Risk, Ethics and Governance

Introduction

Employee onboarding is often treated as an administrative transition: a new employee completes forms, receives equipment, attends orientation, and begins work. At graduate level, however, onboarding should be understood as a high-risk organizational process. It is the point at which the organization collects sensitive personal information, grants access to systems, communicates employment conditions, establishes supervisory relationships, introduces workplace norms, and creates records that may later be examined by regulators, courts, auditors, unions, or employees themselves.

A poorly governed onboarding process can produce unlawful discrimination, privacy breaches, insecure accounts, inaccurate employment records, labor-relations disputes, psychological harm, and reputational damage. Conversely, a well-governed process creates trust, accelerates lawful productivity, protects organizational assets, and demonstrates that ethics is embedded in management practice rather than added after a problem occurs.

This chapter examines how HR professionals can manage legal, privacy, cybersecurity, records, labor-relations, equity, and ethical risks across jurisdictions. It also considers responsible use of artificial intelligence (AI), accountability structures, audit controls, and the practical design of a defensible onboarding governance system. Laws differ by country and sometimes by region, sector, or collective agreement; therefore, this chapter provides a governance framework rather than jurisdiction-specific legal advice.

Learning Objectives

By the end of this chapter, readers should be able to:

1. Identify major legal, ethical, privacy, cybersecurity, records, labor-relations, and equity risks in onboarding.
2. Distinguish compliance obligations from broader ethical responsibilities.
3. Design a risk-based onboarding governance framework with clear accountability.
4. Apply privacy, security, records-management, and audit controls to onboarding activities.
5. Evaluate the use of AI in screening, orientation, workflow automation, and employee support.
6. Manage onboarding consistently across jurisdictions while respecting local law and collective rights.
7. Analyze a complex onboarding failure and recommend corrective action.

1. Onboarding as a Governance System

Governance is the system through which authority is allocated, decisions are made, risks are controlled, performance is monitored, and accountability is enforced. In onboarding, governance extends beyond HR. It involves HR, hiring managers, information technology, information security, legal counsel, payroll, facilities, accessibility specialists, records management, procurement, and sometimes employee representatives or unions.

A useful distinction is between process ownership and control ownership. HR may own the onboarding process, while information security owns identity and access controls, legal counsel interprets employment law, and records management determines retention requirements. Shared responsibility does not mean unclear responsibility. Each critical activity should have a named accountable owner.

A practical governance chain is:

Policy → risk assessment → procedure → control → evidence → review → corrective action.

For example, a policy may require least-privilege access. A procedure may require a manager to request access through an approved system. A technical control may prevent access until approval is recorded. Evidence may consist of the request, approval, timestamp, and system log. Internal audit can then test whether the control operated effectively.

1.1 Risk, compliance, and ethics

These concepts overlap but are not identical.

• Compliance asks whether the organization has met a legal, regulatory, contractual, or policy requirement.
• Risk management asks what could go wrong, how likely it is, how serious the consequences would be, and how risk should be treated.
• Ethics asks whether conduct is fair, respectful, transparent, responsible, and consistent with human dignity, including when conduct is technically lawful.
• Governance establishes who decides, who monitors, and who answers for the result.

An onboarding practice may be legal but ethically questionable. For example, an employer may lawfully collect extensive information in one jurisdiction, yet collecting information unrelated to the employment relationship may violate proportionality, trust, or fairness principles. Similarly, a standardized online orientation may be efficient but inequitable if it is inaccessible to employees with disabilities or unavailable to people with limited digital access.

2. A Risk Taxonomy for Onboarding

Risk identification should cover the entire employee journey, from pre-employment checks through the end of the probationary or introductory period.

A risk register should identify the risk, affected people, causes, existing controls, risk owner, residual risk, treatment decision, and review date. A simple qualitative scale—low, medium, high, critical—may be adequate for routine management, but the criteria must be defined. For example, “high” might mean that an event could cause serious legal, financial, operational, or human harm and requires senior oversight.

3. Legal and Regulatory Architecture Across Jurisdictions

Onboarding is regulated by multiple legal fields. The precise rules vary, but the following questions recur across jurisdictions.

