What the governing body should require for workforce, conduct, and operating-model oversight

Authority disclaimer. This page is an executive narrative. It does not establish requirements; the linked corpus governs. It is provided to support understanding, discussion, and decision-making by the governing body and accountable executive leadership (board, ELT, or senior management, as applicable). It creates no obligation, control, or assurance by itself. Its publication approval is an editorial act only and confers no authority over any corpus document. Where it differs from a corpus document, the corpus document prevails.

People are a dependency of the corpus controls. Access is granted and removed by people, alerts are triaged by people, exceptions are requested and approved by people, and an AI system's outputs are challenged or accepted by people. The corpus therefore governs the workforce itself on three fronts: the conduct it expects, the roles that hold each accountability, and the operating model of forums and reviews on which the running of the controls depends. The human capital and ethical conduct framework is the corpus's consolidated statement of workforce conduct and competency, and the role authority register fixes accountability in named roles rather than named individuals.

For the governing body, the question is not whether the organization employs good people. It is whether the conduct machinery exists, is staffed by accountable roles, and produces evidence that it operates. This brief points to where the corpus defines each part of that machinery. The reading of these documents as one connected workforce control system is synthesized across several corpus sources; see the limitations.

• One consolidated conduct framework. The human capital and ethical conduct framework sets the organization's expectations for ethical conduct and workforce integrity in one place: honest and lawful conduct, anti-bribery controls, whistleblower protection, security awareness, responsible AI training for the roles that build or rely on AI, diversity and inclusion, and a training and competency table with completion requirements per training type. Its governance table names the accountable roles, and it routes training-completion reporting to the oversight bodies it names. Individual requirements in that framework carry their own thresholds and timelines; this brief points to the framework and does not reproduce them.
• A protected route for people to raise concerns. The whistleblower and incident reporting procedure defines the reporting channels, including an anonymous channel, prohibits retaliation against reporters, sets the investigation process, and requires a programme-effectiveness review reported to the executive risk forum it names (its section 6).
• Accountability lives in roles, not individuals. The role authority register defines the generic governance roles used across the whole corpus, the accountability each role carries, and a RACI pattern for the governance activities. Under its maintenance rules the roles remain organization-neutral: an adopting organization maps them onto its own structure, and may combine them.
• An operating model sized to the organization. The minimum viable governance structure guideline shows how the forums the corpus names can be run at tiered reference structures, from a smaller organization consolidating forums into fewer bodies to a large regulated organization running them as discrete bodies. Under its consolidation patterns, the underlying responsibilities remain as the number of bodies is reduced.
• Controls at every stage of the personnel lifecycle. The personnel security screening standard sets pre-employment screening with depth proportionate to role risk. The onboarding and offboarding procedure governs access across the full lifecycle (pre-joining, first day, role changes, voluntary and involuntary departure), carries a deprovisioning checklist, and defines the records retained as evidence (its sections 11 and 12).
• Training that is tracked, not assumed. The security awareness and training standard sets the mandatory modules for all personnel, role-based supplemental training for elevated responsibilities, completion tracking, and programme-effectiveness measurement (its sections 4, 7, and 8). The acceptable use policy sets the boundaries of permitted system use and requires acknowledgement from all personnel.
• Consequences that are graduated and fair. The security disciplinary process procedure classifies violations by severity, sets the investigation and hearing steps, defines graduated outcomes, and provides an appeal route. A consistently applied disciplinary route is a dependency of credible conduct expectations.
• Insider risk governed with explicit safeguards. The insider risk programme framework establishes prevention, detection, response, and learning pillars, and pairs every detection capability with privacy and due-process safeguards and a separate list of deliberate exclusions on what the programme may do. It places independent review of those safeguards with Internal Audit and defines programme metrics, including disciplinary-process adherence and personnel awareness of the programme.
• Rules for AI in everyday work. The ethical AI use guideline translates AI governance into day-to-day expectations for staff, developers, and managers: approved tools only, no sensitive data into consumer AI tools, verification of AI outputs, a route for raising AI concerns, and a set of red lines naming AI uses that are not permitted. The responsible AI training for it sits in the human capital and ethical conduct framework (its principle 5).

