Understanding how personnel risk develops over time
Organisations responsible for protecting critical infrastructure invest significant effort in pre-employment screening. Background checks, security clearances, verification processes and role-suitability assessments help ensure that individuals entrusted with sensitive systems, operational technology or critical information demonstrate the integrity, judgement and reliability required for high-trust roles on which the organisation depends.
These pre-employment screening processes establish an important baseline.
But they cannot guarantee that circumstances will remain unchanged.
People’s lives evolve. Personal circumstances change. Financial pressures emerge. Relationships develop. External events reshape geopolitical and economic realities. Over time, these changes may alter the security risk environment surrounding an individual who holds high-trust access within an organisation.
This is why mature Trusted Workforce Programs recognise that trust decisions cannot remain static.
Personnel security frameworks, therefore, do not treat screening as a one-time exercise. Instead, they view it as the starting point of an ongoing suitability assessment process.
The Australian Government Personnel Security Adjudicative Standard, which forms part of the Commonwealth Protective Security Policy Framework (PSPF), identifies seven risk factor areas that may affect an individual’s reliability, judgement or vulnerability to influence. These risk factor areas are used by Australian Government vetting agencies when determining whether to grant a security clearance and when reassessing the ongoing suitability of clearance holders.
The framework requires vetting authorities to apply structured professional judgement, considering the “whole person” and the context of the individual’s circumstances when making suitability determinations. The seven risk factor areas reflect internationally recognised personnel security adjudication practices and are broadly aligned with approaches used by Australia’s Five Eyes partners and other national security communities. These risk factor areas are typically examined during pre-employment screening and adjudicative suitability assessments.
However, these same risk factor areas are equally relevant when considering ongoing suitability during employment.
Pre-employment screening establishes a baseline level of confidence in an individual’s reliability and integrity at the time access is granted.
Ongoing suitability assessment asks a different question: Has anything changed in these areas that may affect the relationship between the individual, the role they perform, and the level of trust associated with that role?
Understanding these domains allows organisations to recognise emerging vulnerabilities early and respond in a structured, proportionate and well-governed way.
Importantly, the purpose of examining these risk factors is not to assume wrongdoing. In most cases, they help organisations recognise circumstances that may create unintentional vulnerability through stress, financial pressure or external influence. In rarer situations, however, behavioural indicators may also reflect intentional manipulation or disregard for organisational controls. Effective workforce assurance programs must, therefore, remain attentive to both dynamics – unintentional and intentional – while ensuring that assessments remain fair, proportionate, legal and grounded in context.
A Realistic Scenario: When Circumstances Change
Consider a realistic scenario.
David is an engineer working for a major Australian electricity provider responsible for maintaining operational technology systems that support energy distribution. His role provides privileged access to systems that underpin critical infrastructure.
When David joined the organisation several years earlier, he successfully completed pre-employment screening, including AusCheck background check. During recruitment he disclosed that he has close family members living in Iran. At the time, this connection was documented but did not raise concern.
Several years later, however, the geopolitical environment changes. A military conflict involving Iran significantly alters the regional security landscape. Intelligence and security agencies begin warning about increased risks of foreign interference targeting individuals with family connections in affected regions.
At the same time, economic instability begins affecting David’s extended family overseas, creating financial pressure for relatives who rely on his support.
David has done nothing wrong. He remains a capable and trusted employee.
But the context surrounding his circumstances has changed.
Situations like this illustrate why workforce assurance cannot rely solely on the judgement made at the time of recruitment. Organisations must also consider how evolving personal circumstances, external pressures and behavioural changes may interact over time.
To understand how organisations should interpret such situations, it is useful to examine the seven risk factor areas that underpin both initial screening and ongoing suitability monitoring.
1. External Loyalties, Influences and Associations: When Personal Circumstances Intersect with Geopolitical Change
The first risk factor concerns external relationships or obligations that may create vulnerability to foreign interference, coercion or divided loyalties.
During pre-employment screening, organisations often consider factors such as:
- overseas family connections
- foreign financial interests
- outside employment or affiliations
- close relationships with foreign nationals.
