HR Risk Management

I spent nearly a decade recruiting insiders for U.S. intelligence.  Now I’m giving HR the playbook to prevent them. I’m proud to share I was published in the Winter 2026 edition of SHRM's People + Strategy Journal. The article is called: “The Quiet Threat Within: Lessons from a Spy on Preventing Human Risks.” Seeing my work in a journal built for senior HR and business leaders hits me hard. I wrote this article because HR has a unique vantage point into human risk that most security programs simply don’t have. Security sees anomalies in systems. Legal sees violations after the fact. HR sees the human timeline before it becomes a headline. We need more of this. In the article, I break down: • The spy-world truth that applies to every workplace: people don’t “turn” when they’re happy. They turn when they’re under pressure. • The three flavors of insider incidents (unintentional, compromised, malicious) and what HR can spot earlier than anyone else • Why remote and hybrid work makes “quiet threat detection” harder, and what to do about it • Practical HR touchpoints that reduce risk across the employee lifecycle: recruiting, onboarding, development, retention, and especially offboarding (your highest-risk window) • The behavioral pattern shifts that matter most, and how HR + Security partnerships catch them before damage happens If you lead HR, partner with HR, or have ever had to clean up a “how did we not see this coming?” incident… I wrote this for you. If you read it and it resonates, I’d love for you to share it with your HR team, your security counterpart, and that one leader who still thinks insider risk is “an IT problem.” Because technology can’t fix people. But people can absolutely protect people, when we actually pay attention. (Article + full issue below) #SHRM #PeopleAndStrategy #HumanRisk #InsiderThreat #HR #CHRO

What Facilities Management businesses get wrong about HR and Why it’s a risk issue, not a People issue? In manpower-intensive industries like Facilities Management, HR is often discussed in terms of engagement, culture, or retention. In reality, HR in FM is fundamentally about risk, continuity, and margin protection. When you are managing tens of thousands of employees across multiple countries, HR decisions directly impact: Contract profitability Regulatory exposure Client confidence Business continuity Over the years, leading HR for large FM operations across the GCC, South Asia, and Africa, I’ve seen that the most successful organizations treat HR as a governance and workforce risk function, not just a support service. Three realities stand out: 1.Workforce scale amplifies risk At scale, small process failures — delayed onboarding, payroll inaccuracies, visa lapses, inconsistent supervision — quickly become material business risks. Strong HR governance is often the difference between operational stability and client escalation. 2. Compliance and welfare are commercial issues Worker welfare, ethical employment practices, and regulatory compliance are not “soft” topics. In regulated markets, they influence audit outcomes, government ratings, contract renewals, and employer credibility. Organizations that invest here reduce long-term cost and volatility. 3. Data matters more than intent Boards don’t need HR narratives — they need visibility. Attrition trends, workforce cost ratios, mobilization timelines, and leadership pipeline health must be visible in real time to enable informed decisions. The role of the HR LEADER in FM is therefore not just to enable people — but to protect the business while enabling growth. As FM organizations continue to expand across borders and regulatory environments, HR leadership must evolve from execution to strategic workforce governance. This shift is no longer optional — it’s a competitive advantage.

Companies talk about the importance of mental But most just do that "talk" They really don't actually give a sh*t   Because if they did, there would be more budget allocated towards workplace mental health support But there isn't   What if mental wellbeing was treated like any other business risk. Monitored, resourced, and reviewed.   We budget for cyber risk and financial risk, we run scenarios, buy insurance, train teams. Human risk deserves the same seriousness, because stress, burnout and attrition are not random, they follow patterns we can measure and change.   A practical model: → Workload that matches capacity, → Role clarity that leaves room for judgement, → Managers trained for hard conversations with support behind them, → Access to qualified help, confidential and quick, → Fair flexibility, measured by outcomes, not chair time, → Clear progression, so staying makes sense.   Add governance so it lasts: → Set quarterly reviews with HR and leaders, look at absence, turnover, workload signals, and internal moves. → Publish what you will change, and by when. → Give managers a simple playbook for tricky moments, and a person they can call. → Resource it like it matters, not only during a crisis.   None of this sits with HR alone. It needs leadership ownership, budgets, and time. When that happens, you see fewer preventable exits, steadier teams, better decisions under pressure.   Treat people risk with the same respect you give every other risk. Your culture, and your numbers, will reflect it.   Start somewhere small this week, and build from there.

