Workforce Risk Signals You Can’t Ignore

Workforce risk is no longer solely an HR concern. It is an enterprise-wide issue that requires collaboration across HR, IT, security, compliance, legal, and leadership teams. This reality was the focus of the recent webinar, Rethinking Workforce Risk: Who’s Accountable? Hosted by Savanna Leavitt-Green, Sr. Director, Strategic Consulting at First Advantage, and featured me alongside Jon Black, SVP of IT Operations at First Advantage. The session dove into the emerging and intensifying challenges organizations face in safeguarding their workforces.

In this article, I’ll highlight key workforce risk signals discussed during the webinar, share practical ways organizations can address them, and explain why information sharing across teams is critical for early detection.

Payroll signals that should raise red flags

One of the most underappreciated risk areas today lies in payroll and HR-related signals. Why? Payroll changes, particularly updates to bank account information, warrant attention because they can indicate potential fraud or other workforce risks. While seemingly unrelated to IT or security, payroll processes are often targeted precisely because they’re overlooked in risk mitigation strategies.

As I mentioned during the webinar: “How often do you change your bank account information for your paycheck? Very rarely, if at all. That’s a pattern you should be looking for.”

Notably, changes in payroll account details that redirect funds offshore can sometimes correspond to fraudulent hires or even nation-state-sponsored actors funneling money from legitimate corporate salaries. These actors often infiltrate organizations by passing pre-hire screening with counterfeit credentials and then operate unnoticed due to siloed processes.

To address payroll risk signals, CFOs or payroll teams can enhance their monitoring frameworks by tracking:

• Frequency of bank account changes. Excessive, unexplained changes may indicate fraud.
• Reason for changes. Explore whether there is documented justification.
• Destination of funds. Offshore transfers deserve closer scrutiny.

These signals provide powerful indicators and are often easier for HR and financial teams to track than IT activity, but they are just one part of the overall puzzle.

Technical signals: what IT should look for

While payroll data can reveal one set of risk indicators, IT teams can help identify potential issues through technical signals. Analysis of device behavior, remote access patterns, and network activity can reveal whether a workforce member is operating in bad faith or under fraudulent circumstances.

Here are some key signs IT teams should prioritize:

1. Unusual Remote Desktop Protocol (RDP) traffic: RDP usage that exceeds average expectations is a red flag, as Jon Black highlighted during the webinar: “If you’re seeing higher-than-average RDP traffic coming out of an endpoint, that’s weird. Look into it. That’s a big signal.”
2. Unusual network traffic: Watch for any unexpected activity going over atypical ports, such as port 22. As Jon said: “We got a bunch of stuff going over Port 22… those are signals. Check into them.”
3. Geo-spatial activity alerts: If a device has static behaviors (e.g., always logging in from a specific city or region) and suddenly shifts dramatically (e.g., showing activity from overseas), it’s worth investigating whether you’re dealing with a fraudulent entity.

By consolidating these data signals into actionable alerts, IT teams can identify unusual activity earlier, ideally as an anomaly starts rather than after damage is done.

Shared accountability: why collaboration is essential

A recurring theme from the webinar was that the most effective risk mitigation programs rely on shared accountability. No single department can manage workforce risk effectively on its own. As Savanna Leavitt-Green stated, “It’s often after an incident occurs that organizations think about working together. Address it now!”

Here are the key stakeholders and their roles in managing workforce risk signals:

• HR: Central to initial employment screening and verification but must share data across departments as risks evolve post-hire.
• Compliance and Legal: Critical for monitoring regulatory frameworks and handling audits. For example, employment discrepancies and fraudulent workers can trigger compliance issues under frameworks like Sarbanes-Oxley (SOX).
• IT: The linchpin in technical signal detection and systems provisioning. IT must play an active role in identifying abnormal device activity, managing access controls, and updating permissions dynamically as employees shift roles.
• Security: Responsible for monitoring insider threats, verifying ongoing identity and behavior, and partnering with IT for real-time risk alerts.
• Executive Leadership: Setting the tone from the top, funding, and maintaining accountability across departments. Without executive buy-in, programs often fail to break down silos.

Beyond background checks

While pre-hire background checks remain a critical part of the hiring process, they are only one component of a broader workforce risk strategy. Fraudulent hires can often pass these checks with synthetic identities. As Jon aptly noted in the webinar: “Background screens are the foundation, but they’re a snapshot at a point in time, and a lot of things change after day one.”

To mitigate workforce risk more effectively, organizations must monitor risk throughout the employment lifecycle. Critical processes include:

• Identity verification at hire: Modern onboarding should include biometric authentication tools like Face ID or Touch ID. As I mentioned during the session: “When you establish those biometric controls as part of the onboarding process, you have a much greater assurance that it’s going to be the person you hired logging in and doing the work.”
• Ongoing compliance checks: Employ continuous monitoring systems that evaluate whether employees are adhering to internal role definitions, permissions, and codes of conduct.
• Access reviews during role changes: Any move within the organization should prompt a full review of access privileges to avoid accumulated risk due to privilege creep.
• Secure offboarding: Immediately deactivate accounts, credentials, and third-party logins during employee separation to prevent lingering vulnerabilities.

Putting it all together

What does an ideal workforce risk management program look like?

It starts with collaboration, aligning HR, IT, security, compliance, and leadership on shared goals, roles, and processes. Once roles are clear, organizations can implement workflows supported by integrated systems, which detect and act on signals from payroll patterns, IT indicators, and ongoing compliance reviews. Executive buy-in can help drive program adoption and cross-functional alignment, while information sharing enables teams to identify and respond to risks more effectively.

As I shared during the webinar, “A little bit of information sharing ahead of time   could make the difference between catching a risk early and letting it operate for months unnoticed.”

Watch the webinar on demand

The webinar, Rethinking Workforce Risk: Who’s Accountable?, dives into these topics in far greater detail. My colleagues Jon Black and Savanna Leavitt-Green joined me to explore real-world examples of workforce risk, like fraudulent “laptop farms.” Watch to learn about actionable strategies for risk detection and mitigation.

Frequently Asked Questions

Recommended Resources

---

Insider Threats Explained

Post-hire | Article

Who’s Accountable for Workforce Risk Management?

Post-hire | Article

Why Identity Checks Can’t Stop at Onboarding

Identity Solutions | Article