These factors are not inherently problematic. Many professionals working in global industries maintain international relationships, financial interests or family ties across borders.
However, external circumstances can change the risk environment in ways that may alter the vulnerability surrounding an individual’s circumstances.
In David’s case, his family connections in Iran were disclosed during recruitment and were not considered a concern at the time. But several years later, a regional conflict changes the geopolitical landscape. Intelligence agencies warn that individuals with family members in affected regions may face increased risk of foreign interference or coercion.
Suddenly, a previously benign circumstance becomes relevant to workforce security risk.
In this situation, the organisation does not assume misconduct. Instead, it recognises that external events may have created new pressures that did not previously exist.
A responsible organisational response focuses on awareness, support and protective safeguards. This may include:
- briefing David and other employees in similar roles on the evolving threat environment, ensuring they understand how foreign interference approaches may occur and what warning signs to look for
- providing clear guidance on how to respond if they experience unusual contact, pressure or requests for information, including how to report such approaches safely and confidentially
- offering support where external circumstances may create personal or family pressures, recognising that early disclosure enables the organisation to help protect both the employee and their family
- reviewing whether existing safeguards, role design or access arrangements remain appropriate in light of the changing threat environment.
For David, his responsibility is equally clear.
If he experiences pressure relating to his family overseas, he must disclose it through the organisation’s established reporting channels. Early disclosure allows the organisation to provide support and ensure that appropriate safeguards are in place.
It is also important for organisations to avoid assuming that all individuals will view disclosure obligations in the same way. People from different cultural and political backgrounds may bring very different experiences of authority, government and reporting.
For some individuals, disclosing sensitive family, financial or overseas matters to an employer or government authority may feel deeply unsafe, particularly if in their country of origin such disclosure could have led to surveillance, punishment or harm.
This does not remove the need for disclosure in high-trust roles. However, it does mean organisations should approach these conversations with cultural awareness, clarity and care, rather than assuming reluctance automatically reflects dishonesty or disloyalty.
2. Personal Relationships and Conduct: Behavioural Changes as Early Indicators
The second risk factor concerns behaviour that may indicate changes in judgement, reliability or integrity.
During pre-employment screening, organisations assess whether individuals demonstrate honesty, maturity and willingness to comply with rules and professional standards. However, during employment the focus shifts from static assessment to observing changes in behaviour over time.
Many of the earliest indicators of emerging workforce risk appear not in formal records, but in subtle shifts in behaviour.
These may include:
- increasing secrecy or reluctance to discuss work responsibilities
- manipulation or deception in professional interactions
- persistent conflict with colleagues or supervisors
- reluctance to follow established processes or oversight mechanisms
- concealment of information relevant to organisational obligations.
Importantly, behavioural change does not automatically indicate malicious intent. In many cases, such changes reflectpersonal stress, workplace dissatisfaction or external pressures affecting the individual.
However, in roles involving sensitive systems, privileged access or critical infrastructure, behavioural changes may signal that an individual is experiencing circumstances that warrant attention and support.
Returning to David’s situation, the evolving geopolitical environment and growing concern for his family overseas could understandably create emotional and psychological strain.
Colleagues may begin noticing subtle changes. David, who previously collaborated openly with his team, may become more guarded when discussing certain aspects of his work. He may appear distracted in meetings or less willing to engage in routine oversight discussions.
Individually, these behaviours may seem minor. But taken together, they may indicate that David is under pressure.
For organisations responsible for protecting critical infrastructure, the appropriate response is not suspicion but early awareness and supportive engagement.
A responsible organisational approach may include:
- maintaining a workplace culture where employees feel comfortable discussing concerns or pressures affecting their work
- encouraging supervisors to recognise behavioural changes and initiate supportive conversations when appropriate
- ensuring that workforce assurance processes allow concerns to be assessed fairly and proportionately.
For David, maintaining openness with trusted supervisors and using established reporting channels can help ensure that pressures affecting his circumstances are addressed early, allowing the organisation to provide support while maintaining the integrity of the role.