3.1 Employment and labor law

Employment documents should accurately state the relationship, duties, compensation, working time, benefits, probationary provisions, confidentiality obligations, intellectual-property terms, and termination conditions where required. HR professionals must avoid presenting a template as universally valid. Employment status, wage rules, working-time requirements, leave entitlements, and mandatory notices may differ by country, state, province, or worker category.

Pre-employment inquiries should be job-related and legally permitted. Questions about health, family status, religion, age, disability, political activity, or other protected characteristics may be restricted or lawful only in narrow circumstances. A safer practice is to ask whether the candidate can perform essential functions, with reasonable accommodation where applicable, rather than seeking unnecessary medical or personal detail.

Background checks require particular care. Organizations should determine whether the check is necessary, whether consent or notice is required, whether certain records are legally restricted, and whether the individual can correct inaccurate information. Adverse decisions should not be based on unverified, irrelevant, or legally protected information.

3.2 Privacy and data protection

A privacy-responsible onboarding process follows several widely recognized principles:

1. Purpose limitation: collect information for specified and legitimate purposes.
2. Data minimization: collect only what is necessary.
3. Transparency: explain what is collected, why, how it is used, who receives it, and how long it is retained.
4. Accuracy: provide mechanisms for correction.
5. Security: protect confidentiality, integrity, and availability.
6. Retention limitation: delete or anonymize information when it is no longer required, subject to legal holds.
7. Accountability: be able to demonstrate compliance.

Privacy notices should be comprehensible, accessible, and delivered at the relevant point of collection. Consent is not always the appropriate legal basis for employment processing because the power imbalance may make consent insufficiently voluntary. Depending on the jurisdiction, processing may instead rely on contract, legal obligation, legitimate organizational interests, or another recognized basis. HR should not assume that inserting a consent checkbox resolves every privacy issue.

Sensitive information—such as identity documents, bank details, health information, biometric data, or demographic information—requires enhanced safeguards. Access should be limited by role, and highly sensitive data should not be copied into email, informal spreadsheets, or local devices without a documented reason.

3.3 Cross-border data flows

Multinational employers frequently transfer onboarding data between countries. Before doing so, they should map the data flow, identify the exporting and receiving entities, assess the destination’s legal environment, use approved transfer mechanisms where required, and establish contractual and technical safeguards. Centralized HR platforms do not eliminate local obligations. A global process should have a common control baseline with jurisdiction-specific variations documented and approved.

4. Cybersecurity and Identity Governance

New employees are attractive targets for attackers because they are unfamiliar with organizational procedures and may receive broad access quickly. Onboarding therefore represents both a security vulnerability and an opportunity to establish secure behavior.

4.1 Core security controls

Effective controls include:

• unique user identities rather than shared accounts;
• multi-factor authentication, particularly for privileged or remote access;
• role-based access control;
• least privilege, meaning access is limited to what is required for current duties;
• documented approval by an authorized manager or system owner;
• secure device configuration and endpoint protection;
• phishing-resistant or otherwise robust authentication where feasible;
• prompt removal or modification of access when roles change;
• secure channels for identity and payroll information;
• security awareness training that is practical rather than purely ceremonial.

Access should be granted through a controlled workflow. A manager’s request should identify the role, systems required, business justification, start date, and end date where access is temporary. Automatic provisioning can improve consistency, but automation must not silently reproduce excessive permissions.

4.2 Joiner–mover–leaver logic

Identity governance should treat onboarding as the “joiner” stage of a broader lifecycle. When an employee changes role, the organization must review whether old permissions should be removed; when employment ends, access must be revoked promptly and organizational property returned. The same authoritative employee record should trigger these events, but sensitive actions should remain subject to validation and logging.

4.3 Human factors

Security failures are often caused by confusing processes rather than deliberate misconduct. New employees should know how to report suspected phishing, lost devices, accidental disclosure, or inappropriate access. Managers should avoid sending passwords through ordinary email or asking employees to bypass controls to meet a deadline. A psychologically safe reporting culture is itself a security control.

