracks relevant metrics. Implement measures to quantify the cost and revenue impact by role, and build solutions that predict who is most likely to leave and when. Finally, put a formal process in place for succession planning and knowledge transfer for both leaders and key contributors to mitigate the retirement risk. In the interim, it's also helpful to identify ways to retain your critical talent and explore post-retirement consulting arrangements to minimize the disruption.

We often see organizations planning succession for leaders, but not for individual contributors in critical roles. When those contributors retire, they leave behind huge holes. Consider how you will preserve knowledge. Knowledge management is going to become more and more critical in the next few years.

HR Processes to Examine:

  1. Retirement Planning & Analytics
  2. Succession Planning
  3. Leadership Development

Risk #4: Diversity & Inclusion

Diversity and inclusion can present major pockets of risk if organizations don't act. Are you building a diverse workforce? Or does your organization look at diversity and inclusion as just another box to check off? Are you communicating in a way that accounts for different employee groups' needs, preferences, and backgrounds? Are your employee policies inclusive of all employees' needs and preferences?

We often see pay and rewards programs that don't consider all employee demographics, creating a mismatch between employees' needs and the organization's offerings. Employees may have completely different needs based on their life stage, career stage, marital status and gender. The risk is using a broad brush to create a one-size-fits-all rewards program without considering Issues that affect specific employee segments. If you don't pay and reward employees in the right way, you're bringing in a risk.

What Organizations Can Do: Get Analytical About Diversity & Inclusion

We see many leaders responding to headlines about diversity and inclusion with knee-jerk reactions. They know they need to build a more diverse organization, so they start filling holes and applying new policies to check the box.

The more sustainable solution is to be analytical and understand the diversity and inclusion issues in your organization. understand your current state so that you can identify the most pressing needs.

Look at the data and broaden your definition of diversity. Consider diversity of gender, ethnicity, geographic origin and skills. For example, maybe your leadership team is diverse by gender, but only three of 25 leaders are from outside the U.S., and you expect a large chunk of your growth to come from emerging markets. If your leaders don't represent those markets or know much about them, it's unlikely you'll reach you goals.

Finally, it is imperative that rewards programs are fair and not misaligned Reputational and legal risks to the organization that arise out of pay inequity issues can leave a lasting mark. Negative perceptions in the market can severely hamper an organization's ability to attract and retain critical talent.

HR Processes to Examine:

  1. Diversity & Inclusion
  2. Strategic Workforce Planning
  3. Total Rewards & Pay Equity Analysis

Risk #5: A Disengaged Workforce

Disengaged employees are a major risk to an organization. They don't perform to the level you need them to, and they negatively influence the network of employees around them. The stronger an employee's network, the bigger the influence they have on others.

Disengagement is a major problem at many organizations. In our recent research we found that an average of 8 percent of the workforce are what we call "prisoners." They aren't ambassadors for the firm (have negative things to say about the organization), they don't feel like they want to go the extra mile (they score low on the strive dimension of our engagement model), but they stay put perhaps for the lack of better options. These prisoners bring an organization's morale and engagement down and open it to risk.

What Organizations Can Do: Study and Address Disengagement

Just as with addressing diversity and inclusion, there is no silver bullet for disengagement. The first step toward addressing a disengaged workforce is to identify the pockets of disengagement and do a thorough network analysis to understand impact. Answer these questions: Who is engaged? Who is not engaged? How much of an influence do people have on their informal networks?

Track how engagement has changed over a period of time, and look for patterns. Are there a group of employees who went from being highly engaged to becoming 'prisoners'? Are there some common traits in their (dis)engagement drivers? Often your workplace prisoners can be a microcosm for the larger issues in the organization. Rather than dismiss this group as beyond redemption, delve into their data deeper.

If someone is disengaged but very connected within the organization, their behavior is like a it spreads. Identifying those pockets of disengagement and the network of employees virus — around will help leaders understand the issues leading to risky behavior and act to mitigate it.

Once you survey and understand the levels of disengagement, make an action plan. Nothing frustrates employees more than taking an engagement survey without seeing leaders take concrete actions to address the results.

