From reactive compliance to strategic management: Human Risk as a CHRO and CISO KPI

“Measuring Human Risk can help management identify control gaps, but the indicator must be designed carefully. Measuring the exposure of a role or the coverage of a control is different from profiling an individual,” says André Naef, CEO of Validato. Where an organisation uses personal data for profiling or automated decisions producing legal or similarly significant effects, additional GDPR requirements may apply, including Article 22 where relevant.

This approach allows CHRO and CISO to share a dashboard of risks and controls without necessarily turning every employee into a “score”. Validato recommends prioritising aggregated and role-based metrics, documenting the purpose and legal basis of any personal-data processing, and subjecting individual scoring models to specific review for privacy, employment-law and discrimination risks.

About Validato: Validato is an international provider of background checks and Human Risk Management, headquartered in Zurich, Switzerland, and operating internationally. Its modular, ISO 27001-certified platform enables companies to configure candidate and employee checks according to the role and within the applicable legal framework. Core data is processed and stored in Switzerland and the EU and, under Validato policy, deleted within a maximum of 120 days. No minimum volumes and no setup fees.

Media contact: André Naef, CEO Validato S.A. · Claridenstrasse 34, 8002 Zurich, Switzerland · +41 44 515 77 78 · www.validato.com