Workforce assurance in critical infrastructure series
Executive Summary
For Australia’s critical infrastructure entities, the greatest personnel security risks rarely arise at the point of hiring. They emerge later as access expands, responsibilities increase, pressures accumulate, and trust is tested over time. Workforce assurance, therefore, cannot stop at pre-employment screening. It must extend across the entire employment lifecycle, shaping how people are supported, how concerns are addressed, and how access and relationships are governed when circumstances change.
Ongoing suitability is not about surveillance, suspicion or constant re-checking. It is about maintaining alignment between enterprise and role-based security risks, access, wellbeing and governance as circumstances evolve. Because people and their workplace behaviours are not static, unrecognised or unsupported vulnerabilities can become pathways to insider risk, often without malicious intent.
Equally important is the role of reporting, psychosocial safety and trust. Most insider incidents are preceded by observable signals that are noticed by others long before formal intervention occur. Where reporting mechanisms are unclear, mistrusted or punitive, those signals are suppressed. Where reporting is safe, well communicated and reciprocal, organisations gain early insight and the opportunity to intervene supportively, before issues escalate into incidents.
Offboarding is one of the most underestimated security phases in the employment lifecycle. Emotional volatility, loss of identity, perceived injustice and concentrated knowledge make exit periods uniquely sensitive. Poorly managed offboarding can turn otherwise manageable risk into active harm. Post-employment risk also deserves attention: access to knowledge, relationships, systems and influence does not automatically end on the last day of work, and may persist long after formal employment has ceased.
This article argues that workforce assurance must evolve from a hiring-focused activity into a model of continuous assessment, one that supports people, protects information and critical assets, and manages risk proportionately over time. Ongoing suitability and secure offboarding are components of a mature, trusted workforce capability, aligned with Critical Infrastructure Risk Management Program expectations, the Protective Security Policy Framework, the Australian Standard 4811:2022 and international good practice.
Together with the first two articles in this Workforce Assurance in Critical Infrastructure series, this piece completes a practical narrative on how organisations can design and operate a Trusted Workforce Program in-house: why background checks alone are insufficient; how proportionate, risk-led screening can be built using existing organisational processes; and why trust, support and governance across the employment lifecycle ultimately determine organisational resilience.
Collectively, the series is intended to articulate the core principles of workforce assurance and provide practical guidance on how critical infrastructure entities can design, implement and sustain a trusted workforce program internally, rather than relying solely on external background checking or clearance mechanisms, which, while valuable, were never designed to manage insider risk across time.
Why the highest-risk period is after hiring
Most workforce assurance systems are designed around a single decision point: whether someone should be allowed in. Once that decision is made, attention fades.
Background checks are completed. Onboarding is finalised. Access is provisioned. The individual becomes part of the organisation. And with that, the implicit assumption emerges: the risk has been addressed. This assumption is not only incorrect, but also structurally dangerous.
Risk does not peak at the point of hiring; it accumulates as access, trust and responsibility grow.
As people move through an organisation, several things happen simultaneously: access expands, system knowledge deepens, informal influence grows, relationships widen, familiarity with controls increases, and understanding of what “really” happens, versus what is written, sharpens. Shortcuts become normalised, and trust is increasingly assumed rather than actively examined.
None of this is inherently problematic. In fact, it is what enables organisations to function efficiently. Competence, autonomy and institutional memory are operational strengths. But it also means that the consequences of misuse, error or compromise become far more significant over time.
At the same time, pressure accumulates on a person.
People experience financial stress, family breakdown, health challenges, burnout, grief, frustration, career stagnation, perceived injustice, moral injury and identity conflict. Organisational change, restructures, leadership turnover and shifting priorities can compound these pressures.
None of these are indicators of malicious intent. But all of them can create vulnerability. This is the core misunderstanding in much workforce assurance thinking: that vulnerability equals wrongdoing.
Vulnerability is a normal human condition. It is also the point at which risk becomes possible. If organisations do not have systems to notice, understand and support vulnerability, they are not reducing risk, they are suppressing it.
