Risk Management
Risk management identifies, assesses, controls, finances, and monitors events that could affect people, operations, finances, reputation, or legal compliance. HR owns or contributes to employment practices, safety, privacy, information security, business continuity, crisis response, and vendor risk. A simple risk register records likelihood, impact, owner, treatment, and review date. Treatments include avoidance, reduction, transfer, and acceptance. Controls may be preventive or detective. Insurance and contracts can transfer some financial risk, but not all operational or reputational harm.
Safety and workers’ compensation are frequent test areas. Employers must provide a safe workplace, train employees, investigate incidents, and maintain required records. Workers’ compensation generally provides benefits for work-related injury or illness and is often the exclusive remedy against the employer, subject to jurisdiction rules. Recordkeeping questions often turn on whether a case is recordable versus first aid. Privacy and security questions test access control, minimum necessary data, retention, breach response, and vendor oversight.
Traps: confusing risk transfer with risk elimination; assuming an insurance policy solves a compliance problem; and treating a low-probability risk as no risk. Also watch for plans that are written but never tested.
Worked example: a payroll data breach has high impact and moderate likelihood. Controls might include multi-factor authentication, least-privilege access, encryption, vendor security clauses, phishing training, and a tested incident response plan. Rule of thumb: prioritize by likelihood times impact, assign an owner, and set a review date; accepted risks should be documented and monitored, not forgotten.