HR Processes to Examine:

  1. Employee Engagement
  2. Employer Branding / Employee Value Proposition

Risk #6: Attrition

Attrition. It's not always a bad word. Many times, losing employees is a healthy part of the organization's evolution. But not all employee roles are created equal. It is important to examine which employees you are losing. Every organization has pivotal roles — job roles that have a disproportionate impact on the profitability or the core objectives of the organization. If people in those critical roles, or star performers in any role, leave the organization, they create an attrition risk that directly affects profitability and creates a cascading impact throughout the organization.

What Organizations Can Do: Analyze Likely Attrition

To manage risks arising from unwanted employee attrition, set up dashboards to measure and monitor turnover on an ongoing Oasis, identify employee segments that are high-risk, and compute the costs and impact of attrition.

Then, if you have the right people analytics tools at your disposal, predict which key employees are likely to leave in the next 12 months and why. Many organizations have started to do just that, mapping their attrition risk down to the level of the individual, and the reasons he or she may leave.

When you understand your attrition risk, you can create backup plans to compensate for the loss of key employees — and, more importantly, potentially prevent key employees from leaving in the first place. In an ideal environment, you would also build integrated talent retention roadmaps and action plans, and assimilate the results from predictive attrition risk models into your strategic workforce plans.

HR Processes to Examine:

  1. Performance Management
  2. Talent Management
  3. People Analytics & Attrition Modeling

Risk #7: Employees Exhibiting Risky Behavior

You don't have to look far to see recent cases of risky employee behavior. Take, for example, the recent rash of sexual harassment cases inside organizations. Or employees releasing proprietary information. Or a CEO sending derogatory tweets. Individual employees' behavior can expose an entire organization to grave risks.

What Organizations Can Do: Preempt and Respond

We group individual risky behavior into two buckets: The first is noncompliant behavior, which is especially relevant in the financial services sector. Organizations can actively monitor how employees work (including doing sentiment analysis of work communication like email and instant message), and use that data to predict who is likely to exhibit risky behavior. This preemptive strategy can help organizations respond before the behavior even happens.

The second kind of risky behavior is related to diversity and inclusion — issues like sexual harassment It's virtually impossible to prevent individual bad behavior, but It is possible to minimize the impact. If you put the right monitoring steps into place, you can quickly catch bad behavior and respond. Set guidelines about what is acceptable and what not. Make sure you have the right compliance- training programs, and monitor their effectiveness. Tailor compliance training to individual employees so they can apply to their roles and circumstances. Create a safe space for employees to voice their grievances. And measure broader signals that can point to a culture of discrimination or inequity.

When organizations identify the key drivers of risky behavior, organizations are able to predict who is likely to demonstrate such behavior and then formulate risk mitigation strategies to address and reduce the impact on the organization.

HR Processes to Examine:

  1. Talent Management
  2. Diversity & Inclusion
  3. HR Policy Design & Communication
  4. People Analytics

Risk #8: Safety

Some risky behavior is not tied to a single individual, but to the organization as a whole. For many organizations, breaches in safety lead to major risks. If an employee is hurt on the job because of an unsafe work environment, an organization can face immediate risks such as workers' compensation payouts, plus longer-term risks to the organization's reputation and employee engagement.

What Organizations Can Do: Put Controls in Place

How do you predict when an unsafe incident might happen? Many organizations start with historical data. Study all of the data about past safety incidents to learn who was working during those incidents, what kind of employees are more prone to such incidents, who doesn't follow all the rules and other environmental factors that lead to safety breaches. Once you understand the historical context, you can start to consider controls you can put in place to reduce the number of incidents.

For example, a logistics company was facing a tremendous number of workers' compensation claims. By looking at historical data and understanding where, when and why problems were happening, leaders realized they could change the design of a core piece of equipment to improve safety.

HR Processes to Examine:

  1. Employee Health and Safety
  2. Workers Compensation
  3. Safety Analytics

Study all of the data about past safety incidents to learn who was working during those incidents, what kind of employees are more prone to such incidents, who doesn't follow all the rules and other environmental factors that lead to safety breaches.

Risk #9: Leadership

We often think about people risks from rank-and-file employees, but senior leaders have the ability and influence to expose an organization to major risks. Whether it's speaking inappropriately on behalf of the organization or not exhibiting proper behavior as a leadership team, the wrong kinds of behavior can send a message to employees as well as to the market that has financial and reputational implications.