What ongoing suitability actually means
Ongoing suitability is often misunderstood as a form of constant monitoring, repeated checking, or suspicion directed at individuals.
At its core, ongoing suitability is a risk management function. It exists to help organisations notice when conditions that once supported safe and effective participation begin to change. Risk does not arise because people are flawed; it arises when changing conditions go unrecognised or unmanaged. Ongoing suitability assessment enables earlier, more proportionate responses, before those shifts escalate into harm.
It is also a governance function. Trust is essential to organisational functioning, but trust that is not revisited, examined, and supported can quietly become blind. Ongoing suitability ensures that decisions about access, authority, and responsibility remain visible, reviewable, and defensible over time. Without this, suitability becomes an assumption rather than a managed condition.
Just as importantly, ongoing suitability is a duty of care. It recognises that fatigue, distress, overload, grief, and uncertainty are not personal failures, but predictable features of human life. When these pressures intersect with access and consequence, risk becomes possible. Supporting people early, through dialogue, role adjustment, temporary controls, or workload rebalancing, is often the most effective way to prevent later harm.
Ultimately, ongoing suitability should function as a support system, not a control system. Its purpose is not to police behaviour but to help people remain safe, effective, and trusted in roles that carry pressure and consequence. Suitability is not something individuals must “maintain” alone. It is something organisations help sustain.
What a proportionate ongoing suitability model looks like
If ongoing suitability is misunderstood as vague, subjective, or ad hoc, it will inevitably be resisted. In practice, proportionate suitability models are structured, predictable, and role-governed, designed to be fair, defensible, and transparent. Their purpose is not to create friction, but to maintain alignment between trust, access, pressure, and governance as conditions evolve.
A defining feature of a proportionate model is that it is risk-led and role-based rather than person-based. Suitability is not reassessed because someone feels “concerning” or “different.” It is revisited because the risk profile of a role has changed, or because the consequences of failure have increased.
This distinction matters because it prevents suitability from becoming personalised, discriminatory, or arbitrary. High-consequence roles warrant more attention not because the people who occupy them are less trustworthy, but because the impact of failure is greater. By anchoring suitability to role risk rather than personal suspicion, organisations preserve dignity while strengthening governance.
Proportionate models are also trigger-based rather than continuous. They do not require constant checking, but rely on meaningful review points that signal a potential shift in conditions. These triggers are not accusations; they are prompts to pause and reassess whether the existing balance between trust, access, and support remains appropriate.
Common triggers include:
- Changes in role or responsibility
- Expansion of access or privileges
- Significant organisational restructures
- Disciplinary processes
- Major life events (where disclosed)
- Unusual or high-risk travel patterns
- Security incidents or near misses
Credible concerns raised by others.
In this sense, proportionate models function less like surveillance systems and more like early-warning frameworks. Their value lies not in the volume of data they collect, but in the timing of the insight they enable.
Proportionate models are also layered rather than monolithic. No single signal should ever determine suitability. Instead, decisions are informed by multiple partial perspectives, including:
- What people disclose about themselves
- What managers observe
- What peers notice
- What systems record
- What governance structures require.
Because each of these inputs is incomplete on its own, suitability must be assessed in context. This layered approach reduces false positives, avoids overreaction, and enables responses that are calibrated rather than blunt.
In practice, organisations draw from a toolbox of mechanisms, selecting and combining them based on role risk, operational context, and organisational maturity. This may include:
- Role-based reassessment following changes in responsibility
- Access reviews when privileges expand
- Trigger-based suitability check-ins
- Structured performance and wellbeing conversations
- Targeted re-screening for high-consequence roles
- Clearly defined escalation pathways
- Temporary role adjustments or access constraints
- Formal review points for sensitive positions
The value of this toolbox lies not in any single tool, but in how the tools are combined, governed, and adapted over time.
A proportionate model does not aim to eliminate risk. Its purpose is to make risk visible, manageable, and governable. It allows organisations to respond early, gently, and fairly, rather than late, bluntly, and defensively.