Recognising behavioural change as a potential early signal allows organisations to identify emerging vulnerabilities before they escalate into more serious insider risk situations.
3. Financial Considerations: When Economic Pressure Creates Vulnerability
Financial pressure is one of the most widely recognised risk factors in personnel security frameworks.
Significant personal debt, financial hardship or sudden unexplained wealth can increase vulnerability to bribery, fraud, coercion or other forms of undue influence. For individuals working in critical roles that involve access to sensitive systems, information or operational decision-making, financial stress can create circumstances that may be exploited by others.
During pre-employment screening, organisations may examine indicators such as financial stability, bankruptcy records or other signs of significant financial distress. However, financial circumstances can change considerably during employment.
Common indicators that may warrant attention include:
- significant personal debt or financial hardship
- sudden lifestyle changes inconsistent with known income
- gambling problems or financial disputes
- pressure arising from supporting family members facing economic difficulty.
Financial stress does not imply dishonesty or wrongdoing. Many employees experience financial pressures at different stages of their lives, often for entirely understandable reasons.
However, when financial stress intersects with roles that involve privileged access, procurement authority or control over critical systems, organisations must consider whether additional safeguards or support may be required.
Returning to David’s situation, the geopolitical conflict affecting Iran has significant economic consequences for his extended family. Currency instability and disruption to local employment mean that relatives increasingly rely on David for financial assistance.
As these pressures grow, David may find himself under increasing financial strain.
Again, David has done nothing wrong. Supporting family members in difficult circumstances is a normal and commendable human response.
But the situation illustrates how changing external circumstances can create new vulnerabilities that did not exist when David was originally assessed for the role.
A responsible organisational response focuses on support, transparency and early engagement. This may include:
- ensuring employees understand that financial pressures affecting their circumstances can be discussed confidentially
- reinforcing that early disclosure allows the organisation to provide support while maintaining appropriate safeguards
- reviewing whether role design, access arrangements or oversight mechanisms remain appropriate where financial stress may increase vulnerability.
For David, openness about emerging financial pressures allows the organisation to help manage potential risks while ensuring that he continues to perform his role effectively.
Recognising financial stress early allows organisations to respond proportionately and prevent situations where unmanaged pressure could later be exploited by external actors.
4. Alcohol and Drug Use: When Impairment Affects Judgement and Reliability
Substance misuse is recognised in personnel security frameworks as a risk factor not because of moral judgement, but because it may affect judgement, reliability and impulse control.
For individuals working in roles that involve safety-critical operations, sensitive information or privileged access to organisational systems, cognitive impairment can significantly increase risk.
During pre-employment screening, organisations may examine whether there is a history of substance misuse that could affect an individual’s suitability for the role. However, as with other risk factors, circumstances may change during employment.
Indicators that may warrant attention include:
- repeated concerns about intoxication or impairment
- deterioration in reliability, punctuality or attendance
- incidents suggesting impaired judgement
- breaches of workplace substance policies.
In many cases, substance misuse reflects underlying personal stress, health issues, past trauma or difficult unresolved life circumstances rather than malicious intent.
Organisations responsible for critical infrastructure must, therefore, approach this risk factor with care, respect, discretion and proportionate response.
Returning to David’s situation, the pressures associated with geopolitical uncertainty and concern for family members overseas could understandably create emotional strain. While there is no indication that David is experiencing substance misuse, situations involving sustained stress highlight why organisations must remain attentive to factors that could affect wellbeing and judgement over time.
Where concerns arise, responsible organisational responses should prioritise support and early intervention. This may include:
- encouraging employees to seek confidential assistance where personal difficulties affect wellbeing
- ensuring supervisors recognise signs that may indicate an employee is struggling
- providing access to employee assistance programs or professional support services
- assessing whether temporary adjustments to duties or responsibilities may be appropriate.
In Trusted Workforce Programs, the objective is not punishment but maintaining safety, reliability and trust while supporting employees who may be experiencing personal difficulties.
Recognising and addressing potential impairment early helps organisations protect both their people and the critical systems those people are entrusted to operate.
