Why Role-Based Risk Assessment Matters

Not all professional roles carry the same level of risk.

Employees with privileged access to critical IT systems, sensitive personal data or confidential business information may expose an organisation to different risks than employees with limited access rights.

Similarly, individuals with substantial financial authority, responsibility for critical infrastructure or decision-making powers may occupy positions with particularly significant risk exposure.

These differences are especially relevant in highly regulated industries such as financial services, healthcare, energy, telecommunications and critical infrastructure.

However, identifying and comparing the risks associated with different roles remains a challenge.

Many organisations still rely on general job titles, internal policies or subjective assessments when determining which positions require enhanced security measures or more extensive background checks.

A structured, scientifically grounded approach could help make these decisions more consistent, transparent and proportionate.

This is precisely the objective of the joint research project between Validato AG and FHNW.

Developing a Human Risk Score from 1 to 100

The project aims to develop a scientifically grounded Human Risk Score ranging from 1 to 100, enabling organisations to systematically assess and compare the inherent risk exposure associated with different professional roles.

An essential distinction lies at the heart of the methodology:

The Human Risk Score is designed to assess the risk exposure of a professional role, not the trustworthiness, integrity or reliability of the individual performing that role.

For example, a system administrator with extensive access to critical infrastructure may have a significantly different risk profile from an employee without privileged system access.

Likewise, a finance executive authorised to approve substantial payments may face different risk exposures than an employee without financial decision-making authority.

The proposed model seeks to capture these differences through a consistent and explainable assessment framework.

Four Key Risk Dimensions

The FHNW project team is developing a structured risk taxonomy covering four main dimensions.

1. Information Technology (IT)

This dimension focuses on risks associated with access to IT systems, technical infrastructure, administrative privileges and critical digital environments.

2. Information Security

This area examines exposure to confidential business information, sensitive personal data, intellectual property and other information assets requiring protection.

3. Compliance

The compliance dimension considers risks related to fraud, corruption, conflicts of interest, regulatory obligations and potential compliance violations.

4. Operations

Operational risks arise from responsibilities involving critical business processes, essential services, technical facilities and activities that could affect business continuity or operational safety.

Together, these dimensions are intended to provide a differentiated assessment of the risks associated with individual professional functions.

Combining Occupational Data with Organisational Context

A central challenge is determining how professional roles can be assessed consistently across different industries and organisations.

The project therefore draws on scientific research and established occupational databases.

The project draws on scientific research and structured occupational information to establish a consistent foundation for assessing different professional roles.

This approach supports the systematic evaluation and comparison of job profiles based on their responsibilities, activities and associated risk exposure.

However, general occupational classifications alone cannot adequately reflect the specific circumstances, responsibilities and risk environment of an individual organisation.

Consider two IT administrators: one working for a small professional services company and another responsible for operational technology systems at an electricity provider.

Although their job titles may be similar, their actual responsibilities, access privileges and potential impact on business operations could differ considerably.

To address these differences, the project also incorporates organisation-specific information, including:

  1. Access to sensitive information and critical systems
  2. Financial authority and decision-making responsibilities
  3. Management and supervisory responsibilities
  4. Involvement in business-critical operations
  5. Existing organisational and technical controls

A structured company questionnaire is being developed to capture these factors and complement the occupational data.

The objective is to combine standardised job information with the specific risk environment in which a role operates.

Moving Beyond Black-Box Risk Assessments

Transparency and explainability are central principles of the project.

Rather than generating a numerical score without context, the proposed framework aims to identify the factors contributing to a role’s overall risk exposure.

The planned methodology includes an overall Human Risk Score, individual assessments across the four risk dimensions and an explanation of the most significant risk drivers.

The project team is also exploring Monte Carlo simulations to account for uncertainty in the assessment process.

This approach could help organisations better understand not only the estimated risk level but also the degree of uncertainty associated with the result.

The objective is not simply to generate a number, but to provide a transparent and reproducible basis for risk-related decisions.

Successful Midterm Presentation at FHNW

On 20 October 2026, the project team presented its progress at FHNW in Olten, Switzerland.

The midterm presentation provided an opportunity to review the scientific foundations, discuss the emerging risk taxonomy and examine the proposed methodology for developing the scoring model.

The initial results were encouraging and demonstrated the potential of combining academic research with practical requirements from the background screening industry.

The next phase will focus on refining the risk taxonomy, developing the scoring methodology and building a prototype.

The project will also address validation, practical applicability and relevant legal and ethical considerations.

The final presentation and completion of the research project are scheduled for early January 2027.

What Could This Mean for Risk-Based Background Screening?

For Validato, the project represents an opportunity to further advance the concept of risk-based background screening.

Organisations increasingly need to balance security requirements, regulatory obligations, operational efficiency and employee privacy.

Applying identical screening procedures to every position may not always be appropriate or proportionate.

At the same time, insufficient screening of particularly sensitive roles can expose organisations to significant operational, financial or reputational risks.

A scientifically grounded Human Risk Score could eventually help organisations:

  1. Identify roles with particularly significant risk exposure
  2. Compare risk profiles across departments and business functions
  3. Establish more consistent internal screening policies
  4. Apply background checks in a more targeted and proportionate manner
  5. Prioritise resources within Human Risk Management
  6. Improve transparency and documentation of risk-related decisions

The direct connection between the Human Risk Score and specific background screening packages is not part of the current research project.

Nevertheless, this represents a promising opportunity for future development.

By better understanding the inherent risks associated with individual roles, organisations could eventually make more informed decisions about which verification measures are appropriate.

Legal Compliance and Responsible Risk Assessment

Developing a structured risk assessment model also requires careful consideration of legal and ethical requirements.

The project examines relevant regulatory frameworks, including the Swiss Federal Act on Data Protection (FADP), the EU General Data Protection Regulation (GDPR), Swiss employment law and the EU AI Act.

A particularly important consideration is the distinction between assessing a professional function and evaluating an individual employee.

The proposed Human Risk Score focuses on the former.

It is not intended to predict individual misconduct, determine personal trustworthiness or automatically make employment decisions.

Any future operational application would need to respect applicable data protection requirements, proportionality principles and appropriate human oversight.

For Validato, responsible innovation means combining technological progress with transparency, legal compliance and human accountability.

Bridging Academic Research and Practical Human Risk Management

The collaboration between Validato and FHNW brings together academic expertise and practical experience in background screening and Human Risk Management.

By combining scientific methods with real-world business requirements, the project aims to develop a framework that is both methodologically sound and relevant to organisations operating in complex risk environments.

The ongoing work also highlights the importance of moving beyond generic job classifications towards a more differentiated understanding of role-based risk exposure.

Validato would like to thank the FHNW student project team for its commitment, professionalism and valuable contributions throughout the project.

We look forward to the next milestones and to presenting the final results in early 2027.

Trust matters. Verification protects.