With risk management having bloomed, for many companies, into an essential competency over the past decade, it only makes sense that enterprise risk managers would eventually begin spooning human-capital risk onto their plates. And that is happening – but very slowly, with relatively few yet digging in.

There remains, in a majority of large companies, a wide communications gap between risk and human-resources managers that creates greater exposure to human-capital risk than would otherwise be present.

One big culprit for the disconnect is the tendency for enterprise risk management (ERM) to focus its sights on business-unit leaders rather than functional leaders. "It's a mistake to assume that it's human resources' job to manage human-capital risks, in the same way it would be a mistake to say ERM is responsible for managing operational risk," says Mary Young, principal researcher for human capital with The Conference Board.

Instead, both HR and ERM leaders should bring risk factors to light and provide data-based insights that ultimately help business leaders manage the risks, Young says.

Pointing to a list of 21 human-capital risks that The Conference Board compiled (see below), Young notes, "If you're an HR person looking at this list you'd say, 'Well, this is what we do.' But companies, for the most part, have not considered these risks as part of their overall risk portfolios."

The communications gap is revealed in several ways by The Conference Board's publication last month of a thorough report on managing human-capital risk, the result of a two-year research project.

Among 11 categories of enterprise risks, HR rated human-capital risk as having the greatest impact on the business, while ERM placed it sixth. Yet, the risk professionals judged only one category – political or country risk – to be more poorly managed.

"Less important than the rankings themselves is just the notion that managing human-capital risk is pretty important to success, but organizations aren't doing anything about it," says Ellen Hexter, senior adviser on ERM for The Conference Board.

Also, for 20 of the 21 human-capital risk factors, more HR managers rated them as of "very significant" importance than did the ERM professionals. For example, 74% of the former and 61% of the latter cited "shortage of critical skills within workforce." Other disparities included "shortage of critical skills in the external labor force" (58% to 38%), employee engagement (55% to 38%), and labor costs (44% to 26%).

Explaining those perception gaps, the report's authors noted that HR leaders are steeped in human-capital issues every day and may overrate their importance. At the same time, risk managers either may not be well informed about human-capital risks, or, because they work with a broader spectrum of risks, they view specific human-capital risks as less significant.

"Both sides have blind spots, but there usually isn't an established forum for them to share information," says Young. "Yet each would be more successful by collaborating and bringing these issues into the spotlight that ERM provides because of its mandate to report to the board of directors."

The report indicates that the two sides don't even agree on who participates in human-capital risk assessment. For example, while 56% of risk managers said they assess human-capital risk, only 28% of HR managers thought the other group did so. And almost twice as many in HR believed internal audit was involved in the assessment (27%, compared with 15% for the risk people). Likewise, the groups diverged as to whether their companies had a formal human-capital risk assessment process.

"This too speaks to the facts that they are looking at these issues from different perspectives and don't have enough contact to develop a shared understanding of what's going on," Young says.

Meanwhile, the researchers created a scale of maturity for organizations' efforts on ERM and strategic workforce planning, or SWP (which means systematically connecting business strategy to HR strategy). The scale derived from previous research and ongoing relationships with more than 100 companies that have implemented SWP.

They had hypothesized that companies with a mature ERM process would assess and manage human-capital risk more effectively than those with early- or middle-stage maturity. But the hypothesis proved incorrect: about a third of respondents from companies at all three maturity stages said ERM was effective at assessing the risk.
The same was not the case for SWP. The research found that there was a significant relationship between SWP maturity and effective human-capital risk assessment

In fact, the report noted one company that changed the name of its strategic workforce management program to human-capital risk assessment, to frame it in terms more commonly understood by risk and financial people.

But Young says that she no longer believes, as she did when starting out on the research project, that human-capital risk assessment and SWP are synonymous.

"You can be good at both SWP and ERM and still not be effectively assessing and managing human-capital risk," she says. "The difference is that ERM has been around longer and reports to the board, so there is a regular mechanism and process for it. With SWP, there is no well-worn path. It's on the sidelines, and that limits the impact it can have."

The researchers also asked respondents to gauge how well C-suiters understand human-capital risk. Sixty-five percent said CFOs understand it to "a great extent." With regard to that result, Hexter actually knocks the research. "That doesn't square with my experience," she says. "Sometimes, when you ask someone about someone else's understanding of something, the result is wishful thinking."