I've been working on something exciting - Eunomia HR is relaunching with a sharper, simpler focus (and some freebies). Every HR leader I speak to says the same thing: “We know AI is coming fast… but we don’t know how to get a grip on it.” The blockers? - Legal & compliance uncertainty (Legislation like the EU AI Act, GDPR/UK GDPR, Data Use Act 2025). - Fear of bias, discrimination, or bad data. - Lack of clear policies, governance, or oversight. So from today, Eunomia HR is focused on two core services: 1) AI in HR Risk Assessments: Uncovering risks across your AI systems, processes, and policies. 2) Fractional AI Governance: Ongoing support as your “AI Policy & Ethics Partner”, without the full-time headcount. And because so many HR teams are starting from scratch, I’m also open-sourcing part of my IP: - AI Recruitment Vendor Scorecard - a structured tool to compare suppliers against compliance & ethics criteria. - AI Usage Policy Template for HR - ready-to-customise starter policy covering governance, risk, and compliance. - Universal Framework for AI in HR - a practical, six-principle governance model that helps HR leaders adopt AI responsibly. - QuickScore™ Self-Assessment – a 12-question quiz to benchmark your AI readiness. If you’re an HR leader worried about AI adoption but want to get a grip on risk, governance, and compliance, this relaunch is for you. The message is simple: AI in HR doesn’t have to be chaotic, risky, or overwhelming. With the right structures in place, you can adopt AI responsibly and with confidence.

CFO: We lost 12 people last month. Why? HR: 3 reasons: no growth, no recognition, and rigid work. CFO: Not pay? HR: All within comp band. They felt stuck. CFO: What’s the damage? HR: 1.5x salary per person. Fast add-up. CFO: We cut $400K from engagement last quarter. Did that cost us? HR: Yes. Saved $400K, lost $1.2M. Plus slower work and burned-out teams. CFO: So engagement is risk management. HR: And retention. And cost control. CFO: What actually works? HR: Career tracks, real recognition, and flexible policies with accountability. When we did that, attrition dropped. CFO: Engaged teams perform 20% better. That’s margin. HR: Keeping people isn’t a perk. It’s a cost of business. CFO: And ignoring it already hits our P&L. BOTTOM LINE Unmet employee needs are a business risk. Ignore them, and you lose time, momentum, and profit.

If you’re not tracking Manager Risk, you’re not managing People Risk. Most organizations measure performance. But very few measure managerial damage, until it costs them their best people, their culture, and millions in silent losses. We hear and read about toxic managers. We know the quote: “People don’t leave jobs,they leave managers.” But here’s the uncomfortable truth: Most companies still don’t know how to measure this. And so the damage continues, quiet, compounding, and expensive. I see a lot of fluff posts about leadership toxicity. But this isn’t about calling out bad behaviour. This is about calling in HR to rethink how we capture risk. Not by adding more work. But by being more strategic with what we’re already seeing. That’s where the Manager Impact Loss™ (MIL) metric comes in. This isn’t just another HR framework. It’s a financial and cultural lens that lets you calculate the hidden cost of poor leadership. What are you really paying for? - High-performing employees walking out quietly - Teams disengaging under pressure - Absenteeism and burnout going unaddressed - Innovation lost to fear, silence, and survival mode All of this has a price tag. And yes, you can calculate it. How? Here’s the simple formula: MIL = (Turnover × Replacement Cost) + (Engagement Drop % × Lost Output) This gives HR and Finance a shared language,to name what’s often ignored and to act before the damage is permanent. What should you be tracking? - Manager Impact Loss (MIL) - Engagement Drop by Team - Manager Transfer Avoidance - Leadership Risk Alerts from HRBPs These are not soft signals. They are leading indicators of retention, risk, and readiness. What do great HR teams do? ✅ Make “Manager Quality” a metric ✅ Track impact at the leadership level ✅ Reward retention, engagement shifts, and feedback culture ✅ Build accountability into dashboards, not just feedback sessions Here's my thought: One bad manager can quietly undo what five great employees are trying to build. And if you’re not measuring it, you’re letting it scale. MIL isn’t just a metric. It’s a mirror. And it’s time we all looked a little closer. I’m actively building this out into a robust diagnostic and strategic tool. If you’re working on culture, retention, manager effectiveness, or HR analytics and want to collaborate, test, or help refine the MIL model, I’d love to connect. Kindly DM Let’s turn this from insight into impact.

