11,000 employees laid off by Meta. 10,000 by Amazon, 3,700 by Twitter. And there are heart-breaking stories of thousands more outside of the headline-grabbing FAANG organizations. It is truly an unprecedented time in the once-booming tech industry with recession looming, increasing labor costs, and rising uncertainty.
Throughout my time in risk management, I’ve seen numerous iterations of “knowledge gaps” on organizational risk registers. At a high level, the concern now is centered around the value of the workforce and the gaps created through scheduled and unscheduled turnover.
Caleb Juhnke is Sr. Risk Engineer at Equinix and winner of the 2022 FAIR Ambassador award from the FAIR Institute. Read more blog posts by Caleb.
Caleb receives the FAIR Ambassador award with (from left) FAIR Institute Chairman Jack Jones, FAIR Advisory Board Member Donna Gallaher and Institute President Nick Sanna.Even in the age of automation, employees still power the business. Though good documentation and processes are preventative controls against losing tribal knowledge, they are not silver bullets. The loss categories impacted by employee turnover are replacement costs (recruitment and hiring), loss of employee productivity, customer satisfaction, and product/value delivery.
Measure Twice...
Anyone with exposure to FAIR has likely encountered the famous Bald Tire Scenario. This thought exercise highlights the importance of scenario scoping, risk framing, and context establishment. When considering concerns with employee turnover, it is imperative to identify the right risk scenarios.
The primary value of FAIR is not just risk quantification, but a consistent and defensible decomposition framework of risk that enables proper measurement, accurate comparisons, and effective decision-making. ‘Scoping’ refers to clearly identifying a loss event for which frequency and magnitude can be estimated. Defined in Measuring and Managing Information Risk, the required elements are:
-
Asset – a thing of value that can be impacted resulting in loss.
-
Threat – a person, group of people, force of nature, or other entity that can act against an asset in a way that could result in loss.
-
Effect – the characteristic of the asset impacted by the threat’s actions in context of confidentiality, integrity, and availability.
Is employee turnover a risk? Not according to the above requirements. Employee turnover fails to meet the criteria of containing a threat, asset, and effect. It cannot be an independent loss scenario. But if it matters, it can be measured!
Properly leveraging the FAIR framework enables a nuanced conversation with decision makers and stakeholders to avoid knee-jerk reactions and improper risk register entries by:
- Developing properly scoped loss event scenarios.
- Using issue logs to adjust frequency and impact estimates of existing loss event scenarios.
- Leveraging advanced risk analysis techniques to create comparison assessments of current state loss scenarios against future state loss scenarios.
Employee turnover is an unavoidable fact of business, but it’s impact to your organization can be measured, and used to inform decisions.
So, what do we do with this obvious issue which is impacting a trillion-dollar industry?
...Cut Once!
The value of a risk decomposition framework is specifically scoping loss events to differentiate between risks and issues. ‘Issues’ are concerns across the organization that do not meet the criteria of ‘risk’, but still must be documented, tracked, and treated. An issue log is an excellent source of internal data to influence vulnerability and magnitude estimates. Employee turnover should be viewed as an element of the risk landscape which impacts the way estimates are generated, but should not be a standalone loss event scenario.
The proper way to measure the impact of employee turnover is to make informed adjustments to loss event frequency and loss event magnitude estimates of existing risk register items. For example, an appropriately scoped loss event statement that is already on risk registers reads, “Analyze the risk associated with privileged insider causing an outage of XYZ business process due to non-malicious error.”
Risk analysts could then defensibly adjust frequency and magnitude estimates to capture the uncertainty caused by employee turnover (Note: increased vulnerability, for instance due to reduced security staff, would be captured on the loss event frequency side of the FAIR model). That same estimate adjustment rigor is then applied to other properly scoped risk scenarios across the organization. A risk analyst can make frequency and impact adjustments to all existing risk register items that have departments or business processes impacted by layoffs (sales, operations, HR, etc.)
Now, risk analysts can create comparison risk assessments between the original risk register items against the updated loss event scenarios with employee turnover estimates. The delta between scenarios creates a quantifiable risk increase, enabling apples-to-apples conversation in financial terms.
Conclusion
Properly leveraging the FAIR framework enables a nuanced conversation with decision makers and stakeholders to avoid knee-jerk reactions and improper risk register entries by:
- Developing properly scoped loss event scenarios.
- Using issue logs to adjust frequency and impact estimates of existing loss event scenarios.
- Leveraging advanced risk analysis techniques to create comparison assessments of current state loss scenarios against future state loss scenarios.
Employee turnover is an unavoidable fact of business, but it’s impact to your organization can be measured, and used to inform decisions.
