Workforce risk management and mitigation

As complex global forces of change and the threats they bring converge, Canadian organizations need to consider the implications for their people, including the wide range of workforce risks that are emerging. Those organizations that get a proactive handle on and take a holistic approach to these workforce risks stand to benefit in many ways, notably through enhanced competitive advantage and improved financial performance. We saw evidence of this in our 2023 Global Risk Survey, in which the vast majority (84%) of organizations identified as being leaders in risk management reported improved financial performance through their approach to risk.

What is workforce risk?

Workforce risks typically stem from the ways employee actions and behaviours affect their employers or involve external forces that impact their people. Consider, for example, the impacts of generative artificial intelligence, a technological disruptor that offers many opportunities but also carries significant risks and implications for both organizations and their employees.

An important priority for organizations looking to adopt generative AI will be ensuring they have the right people with key skills to see the full benefits of the technology. At a time of competition for and shortages of talent, the lack of skills in areas like AI represents an important workforce risk, especially given the pressures on organizations to reinvent their businesses through investments in technology. We saw evidence of this concern in our latest Global CEO Survey, in which 53% of respondents said a lack of skills was inhibiting their organization from changing the way it creates, delivers and captures value.

Workforce risk management a growing imperative for Canadian organizations

These are just some of the reasons why organizations need to make workforce risk management a strategic business priority. Beyond the implications for access to skills and talent, key impacts include those related to an organization’s ability to navigate a changing regulatory and compliance landscape, optimize its strategy and operating model and protect and enhance its brand. Returning to the example of generative AI, other workforce risks stem from the need to ensure a just transition for employees whose roles are displaced as well as guard against cybersecurity and data privacy threats that can harm an organization’s reputation internally and externally and impact shareholder value.

While organizations have always faced workforce risks to one degree or another, they’ve increased significantly due to complex global forces that create new challenges and standards organizations must adapt to.

(Swipe table to the left to view all content)

See below to learn about these global megatrends and a small snapshot of the workforce risks they can create.

	Implications for organizations	Examples of workforce risk created
Technological disruption	Technology creates tremendous opportunities for value creation but also presents possibilities for risks and disruption.	Employee behaviours are often key contributors to vulnerabilities leading to cyberattacks that reduce trust and open an organization up to regulatory scrutiny and compliance risks, all of which can affect financial performance and shareholder value.
Demographic shifts	We now have five different generations in the workforce, each with different experiences influencing their needs and expectations.	A more socially aware younger generation might want their employer to take a public stand on controversial issues, which can create internal pressures and conflict and impact the organization’s brand and reputation externally.
Climate change	Organizations need to rethink their footprint and operations in light of the wide-ranging impacts of climate change, as well as consider employees’ concerns and views about this key global challenge.	Organizational resilience may suffer if companies fail to ensure employee safety and provide the workforce with the resources needed to continue operations in the face of the physical disruptions caused by climate-related events. Generational issues also come into play here, with younger workers more likely to be concerned about a company’s impact on climate change and wanting to work for organizations that reflect their values.
Social instability	Ongoing societal changes and growing concerns about social equality are creating new pressures and eroding trust in institutions and organizations.	Amid a heightened focus on diversity and inclusion and the introduction of equity initiatives like pay transparency laws by governments across Canada, organizations that fail to meet rising expectations and evolving compliance requirements may see negative impacts on their internal and external image and their ability to attract and retain people with key skills.
A fracturing world	An increasingly uncertain geopolitical environment creates added challenges for organizations navigating evolving local and international issues.	Geopolitical volatility heightens risks for organizations that have employees in regions where conflict breaks out.

While these forces have been playing out for some time, they continue to intensify and layer on top of each other to further heighten the increasingly interconnected workforce risks they create. And while an organization may be able to deal with an issue or crisis related to one of these risks, it might find itself crippled when multiple events happen at the same time.

Adding to these challenges is the ongoing decline of societal trust, which only increases the need for leaders to better understand and mitigate their workforce risks given how they can impact an organization’s reputation and how both their people and their wider group of stakeholders view an organization. More than ever, companies are coming under intense scrutiny of their actions, whether a result of the spread and amplification of information (and disinformation) on social media or rising expectations from stakeholders. Among those keeping a close eye on what organizations are doing are regulators, which continue to roll out new regulations that bring significant implications for workforce risks given both the need to ensure compliance and some of the people-related requirements they introduce (see below for more details).

Pillar Two: Canadian legislation to implement the Organisation for Economic Co-operation and Development’s Pillar Two provisions, which set a minimum global tax rate, introduces several workforce risk considerations for companies subject to it. These include setting aside dedicated resources, upskilling employees and establishing cross-disciplinary teams with the expertise necessary to meet complex data and compliance requirements.

Canada’s Modern Slavery Act: A piece of legislation that goes to the heart of the brand and reputation as well as the regulatory and compliance implications of workforce risk is Canada’s Fighting Against Forced Labour and Child Labour in Supply Chains Act. The law requires affected entities to publish a report each financial year that discloses the steps they’ve taken to prevent and reduce the risk of using forced or child labour in their operations and supply chains. Organizations subject to it need to proactively analyze the risks, identify gaps, educate all stakeholders—including employees—and put in place policies to mitigate risks and navigate worst-case scenarios.

Corporate Sustainability Reporting Directive (CSRD): The European Union’s new environmental, social and governance (ESG) provisions include a number of workforce reporting requirements on metrics covering issues like equality in pay, fair remuneration, absenteeism and health and safety. Many Canadian companies are unaware that the CSRD applies to them. Companies subject to it will need to quickly work out how they’ll comply and gather and report the required data and information, which they can then use to bolster stakeholder trust in their track record on ESG issues.