For the governing body and accountable executive leadership, the corpus position treats workforce and conduct risk as a matter of evidence rather than trust. The connections drawn here are a composite reading of the sources named above.

• The governing body oversees the machinery; management runs it. Screening, training, acknowledgement, discipline, and monitoring are management's to operate. The governing body's oversight is a dependency on management producing the evidence that each part exists and operates, which the next section expresses as evidence classes.
• The workforce controls form one connected system. The corpus documents reference each other deliberately: the insider risk programme framework draws its prevention pillar from screening, awareness, and departure protocols and coordinates referrals with the whistleblower route; the security disciplinary process procedure receives referrals from monitoring, from managers, and from audit findings. Oversight that examines one piece in isolation leaves the joins between them unexamined; the governing body's questioning is a contribution to oversight, following how a concern travels from report to investigation to outcome.
• Consolidating forums is acceptable; losing accountability is not. A smaller organization does not need every forum the corpus names as a discrete body. The minimum viable governance structure guideline is a contribution to running the corpus operating model through a leaner forum structure, and it maps every named responsibility to a named owner: after consolidation, every accountability still has a named seat.
• Workforce monitoring is bounded by design. The safeguards and deliberate exclusions in the insider risk programme framework are a prevention against the monitoring programme itself becoming the conduct failure. A programme description that lists capabilities without safeguards is out of step with the corpus.
• Some answers are weak answers. "Our people know the rules" without tracked training completion and acknowledgement records is an assertion, not evidence. "We have a hotline" without the effectiveness review the whistleblower and incident reporting procedure requires says nothing about the disclosure activity, outcomes, and awareness the effectiveness review records. And responsibility for conduct attributed to culture rather than to a named accountable role has no seat the governing body can question.

Each item below is an evidence class the governing body can call for from management, and each is evidence for a named control or outcome.

• Training completion reporting, as evidence that the training and competency control operates, per the completion requirements in the human capital and ethical conduct framework (its training and competency section) and the tracking requirement in the security awareness and training standard (its section 7).
• The acceptable-use acknowledgement records, as evidence that conduct boundaries are set and acknowledged by all personnel, per the acceptable use policy.
• The whistleblower programme effectiveness report, as evidence for the required programme review and the disclosure activity, outcomes, and awareness it records, per the review the whistleblower and incident reporting procedure requires (its section 6).
• A forum-to-seat mapping of the adopted operating model, as evidence that every accountability in the role authority register has a named seat, using the consolidation patterns in the minimum viable governance structure guideline where forums are combined.
• Screening completion records, as evidence for the pre-employment control layer, with depth proportionate to role risk per the personnel security screening standard.
• A sample of offboarding deprovisioning records, as evidence that leaver access removal operates, per the checklist and records requirements in the onboarding and offboarding procedure (its sections 11 and 12).
• Disciplinary process adherence reporting, as evidence that consequences are applied consistently and with due process, per the security disciplinary process procedure; the insider risk programme framework carries an adherence measure in its metrics section.
• Internal Audit's review of the insider risk programme safeguards, as evidence that workforce monitoring operates within its privacy and due-process limits, per the independent-oversight requirement in the insider risk programme framework.
• Records that AI tools in use were approved and that raised AI concerns were reported and investigated, as evidence that AI use in everyday work is governed, per the ethical AI use guideline (its guidance for staff and for managers).

• This page creates no compliance and imposes no requirement. The linked corpus documents govern; where this page differs from a corpus document, the corpus document prevails.
• This page carries composite claims. The division of labour it describes (management operates the workforce controls; the governing body oversees them through evidence) and the reading of the named documents as one connected workforce control system are synthesized across several corpus sources. The adopting organization validates that reading against its own employment law, consultation obligations, and governance structure, which may name the committees, roles, and disciplinary steps differently.
• The corpus documents this page points to carry the specific training deadlines, notification timelines, severity classifications, tier profiles, safeguards, and metric definitions. This page routes to them and does not reproduce them. That routing is a contribution to the corpus's status as the single source for every value.
• Employment, privacy, and workforce-consultation law varies by jurisdiction and changes over time; the corpus sources state their own alignment, and the adopting organization confirms current applicability with its own counsel.
• This page makes no claim about how likely any conduct failure is, and none of its statements should be read as a probability or a frequency.