5. Records, Evidence, and Auditability

Onboarding creates records in HR information systems, applicant-tracking systems, payroll platforms, learning systems, email, collaboration tools, access-management platforms, and paper files. Without governance, the organization may retain duplicate, contradictory, or uncontrolled copies.

A records schedule should define:

• the official record or system of record;
• the responsible owner;
• the retention period or event that starts the period;
• permitted access;
• disposition method;
• legal-hold requirements;
• version and correction controls;
• audit evidence.

Retention must balance competing obligations. Keeping everything forever increases privacy, discovery, and breach risk; deleting too early may violate law or undermine a legal defense. Legal holds suspend ordinary deletion when litigation, investigation, or regulatory action is reasonably anticipated.

Records should distinguish fact from opinion. A manager’s informal comment about a new employee may become discoverable and may unfairly influence future decisions. Onboarding notes should be professional, relevant, accurate, and limited to legitimate purposes.

5.1 Audit controls

A control is reliable only if it is designed appropriately and operates consistently. Common onboarding controls include:

Internal audit should test both design and operating effectiveness. Sampling can examine whether controls were present and whether they worked over a defined period. Findings should be assigned owners, deadlines, severity ratings, and verification procedures. Metrics should not reward superficial completion alone; “100 percent orientation completion” does not prove comprehension, fairness, or security.

6. Labor Relations, Equity, and Accessibility

In unionized or collectively represented environments, onboarding may be subject to collective bargaining agreements, consultation requirements, established practices, and union access rights. Management should determine whether orientation content, scheduling, job assignments, probationary rules, technology monitoring, or training requirements are matters covered by agreement. Excluding employee representatives from issues affecting bargaining-unit employees can create avoidable conflict.

Onboarding should not undermine collective representation by presenting anti-union messages, discouraging lawful organizing, or implying that loyalty requires silence. Supervisors must understand the difference between legitimate culture-building and interference with protected employee rights.

Equity requires more than identical treatment. A uniform process can produce unequal effects when employees differ in disability, language, location, socioeconomic resources, religion, caregiving obligations, or access to technology. Reasonable accommodation and accessibility should be designed into the process rather than treated as exceptional favors.

Examples include:

• captions and transcripts for orientation videos;
• screen-reader-compatible documents;
• alternatives to color-only instructions;
• flexible scheduling for religious or caregiving needs;
• interpretation or translated materials where appropriate;
• accessible physical locations;
• alternative authentication or document-submission processes when justified;
• clear, confidential channels for requesting support.

Equity audits should compare completion rates, time to access, early attrition, disciplinary outcomes, and employee experience across relevant groups, while respecting privacy and small-group confidentiality. Differences do not automatically prove discrimination, but unexplained patterns require investigation.

7. Ethical Decision-Making in Onboarding

Ethical onboarding is grounded in several principles:

• Respect for autonomy: employees should receive truthful information and meaningful choices where choices exist.
• Non-maleficence: avoid preventable harm, humiliation, surveillance, and unnecessary exposure.
• Beneficence: design processes that support successful participation and well-being.
• Justice: distribute opportunities, burdens, and protections fairly.
• Fidelity: honor commitments and avoid misleading representations.
• Accountability: provide explanation, review, and remedy when decisions cause harm.

Ethical analysis becomes especially important when business efficiency conflicts with employee interests. Consider a requirement that all new hires complete intrusive personality testing before receiving system access. The organization may claim efficiency, but the practice should be tested for necessity, validity, privacy impact, accessibility, and proportionality. Ethical governance asks not only “Can we?” but also “Should we?”, “Who bears the risk?”, and “What remedy exists if the process is wrong?”

A practical decision protocol is:

1. Define the decision and affected stakeholders.
2. Identify legal duties, organizational policies, and professional standards.
3. Identify foreseeable benefits and harms.
4. Test necessity and less intrusive alternatives.
5. Examine disparate impact and accessibility.
6. Document the reasoning and decision authority.
7. Communicate the decision in understandable terms.
8. Monitor outcomes and provide challenge or remedy.

