Human risk ('the risk of people doing things they shouldn't, or not doing things they should') is the largest single risk facing all organisations -- when things go wrong, there's always a human component, either causing the problem or making it worse. Collectively, companies spend billions trying to manage human risk via functions like Compliance, InfoSec, Risk, Audit, Legal, Human Resources and Internal Comms -- it is people in these functions, as well as those tasked with managing people, that is the target audience for the book. Technology exacerbates the problem by providing each of us with 'weapons of mass destruction' from a human risk perspective -- even the most junior employee can cause huge damage via their keyboard, either in the work environment or via their personal social media account - and by taking over basic, repetitive tasks, which mean people are spending more time in 'human risk sensitive' activities. Traditional approaches to mitigating human risk rely heavily on the idealised presumption that because people are employed, they can simply be told what to do -- this works well in safety-critical environments, where the 'black & white' parameters of desired outcomes are easy to predict, but is much harder when it comes to 'grey', less codifiable, areas like ethics which are often difficult to monitor until it's too late and rely on employees being positively engaged. If we want to mitigate the risks posed by human decision-making, then we need to base our approach on an understanding of how humans actually make decisions, which is where Behavioural Science -- a discipline based on academic research and field-tested on 'real' humans by advertisers, governments and transport authorities -- can help achieve better outcomes. This book is designed to help all those involved in managing human risk to achieve 'compliance' with a small 'c' -- in other words, getting their desired outcome -- and explores how organisations can get the best out of their people by designing frameworks that work with, rather than against, the grain of human thinking. Readers will learn to challenge their existing presumptions about managing human risk and discover practical techniques and examples they can deploy in their work environment.