5. Criminal History and Conduct: When Legal Obligations and Trust Intersect
Another risk factor considered in personnel security frameworks is criminal conduct. This factor examines whether an individual’s behaviour demonstrates respect for legal obligations, honesty and responsible decision-making.
During pre-employment screening, organisations often review criminal history records to determine whether past conduct may affect an individual’s suitability for a role involving trusted access. However, as with other risk factors, circumstances may evolve during employment.
Matters that may warrant attention include:
- new criminal charges or convictions
- association with criminal actors or networks
- behaviour suggesting disregard for legal or regulatory obligations
- activities that could expose the organisation to reputational or legal risk.
Importantly, the existence of a criminal allegation does not automatically determine an individual’s suitability. Personnel security frameworks emphasise the importance of context, proportionality and fairness when considering such matters.
For example, the nature of the offence, the circumstances surrounding it, the time that has passed, and the relevance of the behaviour to the individual’s role must all be considered carefully.
In David’s situation, there is no indication of criminal behaviour. However, the scenario illustrates why Trusted Workforce Programs must consider how changing personal circumstances and external pressures could, in rare cases, create situations where individuals may be exposed to coercion or inducement by others engaged in unlawful activity.
Where credible concerns arise, a responsible organisational response should focus on fair assessment and due process. This may include:
- ensuring that allegations are assessed based on verified information rather than speculation
- considering whether the conduct is relevant to the individual’s role or access
- providing the individual with an opportunity to explain the circumstances
- determining whether additional safeguards or oversight are required.
For individuals working in trusted roles, maintaining openness about legal matters that may affect their suitability is essential. Early disclosure allows organisations to assess the situation fairly and ensure that appropriate protections remain in place for both the employee and the organisation.
Ultimately, the purpose of examining criminal conduct within Trusted Workforce Programs is not to judge past mistakes but to ensure that individuals entrusted with critical responsibilities continue to demonstrate the reliability and integrity required for those roles.
6. Security Attitudes and Violations: When Behaviour Reflects Respect for Controls
One of the strongest indicators considered in personnel security frameworks is an individual’s attitude toward security rules and organisational controls.
While occasional mistakes can occur in any workplace, persistent disregard for security procedures may signal declining reliability, poor judgement or reduced respect for organisational safeguards.
In environments responsible for protecting critical infrastructure, where employees may have privileged access to operational technology systems, sensitive information or safety-critical processes, adherence to security controls is essential.
Indicators that may warrant attention include:
- repeated non-compliance with established security procedures
- misuse of credentials, systems or access privileges
- bypassing or disabling security safeguards for convenience
- careless handling of sensitive or restricted information.
In many cases, these behaviours arise not from malicious intent but from operational pressure, complacency or a belief that security procedures are unnecessary obstacles to efficiency.
However, over time, such patterns can weaken the protective controls that organisations rely upon to safeguard critical systems.
Returning to David’s situation, there is no suggestion that he has intentionally violated security procedures. However, the pressures associated with his personal circumstances and concern for his family overseas illustrate why organisations must remain attentive to behavioural indicators that may signal declining focus or increasing stress.
For example, if an employee who previously demonstrated strong adherence to procedures begins bypassing routine controls or accessing systems outside normal operational requirements, this may warrant supportive engagement and clarification.
A responsible organisational response focuses on reinforcing security culture rather than assigning blame. This may include:
- ensuring employees understand the purpose of security controls and how they protect both the organisation and its workforce
- encouraging open discussion when operational pressures make procedures difficult to follow
- addressing patterns of non-compliance through coaching, training and supervision rather than immediate punitive action.
For individuals working in trusted roles, consistent adherence to security procedures is an important demonstration of professional responsibility. Respect for organisational controls helps ensure that critical infrastructure systems remain secure and resilient.
Over time, patterns of behaviour, both positive and negative, provide valuable insight into how individuals understand and respect the responsibilities associated with trusted access.
7. Emotional and Mental Health Factors: Recognising Human Pressures
The final risk factor considered in personnel security frameworks relates to significant changes in emotional stability, wellbeing or behavioural functioning that may affect an individual’s judgement or reliability.