Reporting as the cornerstone of ongoing suitability
If ongoing suitability is about recognising when conditions change, then reporting is how those changes are first seen. Most serious insider incidents are preceded by observable shifts in behaviour, tone, routines, language, or engagement that are noticed by other people long before they appear in logs, dashboards, or alerts. Yet despite this, reporting remains one of the most fragile and underutilised elements of workforce assurance.
Research shows that employees’ perception of organisational support, whether they feel valued, treated fairly, and cared for, strongly shapes their behaviour, wellbeing, and orientation toward the organisation over time. Large-scale meta-analytic evidence demonstrates that perceived organisational support is closely linked to trust, commitment, performance, and reduced counterproductive behaviour. This helps explain why people are more likely to speak up, raise concerns, and engage early when reporting feels safe, reciprocal, and worthwhile underscoring why workforce assurance must extend beyond entry screening and be sustained across the employment lifecycle.
This fragility is often masked by increasing reliance on technology. Organisations now deploy sophisticated monitoring systems, behavioural analytics, and artificial intelligence to detect anomalous activity. These tools are valuable, but they are limited. They can identify patterns, but they cannot interpret meaning, intent, or context. Technology can show what has changed, but it cannot explain why. By contrast, humans are highly attuned to subtle social and contextual cues. They notice when something feels “off” long before it becomes measurable. Early warning signs of insider risk are therefore usually social before they are technical.
This is why the most useful signals are often not explicit events but weak indicators: the absence of usual behaviour or the presence of something unusual. A person who was once engaged becomes withdrawn. A careful employee becomes careless. A collaborative colleague becomes defensive. These are not evidence, proof, or accusations. They are early disruptions in pattern. When interpreted with care, they provide a window for support, clarification, and early intervention.
Yet many people do not act on what they notice. They hesitate because of loyalty, fear of being wrong, fear of retaliation, cultural stigma, or uncertainty about what will happen next. Silence is rarely indifference; it is usually the product of social and emotional pressure. Reporting systems that ignore this reality will always fail, regardless of how well they are documented.
Language plays a critical role here. Terms like “snitching,” “dobbing in,” or even “whistleblowing” frame reporting as betrayal. By contrast, phrases such as “raising a concern,” “flagging a change,” or “seeking support” frame it as care.Framing shapes behaviour. If organisations want early insight, they must design language that lowers emotional barriers rather than reinforcing them.
Effective reporting systems therefore do not rely on moral courage alone. They are deliberately designed to feel safe, non-punitive, and worthwhile to use. People need to know where to go, what will happen, who will see their concern, and how it will be handled. Without these assurances, even the most observant employees will remain silent.
Integrating reporting into ongoing suitability governance
Reporting only becomes meaningful when it is embedded within governance. Without structure, it becomes noise, gossip, or escalation theatre. With structure, it becomes insight.
There is no single correct location for reporting within an organisation. Some route concerns through HR, others through security, ethics, integrity units, or line management. What matters is not the organisational label, but the capability. Reports must be received by people who can respond with judgement rather than reflex, and with discretion rather than defensiveness.
When a concern is raised, the default response should not be punishment, but triage. Most reports do not point to malicious intent. They point to stress, confusion, misunderstanding, or misalignment between role demands and human capacity. The question is not “Who is at fault?” but “What has changed, and what does it mean?”
Mature systems distinguish between observation, intervention, control, and separation. Not every observation requires intervention. Not every intervention requires restriction. Not every restriction requires removal. Thresholds matter because they protect people from overreaction and organisations from blind spots.
Governance frameworks that integrate reporting into ongoing suitability create predictable, fair, and proportionate responses. They allow early support to be offered before escalation becomes necessary. They also ensure that when escalation is required, it is defensible, documented, and humane.
Offboarding as a Security Event
Offboarding is often treated as an administrative formality. In reality, it is one of the most psychologically and operationally sensitive phases of the employment lifecycle. It is a moment of transition in which access, identity, relationships, and expectations are renegotiated, often under emotional strain.
