By LiAnn Tang
for the 2025 Risky Women Writing Competition, presented in partnership with Ocorian
While we obsess over systems and regulations, the human workforce—the true backbone of any organization—remains overlooked in risk assessments. It’s time to change that focus for genuine resilience.
AI. Operational resilience. CPS 230.
I can’t open a report, conference agenda, or LinkedIn feed without being told these are the “hot topics.” And it’s true—they matter. AI is reshaping decision-making, regulators are doubling down on resilience, and new standards like CPS 230 are forcing boards and executives to think more critically about end-to-end risk.
But amid all this noise, one thing remains missing from the conversation.
People.
Over the past years, I’ve reviewed more risk assessments than I can count. They’ve covered everything from tweaks to processes, to full system upgrades, to the decommissioning of entire products. The correspondence was exhaustive. Every step documented. Every potential operational failure modeled.
Yet not once did those risk assessments capture changes that affected people.
I don’t mean people as an afterthought – “training will be provided” or “change management will be undertaken.” I mean people as the central risk: outsourcing decisions, restructures, or capability shifts that change who does the work and how it gets done.
And here lies the paradox: the very thing that holds all of our resilience frameworks together – the human workforce – is the least formally risk assessed.
Why does this blind spot persist? I see three reasons:
1. Ownership is unclear. People risks are often siloed into “HR issues” rather than framed as operational risks with systemic consequences.
2. They’re harder to quantify. It’s easier to measure downtime of a server than the disengagement of a workforce. Numbers give comfort; culture feels slippery.
3. It’s uncomfortable. Nobody wants to write a risk assessment that essentially says, “Our people might fail.” But pretending otherwise doesn’t make the risk go away.
This avoidance comes at a cost. We obsess over cyber breaches, but ignore the fact that the majority of cyber incidents involve human error. We design frameworks for AI bias, but overlook that it is people who feed, train, and approve those models. We talk about resilience in systems, yet rarely resilience in teams.
The cracks show quickly when people are ignored. Outsourcing creates dependencies that aren’t well understood until they break. Restructures hollow out institutional knowledge that no playbook can replace. Training gaps lead to mistakes in customer interactions – mistakes that erode trust far faster than any system outage.
I’ve seen this firsthand where offshore teams talk over customers, trying to match words to a script rather than listening. Agents repeating phrases that don’t quite make sense because the process gaps left them guessing. It’s not malicious—it’s systemic. And yet, when those same calls are reviewed, the findings fall under “quality assurance” rather than being elevated to the risk register.
If CPS 230 is about operational resilience, shouldn’t these people risks be treated with the same weight as system failures or third-party contracts?
Here’s the challenge for 2025: let’s stop treating people risks as soft, cultural, or “HR’s problem.”
People risks are operational risks. They create single points of failure, concentration risks, and resilience gaps. They determine whether a process succeeds or fails. They are the difference between a control operating effectively or breaking down under pressure.
We need to embed people change into our risk assessments. That means:
– Treating restructures as risk events.** Who owns the work after? What knowledge is lost?
– Risk assessing outsourcing decisions.** Beyond cost, what are the resilience implications? What if the provider fails or disengages?
– Measuring capability gaps.** Not just whether training is offered, but whether skills are embedded and sustained.
Most importantly, we need to be braver in naming people as both a strength and a vulnerability. Because resilience is not just about systems and processes. It’s about whether the right people, with the right skills, are in the right place at the right time.
AI may automate tasks, and CPS 230 may formalise resilience frameworks. But technology doesn’t comfort a customer in financial hardship. It doesn’t make the judgment call on a borderline loan. It doesn’t decide whether to escalate an issue or let it slide.
People do.
If we continue to ignore people in our risk assessments, we are building resilience on a hollow foundation. And that is the riskiest decision of all.