🔍 Skeletons in Your HR Closet? Here’s Where They’re Hiding Most HR issues don’t start with a major crisis. They begin as small oversights that grow into lawsuits, fines, and culture problems. A solid HR audit doesn’t just check boxes, it uncovers the hidden risks in your policies, practices, and leadership. Here are 10 areas where HR problems often lurk: 1️⃣ Wage & Hour Classifications Misclassifying exempt vs. non-exempt employees isn’t a small mistake, it’s a legal landmine. ⚠️ Risks: unpaid overtime, missed breaks, contractor misclassification. 2️⃣ Job Descriptions That Don’t Match Reality Outdated or vague descriptions can fall apart during legal reviews. ⚠️ Risks: ADA disputes, discriminatory hiring, lack of role clarity. 3️⃣ Missing I-9s and Work Eligibility Docs If you haven’t double-checked your I-9 files lately, you could be in for a surprise. ⚠️ Risks: undocumented workers, audit penalties, ICE investigations. 4️⃣ Outdated or Missing Employee Handbooks If your handbook hasn’t been reviewed in 2–3 years, it’s likely outdated or missing key policies. ⚠️ Risks: conflicting laws, weak legal defenses, inconsistency. 5️⃣ Inconsistent Discipline Treating similar infractions differently isn’t leniency, it’s liability. ⚠️ Risks: retaliation claims, discrimination allegations, wrongful terminations. 6️⃣ No Formal Harassment or Complaint Process An informal “talk to your manager” policy leaves too much to chance. ⚠️ Risks: unresolved issues, EEOC charges, legal exposure. 7️⃣ Off-the-Books Hiring or Pay Practices Cash payments and skipped payroll taxes might seem flexible, but they’re financially dangerous. ⚠️ Risks: tax violations, back pay, Department of Labor penalties. 8️⃣ No Documentation for Promotions or Raises Can’t explain why one employee got a raise and another didn’t? That’s a red flag. ⚠️ Risks: pay equity claims, favoritism, class action vulnerability. 9️⃣ Chaotic Leave Management “Figure it out as we go” doesn’t work for FMLA or ADA leave. ⚠️ Risks: wrongful terminations, failed accommodations, legal disputes. 🔟 No Exit Interviews or Termination Process If employees leave without being heard, you’re missing valuable intel and inviting problems. ⚠️ Risks: toxic leadership patterns, legal exposure, lost knowledge. ✅ Bottom Line: HR audits aren’t about red tape, they’re your best defense against risk hiding in plain sight. 💬 What’s one area of HR you think most companies overlook? 👉 Follow Ricardo Cuellar and subscribe to the newsletter (Link in bio) for more practical insights on building stronger, safer workplaces.

Most executive teams don’t realize HR is carrying liability until it breaks something big: Turnover. Lawsuits. Damaged trust. By then, you’re in defensive mode. But the truth is, the red flags were always there. Here are 5 HR landmines most leaders miss: 1/ Sloppy documentation habits ↳ Discipline without standards invites lawsuits ↳ Policies that fade away won’t protect you ↳ When documentation begins after a problem, it’s already too late 2/ Retention seen as a goodbye issue ↳ You’re measuring loss too late ↳ Engagement surveys can’t fix what poor structure created ↳ Retention needs to be baked into job architecture, not just benefits 3/ Hiring without proper modeling ↳ Headcount ≠ planning ↳ Without demand modeling, you’re just patching holes, not solving problems ↳ Backfilling a vacancy isn’t always the solution 4/ Org charts that mask reality ↳ Reporting lines look neat on paper ↳ But dotted lines, shadow managers, and role creep tell a different story ↳ If your org chart hasn’t been stress-tested, it’s probably fictional 5/ Delaying clarity until conflict hits ↳ Misalignment doesn’t stay silent ↳ When no one claims it, everyone assumes someone else will ↳ Role clarity is a business catalyst, not a cleanup tool Some of the biggest risks in business don’t live in budgets or ops. They live in your people systems. And HR is where those risks can either escalate or get managed. Like this post? Follow Casey Webster for more on high-impact HR.

Your HR case management system might be creating legal risk.  I’ve heard from more than a few General Counsels who were surprised to learn this: Many HR teams are managing workplace investigations inside tools designed for ticket resolution, not evidentiary preservation. That distinction matters. When access controls are broad, when audit trails are incomplete, or when documentation can be modified without clear traceability, you may be introducing risk you won’t see until litigation. If a system cannot clearly demonstrate what was changed, when, and by whom, the conversation shifts quickly from “what happened” to “what can be proven.” Employee Relations isn’t IT support. It’s risk management.  Most case management systems aren’t built for Employee Relations. HR Acuity is. It is designed to protect privilege and stand up to discovery because when litigation happens, documentation becomes a strategy.  If this is on your radar, I’d be more than happy to share why HR Acuity is built specifically to protect privilege and survive discovery. https://lnkd.in/ecnPnJrz #Discovery #Spoliation #LegalTech #EmployeeRelations 

You can’t manage what you can’t see. When it comes to people risk, most CEOs, CFOs, and CHROs only respond once the damage is already on the balance sheet. But the most effective leaders? They learn to map the risk before it hits. People risk isn’t just about turnover or compliance—it’s the unseen friction that slows growth:  • Misaligned leaders  • Gaps in readiness or skill  • Cultural drag  • Talent density that can't keep up with scale Left unaddressed, these issues quietly compound, and suddenly you’re reacting instead of leading. Here’s how to think about people risk like an operator: 1. Identify the real risks.  Not just the obvious stuff. Look for fragility in places others ignore: decision bottlenecks, single points of failure, untested successors, or unclear ownership. 2. Quantify the cost.  What would it actually cost if that VP walks, if hiring stalls, or if your team starts burning out in Q4? Put numbers to the risk. Otherwise, it stays invisible. 3. Prioritize and plan.  Not every issue is a fire. Some need a fast fix, others a long-game strategy. The key is clarity: know what matters most and build resilience where it counts. This isn’t just HR. It’s operational foresight. If you want to shift from reactive to ready, let’s talk. P.S. What’s your biggest people risk right now? DM me “Consultation Call” or grab time via the pinned 📌 comment below.