A Human Capital Perspective on Risk and Value

In a recent shift, U.S. banking regulators have formally removed “reputation risk” from supervisory frameworks and examination content, a change formalized in a rule issued jointly by the OCC and the FDIC (see press release). Their rationale reflects a practical reality: reputation is difficult to define and measure. For more than twenty-five years, regulators have explicitly attempted to incorporate such factors into formal risk frameworks. Removing reputation risk from supervisory frameworks does not diminish the importance of these drivers of value; it underscores the limits of those frameworks in capturing qualitative elements such as reputation, culture, and human capital.

Some of the most consequential drivers of firm value remain only partially visible within existing frameworks, raising a more fundamental question: how should firms understand and manage what they cannot fully measure? Many of the dynamics that ultimately shape reputation stem from human capital, which is itself difficult to measure and manage. One way to approach this question is by examining how human capital shapes both value and risk within the firm.

Human Capital and Contributions to Firm Value

For decades, executives have insisted that “people are our greatest asset” and that people are central to value creation. But in financial terms, they do not appear on the balance sheet as assets. They are attributed in terms of costs: compensation, benefits, training, and other expenditures that are treated as expenses rather than sources of value.

In today’s economy, it is increasingly evident that the primary drivers of firm value extend well beyond physical assets, with many of the most highly valued companies deriving their strength from less tangible sources. This is reflected in equity markets, where firms built on technology, data, brand, and organizational capability consistently dominate. Intuitively, this reinforces the idea that people matter. Yet how human capital contributes to firm value, and the risks it introduces, remain only partially understood, particularly from a quantitative perspective.

The result is not merely an accounting inconvenience; it is a strategic and risk management challenge. When the value of these investments cannot be clearly measured or recognized, it becomes difficult to manage them with confidence. And when they cannot be managed with confidence, they become a source of uncertainty.

Risk and Compliance Considerations of Human Capital

From a risk perspective, human capital sits at the intersection of two traditionally separate domains. On one side is the familiar “people risk”: issues such as misconduct, internal fraud, regulatory breaches, and liability exposure. These are typically addressed through compliance frameworks, controls, and oversight mechanisms. On the other side is a less developed but arguably more consequential dimension: the role of people as drivers of firm value and, by extension, a source of strategic risk.

It is this second domain that is underdeveloped in risk frameworks. The modern firm is increasingly exposed not just to the risk that employees might do something wrong, but to the risk that it does not fully understand the value they create or fail to create. This includes the risk of misallocating talent, of underinvesting in critical capabilities, or of losing key individuals whose knowledge and relationships are not easily replaced. This is especially so with the growing use of AI talent. These are not compliance failures; they are failures of valuation and strategy.

The literature on knowledge work underscores how difficult it is to map effort to output. Productivity is not necessarily linear. For example, research on “superstars” suggests that a small number of individuals generate disproportionate value, but that contribution remains heavily dependent on the systems in which they operate. This variability introduces a form of volatility into the organization that is rarely captured in traditional risk models.

This points to a broader view of risk management, one that extends beyond compliance and control into the domain of strategic resilience. Human capital is not simply a category of risk to be mitigated; it is the foundation of the firm’s ability to generate value over time. The risk is not only that something goes wrong, but that the organization fails to fully leverage what is already in place.

Rethinking Risk Frameworks to Incorporate Human Capital

The recent removal of reputation risk from supervisory frameworks highlights an important boundary in risk management, on which human capital sits. This suggests a need to rethink how risk is framed. Rather than treating human capital solely as a source of discrete risks to be mitigated, it may be more useful to view it as a source of variability in performance, capable of both amplifying and constraining outcomes across the firm.

Incorporating human capital into risk frameworks, however, is not straightforward. The challenge is not simply a lack of data, but the nature of what is being measured. Human capital is inherently uneven and constantly evolving, making it difficult to reduce it to stable metrics or standardized models.

A range of approaches has been proposed to better incorporate human capital into risk frameworks. Rather than attempting to survey these approaches, it may be useful to focus on a single perspective that aligns with the characteristics described above: viewing human capital as a source of volatility in performance.

Framed in this way, the issue is less about isolated risks and more about the distribution of outcomes across the firm. Human capital introduces a level of volatility that is not easily captured through traditional models, which tend to assume more stable and predictable relationships. At the same time, this volatility is often concentrated in specific individuals, roles, or teams, creating exposures that may not be immediately visible. Together, volatility and concentration provide a more useful lens for understanding how human capital shapes both value and risk. In this context, reputation can be seen not as a primary risk factor, but as a reflection of how these underlying dynamics play out in the firm’s outcomes.

Closing Thoughts

The removal of reputation risk from supervisory frameworks highlights the limits of what can be formally measured and managed. Human capital sits at that boundary. The challenge for firms is not to force human capital into existing models, but to evolve those models to better reflect their role. This requires a shift from viewing people primarily as a source of downside risk to understanding them as a driver of outcomes, variability, and concentration. This shift has the potential to shape how firms assess both value creation and risk going forward.

Contributed by:

• Michelle Tuveson, Chair and Executive Director of the Cambridge Centre for Risk Studies at the University of Cambridge Judge Business School.
• Joe Iraci, former CRO of Robinhood and TD Ameritrade, former Head of Business Oversight at J.P. Morgan Self-Directed Investing, and Deputy Chief Operational Risk Officer at Deutsche Bank