Leaders can also get in the way of innovation and technology. Especially if leaders have a long tenure at the organization and are used to a certain way of doing things, they may be unreceptive to, or ignorant of, more innovative ways to work. In the new world of work, leaders need to collaborate in order to make decisions. Decisions made in silos open an organization to risk.

What Organizations Can Do: Assess Leaders for Fit

Do your current leaders fit with the future growth plans of the firm? If not you may need to have some tough conversations. In today's competitive climate, no organization can afford leaders whose goals don't match the organization's.

We're also seeing organizations activate creative leadership solutions to trigger growth — mapping the right leaders to the right roles and projects. If there's a specific growth-oriented segment of the business, try assigning a growth-oriented leader who can drive innovation within a small team. Then hand the segment back to the organization. In the Asia-Pacific region, this popular tactic is called "intrapreneurship," and it capitalizes on the fact that it takes one kind of leader to nudge and grow a business, and a different kind of leader to scale the business.

HR Processes to Examine:

  1. Leadership Assessment & Development
  2. Culture Assessment

Risk #10: Flawed Incentives

Rewards are a key lever for HR to drive employee performance, engagement and retention as well as hiring. High-potential employees are particularly driven by performance-based pay. Yet we see organizations design their incentives programs with very short-term goals in mind (large banks basing incentives purely on cross-sell, promoting misselling), overly aggressive structures (e.g. 100% commission models that actually cause losses for the firm), or at the other extreme, a very socialistic system that doesn't differentiate high performers from average performers in a meaningful manner.

Flawed incentives can also create a situation whether an entire group of employees might be underpaid (leading to risks of attrition), or are being overpaid (a monetary loss for the firm.)

Each of these approaches causes risks for the organization, some more so than others. It would be wrong to think that Incentive design only affects hourly wage workers or sales teams. There are plenty of examples in the news of CEOs and other executives taking actions that would benefit them personally, but would not be in the interests of customers or shareholders.

What Organizations Can Do: Assess the Impact of Incentive Design

In designing incentives, firms need to ask themselves:

  • "What behaviors do we want to incentivize?"
  • "Can the plan be 'gamed'?"
  • “How will this affect both current employee and prospective employee behavior?"

Analyze your pay ratio of rewards spent on pivotal employees versus all others. Are you investing in roles and individuals that will give you the maximum return on investment? Putt ng it crudely, are you getting maximum bang for your buck?

Ensure that your program is nimble, and that it reflects your business environment and competitive landscape. Incentivize those roles that have the greatest contribution. Keep in mind that certain roles might have a long-term impact, and that such "growth" roles must be treated differently than the "cash cow" ones.

Firms also need to consider their own culture and the fit of an incentive program structure. Will the program drive any negative behaviors? Will it get in the way of collaboration between different business units? Will it lead to hoarding of know edge and resources? The bottom line is, employees focus on doing what is measured. Making an explicit link between performance and rewards is critical. At the same time, organizations need to recognize incentive rollout is a change initiative, and accordingly plan sufficient time to test the effectiveness and make tweaks as appropriate.

HR Processes to Examine:

  1. Total Rewards
  2. Performance Management
  3. Executive Pay


Completely eliminating people risk would mean eliminating people from your organization. But by understanding people risk better, organizations can address the issues they face through a robust and proactive risk-management approach.

In our work with clients over the years, we have seen a consistent pattern: HR sees its role as developing and engaging employees. That is an important and critical part of HR's role, but it's not the entire picture. Organizations are made up of people, and people by their very nature have different behaviors, needs and wants. That's what makes us human, but those same behaviors and needs can pose risks for the organization. As we step into an era of unprecedented volatility, HR practitioners must start thinking about people risk in a holistic manner. This will allow them to be true business partners and contribute to the overall strategy of the organization.


Get in touch to learn more about our capabilities, tools and solutions and start your people strategy transformation.


Previous Flipbook
7 Ways to Use Your HR Data Better
7 Ways to Use Your HR Data Better

People analytics is relatively new in HR and too many teams are missing out because they don’t know how to ...

Case Study: Transforming HR Into a True Business Partner
Case Study: Transforming HR Into a True Business Partner

This case study outlines how to develop an effective hr strategy at a large regional bank. This case study ...