Human resources risk

Human resources risk
Human resources risk is not just the activities of the human resources department
although they do contribute to controlling the risk. However, there are particular
conditions which reside within the control of the business areas themselves which
the operational risk manager should be aware or when making an assessment. For
example, the firm’s performance may hinge on a small number of key teams or people
or the age of the teams may be skewed to young or old without an appropriate mix
of skills and experience to satisfy the business objectives which have been set.
Given the rogue trader problems which some banks have suffered it is also
important that the operational risk manager checks that the human resources
department has sufficient controls in relation to personnel security. Key items the
manager should assess on personnel security are as follows:
Hiring procedures:
Ω references and work credentials
Ω existing/ongoing security training and awareness program
Ω job descriptions defining security roles and responsibilities
Termination procedures:
Ω the extent of the termination debriefing: reaffirm non-competition and nondisclosure
agreements,
Ω ensure revocation of physical access: cards, keys, system access authority, IDs,
timescales
Human Resources can help mitigate these risks by setting corporate standards
and establishing an infrastructure such as ‘knowledge management’ databases and
appropriate training and career progression. However, higher than average staff
turnover or the ratio of temporary contractors to permanent staff is one indication
that things are not working. Another indication of human resources risk is evidence
of clashing management styles or poor morale.