Reporting people risk alongside financial risk
Report workforce exposure with the same clarity of ownership and action as other risks, while respecting the limits of people data.
The performance question
Financial reporting often makes assumptions and variances visible. People risk reports can instead list activity without explaining the consequence for delivery. Connect a staffing or workload issue to a specific process, describe the uncertainty and identify the decision management needs.
What the evidence supports
FRC Principle O calls for an effective risk and internal control framework. ICO guidance treats health information as special category data with additional processing requirements. It is under review following legislative change, so organisations should check the current position before implementing new data practices.[1][2]
A practical approach
Include risk description, consequence, owner, control and trend in the established register. Use aggregated operational measures wherever sufficient and state their limitations. Keep individual clinical information in appropriate restricted systems, not routine board packs. Involve the privacy lead before creating new health related reporting.
How to review progress
Review whether indicators led to action and whether controls reduced the specific exposure. Avoid implying precision from a composite people score. Show data gaps and changes in definitions, especially when a trend is used to justify a material spending decision.
Sources and references
- UK Corporate Governance Code 2024 Opens in a new tab
Financial Reporting Council
Application; Principles A, E, F, I, J and O; Provisions 2, 5, 6, 17, 28 and 29
- Data protection and workers health information Opens in a new tab
Information Commissioner’s Office
Special category data, lawful processing, minimisation and security. Guidance is under review following legislative change