In an era where organisations are investing heavily in systems, controls, and automation, one critical variable remains persistently underestimated — human behaviour.
Dr. Jenny Tan, Chair of the Institute of Risk Management (Singapore) and a transformational leader with cross-functional CXO experience across risk, audit, operations, and HR, has been pushing for a fundamental shift: treating human behaviour not as a soft factor, but as a measurable, manageable source of risk — an area she is actively advancing under human risk management (HRM).
In this conversation, she breaks down what it really takes to embed human risk management into organisations, why internal audit must evolve beyond compliance, and where transformation efforts quietly fail.
Highlights
Reframing Risk: From Process to Human Behaviour
Q: You advocate for “human risk management” — but in practice, how do you embed this into an organisation’s risk framework? What actually changes at the process or decision-making level?
A: To roll out human risk management (HRM), the starting point has to be Board and senior management support.
Traditional enterprise risk management (ERM) focuses on strategic, operational, financial, technology, and compliance risks. These are largely process-driven. HRM, however, measures risk directly from human behaviour — which means it sits at a different level.
In my view, HRM should sit at the top layer — where governance and culture drive all ERM components.
To make this practical, organisations need tools to measure behaviour. Every employee can have an individual risk score, derived from how they interact with processes and systems. These scores then become useful in multiple ways: shaping governance behaviour, improving role fit, personalising security training, and even acting as leading indicators for insider threats.
What’s important is that HRM doesn’t require a complete overhaul of processes. The shift is in how you interpret them — understanding what to measure, and why.
At the same time, communication is critical. Employees need to understand what’s being measured, how the data is used, and that individual risk scores remain confidential. Without that trust, the system won’t work.
Redefining Internal Audit as a Business Partner
Q: You’ve repositioned internal audit beyond a traditional control function. What specific shifts made the audit more impactful to the business?
A: I approached this transformation in two parts.
Internally, I focused on shifting mindsets first, then skillsets within the audit team. Externally, I worked to change how the business perceived internal audit — from a policing function to a partner.
A big part of that involved consistent engagement. Through workshops, focus groups, and roadshows, I clarified a common misconception: that the internal audit’s KPI is to produce as many findings as possible.
In reality, our KPIs are tied to business feedback — how much value we’ve added — alongside delivering the audit plan.
KPIs drive behaviour. If you set them wrong, you get the wrong outcomes.
Importantly, our audit methodology didn’t change — but our approach did. We leaned into active listening, put ourselves in the auditee’s position, and used a more consultative communication style.
No one likes being told what’s wrong. But when people feel supported rather than judged, the conversation changes. You move from resistance to collaboration — and that’s where real impact happens.
At the same time, integrity remains non-negotiable. The code of ethics doesn’t change. What changes is how you engage while upholding it.
Why Transformation Breaks — Even When Strategy Is Clear
Q: When driving transformation across risk, audit, and operations, where do initiatives typically break down — and how do you ensure follow-through at scale?
A: Most transformation efforts don’t fail because of strategy. They fail in execution — and the reasons are often predictable.
First, staff turnover resets momentum. New people come in with different beliefs, habits, and levels of ownership. What was once aligned becomes fragmented again.
Second, funding becomes a friction point. Transformation requires resources, and deciding who bears the cost can stall progress.
Third — and most critically — people default to their own KPIs. If a transformation initiative isn’t reflected in what they’re measured on, it won’t get prioritised.
That’s why shared accountability is key. You need “our KPIs,” not just “your KPIs” and “my KPIs.”
And beyond that, “tone at the top” still matters. If leadership signals conflicting priorities, even unintentionally, transformation becomes just another project — not a real shift.
When Human Risk Shows Up in Real Decisions
Q: Can you walk us through an example where a “human risk” issue surfaced — and how it was handled differently from a traditional approach?
A: A good example is the early adoption of AI tools.
When tools like ChatGPT first emerged, we quickly advised that an AI usage policy be established. But when we conducted a governance review, we discovered employees were already experimenting with external tools outside organisational oversight.
This is what we call “shadow AI.”
From a traditional risk lens, you might focus on policy enforcement. But from a human risk perspective, you ask: why are people doing this?
The answer was simple — curiosity and the need to move faster.
So instead of only restricting behaviour, management introduced enterprise-approved AI tools that employees could use safely. That approach acknowledged behaviour and redirected it, rather than trying to suppress it.
That’s the difference. Human risk management doesn’t just control behaviour — it designs around it.
Beyond DEI: What Actually Moves the Needle
Q: As the first woman President of ISACA Singapore and founder of SheLeadsTech, what structural barriers have you seen — and what actually works in changing them?
A: One of the biggest challenges is that diversity and inclusion efforts are often treated as “nice-to-have” initiatives rather than structured priorities.
Without systems in place, these efforts struggle to sustain.
Even in organisations with fewer structural barriers, you don’t always see women stepping into leadership. Confidence, culture, and self-belief all play a role.
Real change requires both sides.
Organisations need to genuinely believe that diversity improves performance and culture — not just optics. At the same time, individuals need to step out of their comfort zones and take ownership of their growth.
There’s no single solution. Progress is gradual. But platforms — especially through non-profit and industry communities — play a meaningful role in creating momentum and influence.
Final Thoughts: The Risk Most Organisations Still Don’t Measure
For decades, organisations have invested in systems to manage risk — frameworks, controls, and compliance structures designed to reduce uncertainty.
But the most unpredictable variable has remained largely unmeasured: human behaviour.
What Dr. Jenny Tan’s work makes clear is that the next evolution of risk management isn’t about adding more controls. It’s about understanding how people actually behave within those systems — and designing with that reality in mind.
Because in the end, risks don’t materialise on spreadsheets.
They materialise through decisions.
And the organisations that learn to see, measure, and manage that layer effectively won’t just reduce risk — they’ll move faster, adapt better, and operate with far greater clarity than those still relying on process alone.
Highlights
Read the Chinese article here.
