What is not measured is managed reactively

Many organizations manage Human Risk reactively: a background check at hiring, an access review after an incident and questions about third parties during an audit. Turning the topic into a management discipline means observing trends before problems appear. That requires indicators about coverage and process, not a simplistic score claiming whether a person is 'good' or 'bad'.

Which indicators can be useful

Useful indicators can be operational: percentage of critical roles with current screening, average time since the last review for defined functions, number of third parties with privileged access, open exceptions, or the percentage of role changes that triggered reassessment. Resolution time for discrepancies can also be measured. These KPIs show the quality of the control system and should always be interpreted in context rather than replacing human judgment.

A KPI should not become a score on the individual

A Human Risk KPI should not automatically become an individual score that labels employees. In Spain, profiling and especially decisions based solely on automated processing that produce legal or similarly significant effects are subject to specific GDPR safeguards. Measuring exposure and control coverage by role or risk group is generally more defensible than assigning an opaque personal label. Relevant risk arises from the interaction between role, access, controls and verifiable circumstances. Reducing it to a personal number can create false certainty and proportionality concerns. It is often better to measure organizational exposure: sensitive roles without defined controls, access exceeding job needs, or screening information that is outdated under policy.

From dashboard to decision

A dashboard only creates value when it leads to decisions. If the number of privileged third parties rises, supplier onboarding can be reviewed. If many critical functions have ageing checks, a re-screening cycle can be assessed. If one unit accumulates exceptions, CHRO and CISO can investigate the cause. The indicator then connects strategy with operations and helps prioritize resources where potential impact is highest.

Human Risk Management as a leadership discipline

Human Risk Management is ultimately a leadership and governance discipline. It requires decisions about the level of trust each function needs, which controls are proportionate and who is accountable. A shared framework improves the conversation between CHRO, CISO, Compliance, management and the board. The aim is not to eliminate human risk - which is impossible - but to make better, more coherent and auditable decisions about people, access and responsibility.

Want to integrate Human Risk Management into your risk model?

Validato helps organizations design modular, proportionate background checks for candidates and employees, with international reach and data governance in Switzerland and the EU. Contact us to discuss which screening level fits your higher-risk roles.