This area is sometimes misunderstood. Personnel security frameworks do not treat mental health challenges as inherently problematic. In fact, seeking professional help is often considered a positive indicator of responsible behaviour and self-awareness.
Concerns arise only where emotional distress or personal difficulty begins to affect an individual’s ability to perform a role requiring consistent judgement, reliability or trusted access.
Indicators that may warrant attention can include:
- severe emotional distress affecting workplace functioning
- unusual volatility or behavioural instability
- difficulty coping with pressure in roles requiring sustained judgement
- significant changes in behaviour that suggest an individual may be struggling
- patterns of manipulative or exploitative behaviour that may indicate intentional attempts to circumvent controls or influence others.
While many behavioural indicators arise from personal stress or changing life circumstances, research in organisational psychology also recognises that certain personality traits, sometimes described as the “Dark Triad” (narcissism, Machiavellianism and psychopathy), can be associated with manipulative, deceptive or self-serving behaviour. In trusted roles, such traits may manifest through deliberate rule-bending, exploitation of colleagues or attempts to manipulate organisational processes.
These situations are far less common than stress-related behavioural changes, but they illustrate why workforce assurance programs must consider both vulnerability-based and intentional behavioural risks when assessing ongoing suitability.
In many cases, such pressures arise from ordinary life circumstances. Family illness, financial strain, relationship challenges or geopolitical events affecting loved ones overseas can all create emotional stress for employees.
Returning to David’s situation, the uncertainty surrounding his family’s wellbeing during a regional conflict could understandably place considerable emotional strain on him. Concern for family members in unstable environments is a normal human response.
In such circumstances, a responsible organisational approach prioritises support, understanding and early engagement. This may include:
- encouraging employees to seek assistance where personal pressures affect wellbeing
- ensuring access to confidential support services or employee assistance programs
- creating an environment where individuals feel safe discussing challenges that may affect their work.
For individuals working in trusted roles, recognising when personal circumstances begin to affect their wellbeing, and seeking support early, is an important part of maintaining professional responsibility.
Trusted workforce programs therefore aim not only to identify emerging vulnerabilities but also to ensure that employees receive the support necessary to remain reliable and effective in their roles.
Connecting the Risk Factors to Insider Risk Pathways
Understanding these seven risk factor areas helps organisations recognise how ordinary human circumstances can evolve into potential vulnerabilities over time.
Importantly, the presence of a risk factor does not mean an individual poses an insider threat. Most people who experience financial pressure, personal stress or changing external circumstances continue to act responsibly and professionally.
However, research into insider incidents consistently shows that harmful insider behaviour rarely appears suddenly. Instead, it often develops through a gradual interaction between personal pressures, behavioural changes and organisational responses.
Clinical psychologist and former intelligence officer Dr Eric Shaw describes this process as the Critical Pathway to Insider Risk. In this model, personal stressors, behavioural indicators and situational pressures interact over time. When such pressures are combined with access to sensitive systems or information—and when warning signs are missed or misunderstood—vulnerabilities can escalate into more serious insider risk situations.
Returning to David’s scenario, none of the factors described automatically indicate wrongdoing. However, the combination of geopolitical change, family pressure and potential emotional strain illustrates how external circumstances can reshape the risk environment surrounding a trusted employee.
For organisations responsible for protecting critical infrastructure, the objective is not to view employees with suspicion, but to ensure that workforce assurance systems are capable of recognising evolving circumstances and responding in a structured and proportionate way.
By understanding these seven risk factors, and by maintaining supportive, well-governed processes for ongoing suitability assessment, organisations can protect both their people and the critical systems entrusted to them.
The Purpose of Trusted Workforce Programs
Ultimately, trusted workforce programs are not about searching for wrongdoing but about managing security risk. They are about recognising that people operate within changing personal, social and geopolitical environments. By maintaining structured and proportionate approaches to ongoing suitability, organisations can support their employees while ensuring that the trust placed in individuals who protect critical infrastructure remains justified over time.
