Operational Risk Management – Common Operational Risk Area 4 – Human Resources


Continuing with our columns on operational risk management, we will now discuss operational risk area 4 – Human Resources-Employees/Volunteers. There are a lot of elements and moving parts to this common operational risk area. Human Resource (HR) professionals have a challenging time keeping up with all the changes and nuances of this very important element of almost every business, nonprofit, medical or dental practice. Everyone generally agrees that getting the proper people in the proper position is key to any successful business, nonprofit, medical, and dental practice. That said, having a HR professional in your corner is paramount because there are some issues that may arise that can dramatically affect your operations and expose your organization to liabilities that may cause you serious financial, legal, and personal harm. Along with all of that is the “trust” factor that all owners place in their employees and volunteers to do their best, be professional, and ethical. As we all know, sometimes that trust is misplaced or violated at the expense of the business, nonprofit, medical, or dental practice. Now we will list some potential HR operational risk areas that may affect your organization.


Lack of an employee handbook, is the most common liability risk factor identified during a risk assessment. The employee handbook is important in many ways and affords protection from unexpected events such as sexual harassment, poor employee performance, employee disputes, discrimination, and work place violence. Having a well-crafted employee handbook can resolve issues and protect both the employer and employee from potential litigation. Example: An employee files a sexual harassment complaint again a supervisor or fellow employee. Some of the first questions to be asked by attorneys are “what does your sexual harassment policy say, is the policy in writing, do all the employees know what the policy is?” If that subject is appropriately covered in your employee handbook and each employee signs for a copy of that handbook, you are most likely in good shape. On the other hand, if you do not have an employee handbook or you do not have a sexual harassment policy, you face increased risk of lability. Of course, the more areas (work place performance/conduct, hiring/termination, job description/duties, etc.) that are covered the better. That said, the employee handbook needs to be routinely updated as laws change, or new laws are enacted. An employee handbook is especially important with the Medical Marihuana and Recreational Marihuana laws in Nevada. The employees need to know the company’s policy with regards to use of marihuana in the workplace and during duty hours.

Trusted Employees/Volunteers/Staff

Trusted employees are very important to the operation of any business because they handle day-to-day tasks that keep the business running, save owners time/energy, and maintain the institutional company knowledge. In addition, trusted employees become, or are friends with, the owner, and sometimes trusted employees are family members. The more trust you place in an employee without verification or proper internal controls, the greater the risk. As mentioned in the previous column titled Internal Controls, checks and balances need to be in place for everyone regardless of their position or status in the company. It’s just business, nothing personal as the saying goes. Example: An office manager of a small company is a trusted employee who has worked for the company for 20 years. The owner allowed the office manager to use the company credit card for office purchases, authorize the purchases, receive and reconcile credit card statements, pay the monthly credit card statement, and maintain the credit card statements in the office file. The owner allowed this because he completely trusted the employee who was known for over 20 years. The owner also stated that by giving all that responsibility to the employee saved him time and trouble. Well, I think you know what comes next, his trusted employee purchased personal items, sold some of the items, and pocketed the money from the sale of those items. The office manager’s fraudulent activity lasted two years and $25,000 later before it was discovered. The owner let the office manager resign but did not report the fraud to law enforcement. Now that person is free to move to another position in another company, to possibly commit the same type of fraud.

There are many reasons trusted employees commit theft and fraud, some of the reasons are:

  1. They are greedy
  2. They have financial troubles
  3. They feel excluded
  4. They believe they aren’t getting paid enough
  5. They feel as if it is a temporary loan which will be paid back

One of the major factors that the trusted employee can commit theft or fraud is because they are trusted so much, because they are family members, longtime friends, or longtime employees with an unblemished work record. Even when the owner(s) are presented with proof of theft or fraud, the owner(s) can’t believe it because the owner(s) refuse to believe that the trusted employee would/could do such a thing.

Below are some types of offenses that trusted employees may commit:

  1. TheftStealing money or items from the business, nonprofit, medical, or dental practice.
  2. Vendor fraudCreating false vendor invoices that go to an account that the trusted employee opened. Working with a third party (or vendor) to inflate charges and then split money.
  3. Copay or Down payment fraud Not recording/depositing money received from patients or customers for medical copay or down payments. Doesn’t provide receipts or records cash received.
  4. Information theftStealing proprietary, personal, or customer/patient information and selling it to third parties for cash.

Here are some indicators (red flags) of employee theft/fraud:

    1. Business seems to be doing well but the revenue is low or doesn’t seem right.
    2. There are always some type of shortages, cash, inventory, stock, etc.
    3. Unusually high invoices for routine supplies or services.
    4. One employee has total control of assigned duties for a particular task. Example: No separation of duties for office credit card use, statements, or payment.

In summary, owners have a great deal of responsibility to their business, their employees, and to their customers/clients/patients, and trusted employees are vital in the success of any organization. However, owners must ensure that trusted employees stay trusted employees by verifying their work.