For most boards, financial and operational risk are well instrumented. People risk — misconduct, toxic leadership, culture drift, and capability gaps — remains stubbornly under-measured, yet it is precisely where reputations are lost.
Regulators across the UAE, Europe and the wider Middle East increasingly expect demonstrable governance over conduct and culture. A credible people-risk framework starts with three questions: Where are our concentrations of risk? How would we know if something were going wrong? And can we evidence the answer to a regulator tomorrow morning?
The organisations that weather scrutiny are not those with the thickest policy binders, but those with clear accountability, tested escalation routes, and leaders who model the behaviours the policy describes.