Managing Human Risk

Human risk is the thread that runs through every section of this publication’s security culture domain, from the foundational understanding of why people behave as they do to the sophisticated programme architecture that the evidence base supports as most likely to produce genuine and sustained behaviour change. This closing section brings together the human risk management perspective that provides the governance framing for the entire domain, synthesising the disciplines this publication has addressed into the coherent risk management approach that connects the human dimension of security to the broader risk management framework that the ISO governs across the organisation.

The positioning of human risk within the risk management framework is the governance decision that determines the security culture programme’s organisational authority, its resource access, and its sustained investment rationale. The security culture programme that is positioned as the awareness and training obligation whose value is measured by its completion rates will consistently receive the minimum resource investment that the compliance requirement justifies. The human risk programme that is positioned as the management of one of the organisation’s most significant and most consequential risk categories, with the risk register entry, the board-level visibility, and the risk treatment plan that the risk management framework provides for every material risk, will receive the investment and governance attention that its genuine significance demands.

The Human Risk Landscape #

The human risk categories that the security culture programme must address reflect the full range of the human behaviour dimensions that create security vulnerability in the modern organisational context. The ISO must govern the human risk assessment with the comprehensiveness that recognises each category’s distinct root causes, distinct consequences, and distinct treatment requirements, while understanding the interconnections between categories that make the holistic risk management approach more effective than the isolated treatment of each category independently.