At the point of exit, multiple risk factors converge. Access may still be active. Knowledge is frequently concentrated. Identity and status are disrupted. Grievance can peak. Loyalty may shift. Even amicable departures can be emotionally complex, particularly when they involve uncertainty about the future or perceived loss of standing. These dynamics do not imply malicious intent, but they do create volatility. This is what makes offboarding a structurally sensitive moment rather than a routine one.
When offboarding is poorly managed, this volatility can transform otherwise manageable risk into active harm. Data may be exfiltrated, credentials misused, relationships leveraged, and narratives hardened. When it is well managed, however, offboarding can close loops, preserve trust, and protect both the organisation and the individual.
Security-centric offboarding is not about suspicion; it is about foresight. It treats departure as a moment that requires deliberate design rather than procedural automation. In practice, organisations draw from a toolbox of proportionate mechanisms, selected based on role risk and context. These may include:
- Timely revocation of physical and digital access
- Structured knowledge transfer and handover
- Asset return and reconciliation
- Clear reminders of ongoing confidentiality and post-employment obligations
- Exit conversations that address security as well as logistics
- Defined post-exit contact protocols for high-consequence roles
- Targeted follow-up where risk justifies it.
What matters is not the presence of every possible control, but the presence of intent. Offboarding should be designed to acknowledge emotional complexity, reduce ambiguity, and keep access, responsibility, and obligation aligned through the transition.
The aim is not to criminalise departure. It is to recognise that exits are moments of heightened vulnerability: for people and for systems. Treating them as routine is not neutral; it is risky.
Post-employment risk: The forgotten phase
Most workforce assurance frameworks end when employment does. Risk does not. Departure marks a change in relationship, not an immediate erasure of influence, knowledge, or access pathways. Former employees often retain deep contextual understanding of systems, informal networks, and decision-making dynamics. They may remain socially embedded, continue to be contacted by colleagues, and, in some roles, become more visible and more valuable to external actors precisely because they are no longer constrained by organisational obligations.
This matters because contemporary threats increasingly target people rather than systems. Competitors, activist groups, and hostile actors rarely begin with technical intrusion; they begin with human approach. For some individuals, particularly those who held high-consequence roles, departure can increase rather than reduce exposure. This is not an argument for suspicion; it is an argument for realism.
Recognising post-employment risk does not mean that former employees should be monitored indiscriminately. It means that post-employment exposure should be considered proportionately, just as pre-employment and in-role exposure is.
A proportionate approach acknowledges that most roles require nothing more than respectful closure, clear contractual obligations, and a well-managed exit. A much smaller subset of roles, those involving sensitive knowledge, strategic influence, or critical access, may justify additional care because the consequences of misuse remain high.
In practice, organisations again draw from a toolbox of options, selecting mechanisms based on role risk, context, and time horizon. These may include:
- Reinforced confidentiality and non-disclosure reminders
- Time-bound post-exit contact protocols
- Restricted or delayed re-access to systems
- Targeted access audits for high-risk roles
- Defined cooling-off periods before certain types of external engagement
- Clear boundary-setting around ongoing relationships
The aim is not to constrain people, but to reduce ambiguity about boundaries.
Whatever form these practices take, they must be transparent, limited, and grounded in legitimate organisational interests.They must respect privacy, avoid retaliation, and be clearly communicated. The purpose is not surveillance. It is stewardship: a recognition that trust, like risk, does not end abruptly, and that transitions deserve as much care as entry.
Conclusion
Workforce assurance has traditionally been framed as a hiring problem. This is a structural mistake.
Trust is not established at entry. It is sustained over time. People change. Roles evolve. Pressures accumulate. Access expands. Dependencies deepen. Vulnerabilities emerge. The highest-risk period is therefore not the moment of hiring, but everything that follows.
Together with the first two articles in this series, this piece has argued for a shift from clearance to care, from screening to continuous assurance, and from assumption to governance. Ongoing suitability, reporting, offboarding, and post-employment awareness are not separate processes; they are components of a single lifecycle system.
Organisations that treat workforce assurance as a capability rather than a checklist build resilience. Those that do not accumulate invisible risk. In critical infrastructure, trust is not a feeling. It is a system.