Broadening the approach to today’s increasingly complex workforce risks

As they navigate these heightened expectations in an increasingly complex environment, how have Canadian organizations been responding? Typically, organizations start considering these issues as a reaction to events facing the business, the industry it operates in or society more broadly. More often than not, responsibility for managing the workforce risks caused by these events falls to human resources functions, which tend to respond in the ways they know best by, for example, rolling out a new policy or training.

The tendency to react to events means organizations may miss key risks or allocate significant resources to issues that aren’t their top priorities. A more proactive approach would involve taking the time to assess and understand the full range of issues they face, but recent studies show opportunities for Canadian organizations to do more to measure their exposure to risks and embrace new ways to navigate them. As we found recently in our Global Risk Survey, only about half (54%) of Canadian respondents have implemented an effective horizon scanning capability that offers a more holistic view of their risk landscape.

And by focusing the responsibility for managing workforce risks on the HR function, responses may deal with only part of the organization, whereas the most effective approach might require changes involving other areas of the business. Training initiatives on ethical behaviours, for example, may not be sufficient to address many of the workforce risks related to generative AI. While involving the HR function in such training is likely critical to managing these risks, it’s also important to bring in technology leaders to consider the need for measures like implementing an identity access management program to prevent disclosures of confidential information—such as employee salary or health data—through adoption of a generative AI tool.

Turning workforce risk strategies into an enabler of competitive advantage

The approach taken by many organizations means they may not fully benefit from the competitive advantages and improved financial performance seen by those that adopt best practices around managing risk and enhancing compliance. For example, they may miss out on the cost savings a more holistic approach can deliver by directing resources and investments to an organization’s priority workforce risks that offer the biggest opportunities for value creation or preservation.

The key to harnessing those benefits is to take a more strategic, enterprise-wide approach to workforce risk that’s underpinned by human insight and technology and rooted in the organization’s purpose and values. This means upskilling your teams and using data-driven tools to better understand, monitor and report on your organization’s workforce risks, determine your risk appetite and thresholds and prioritize areas that require the most attention and resources. This gives you a comprehensive view of your workforce risks so you can then take a broader perspective that supports and engages key functions across the organization in any changes made in response.

Workforce risks have evolved to the point where it needs to be a holistic conversion involving the full executive team. What does this mean for some key functions? Explore below to learn about the considerations for select executive team members and key questions they can ask themselves, each other and their people:

Chief executive officer

Why it matters: CEOs have an interest in all aspects of workforce risks. They need to be accountable to their stakeholders for the organization’s risk profile while responding to pressures like inflation and ensuring employee well-being and skills availability. Taking an enterprise-wide view of workforce risks can help them work collaboratively and proactively with board members on ensuring the resilience of the organization in the face of complex forces of change.

Key questions:

How well do we understand the risks and opportunities within the workforce?
How resilient is our organization in light of current macroeconomic conditions, especially recent inflationary pressures?
What tools are available to better measure and evaluate the effectiveness of our workforce risk management strategies?

Chief human resources officer

Why it matters: As they navigate the many issues impacting the workforce, CHROs will face rising pressure to deliver a workforce strategy that supports the company’s reinvention goals. For them, taking a broader approach to workforce risks that involves their executive colleagues can support their case for the resources and funding to make necessary investments.

Key questions:

Do we have a clearly articulated workforce risk strategy that helps our people deliver on our organization’s purpose and drive business strategy?
Are there opportunities for the HR function to add further business value by enhancing workforce risk awareness and understanding?
Is there sufficient cross-functional collaboration in managing workforce risks?

Chief financial officer

Why it matters: The chief financial officer plays an important role in ensuring value creation and preservation by helping create workforce efficiencies and managing the many costs associated with poor branding and compliance.

Key questions:

What are the key factors affecting workforce costs in our business?
What questions and concerns are we hearing from shareholders, board members and other stakeholders about workforce risks and the impacts they can have on the business?
Have we considered the costs related to workforce risks faced by other organizations, including peers in our industry?

Chief security officer

Why it matters: The chief security officer requires a risk-aware culture to ensure the company’s information and data are safe and secure. Given the role employees play in security events like a cyberattack, the chief security officer will want to be involved in discussions about the risks created by the workforce.

Key questions:

Have we done enough to incorporate workforce risk mitigation strategies into our security procedures and processes?
What are the key contributors to security risks in our organization? How many of these relate to employees and their actions and behaviours?
Do we need to do more to help the workforce understand cyber threats and take appropriate actions during an incident?

Strengthening resilience through the workforce

For organizations that take the time to fully assess their workforce risks and embrace new approaches to managing them, the impacts on the business can be significant. We’ve seen, for example, organizations achieve powerful outcomes through broad, purpose-driven transformation programs based on instilling the right culture and behaviours across their workforce. The result has been organizations that are better able to attract and retain key talent, enjoy stronger relationships with their customers and regulators and have a workforce ready to be ambassadors for their employers.

Successes like these show the opportunities available for organizations to strengthen their resilience through their workforce. By harnessing the power of technology and data in new ways and bringing more diverse, multidisciplinary perspectives and capabilities to discussions about workforce risks, organizations can turn an increasingly complex landscape into an enabler of growth and change as they face the challenges ahead.

How can you get started?

To help Canadian organizations navigate these challenges, we’ve built a workforce risk diagnostic tool that provides them with insights into their unique issues. It incorporates more than 400 risks to help organizations assess and understand their enterprise-wide workforce risk landscape. It’s all part of our workforce risk integrated solution, which combines the insights of our broad range of subject matter experts with technology to help organizations adopt a more proactive approach and create new value.