8. Responsible AI in Onboarding

AI may be used to schedule orientation, answer routine questions, classify documents, recommend training, detect incomplete forms, or support workforce analytics. It may also be used in recruitment and background screening, where the consequences are more serious. The presence of automation does not transfer accountability from the employer to the vendor or model.

8.1 Principal AI risks

AI systems can reproduce historical discrimination, rely on proxy variables, generate inaccurate explanations, expose personal data, infer sensitive characteristics, or make decisions that employees cannot effectively challenge. A model trained on past hiring outcomes may learn that previous preferences were “successful,” even when those preferences reflected unequal access or biased judgment.

Generative AI introduces additional risks: confidential data may be sent to an unapproved service; fabricated answers may be presented as policy; records may be created without appropriate retention controls; and employees may assume that an apparently human response is authoritative.

8.2 AI governance controls

Before deployment, the organization should document the purpose, affected population, data sources, model provider, decision role, risks, performance boundaries, and accountable owner. A proportionate impact assessment should examine legality, privacy, fairness, security, accessibility, explainability, and human oversight.

High-impact employment decisions should not be delegated entirely to an opaque system. Human reviewers must have authority, competence, time, and evidence to question the output. “Human in the loop” is ineffective if the reviewer merely rubber-stamps a score.

Essential controls include:

• approved use cases and prohibited uses;
• data minimization and vendor restrictions;
• validation before deployment;
• testing across relevant demographic and accessibility groups where lawful and statistically responsible;
• monitoring for drift and disparate outcomes;
• disclosure when employees interact with an AI system, where appropriate;
• accessible appeal and correction channels;
• incident response and model withdrawal procedures;
• documented versioning and change control.

A simple fairness comparison may examine selection or completion rates between groups, but a ratio alone cannot establish discrimination or fairness. Small samples, legitimate job requirements, confounding factors, and privacy constraints must be considered. Statistical results should therefore support—not replace—legal, contextual, and ethical analysis.

9. A Governance Operating Model

A mature onboarding governance model allocates responsibilities using a RACI structure: Responsible performs the work, Accountable owns the outcome, Consulted provides expertise, and Informed receives relevant information.

Governance should include escalation routes. Employees must be able to report privacy concerns, discrimination, security incidents, inaccurate records, unsafe practices, or AI-related harm without retaliation. Reports should be triaged, investigated by appropriately independent personnel, documented, and resolved within defined timeframes.

10. Applied Case: The GlobalStart Onboarding Failure

This is an illustrative case.

Background

GlobalStart, a multinational technology company, introduced a centralized onboarding platform for employees in twelve countries. The platform collected identity documents, tax information, emergency contacts, demographic data, and health-related accommodation information. It also used an AI assistant to answer policy questions and recommend mandatory training.

Problem

Within three months, several issues emerged. The system granted new software engineers access to production repositories before managers confirmed their role. A vendor stored identity documents in a region not approved for all participating countries. The AI assistant gave an incorrect answer about parental leave. Employees with visual impairments reported that the platform could not be navigated reliably with screen readers. In one country, the orientation program omitted information required under a collective agreement. Finally, a manager downloaded a spreadsheet containing bank details to a personal device to “speed up payroll.”

Analysis

The failure was not caused by one careless employee. It reflected weak governance:

1. The project treated onboarding as a technology implementation rather than a controlled employment process.
2. No integrated privacy and security impact assessment was completed.
3. Accountability was divided among HR, IT, and the vendor without one accountable executive.
4. The global template lacked a documented local-law variation process.
5. The AI assistant had no approved knowledge source, accuracy threshold, or escalation rule.
6. Accessibility testing occurred after launch.
7. Managers were measured on speed of onboarding rather than secure and accurate onboarding.

Approach and solution

GlobalStart suspended high-risk features while preserving essential onboarding. It established an executive owner and a cross-functional governance committee. The organization mapped all data flows, restricted vendor storage, revised contracts, and separated sensitive payroll and accommodation data from ordinary orientation data. Access provisioning was redesigned around role approval and least privilege.

The AI assistant was limited to low-risk informational questions drawn from approved, version-controlled content. It was required to identify itself, link to authoritative policy, and route uncertain or country-specific questions to HR. Human review was added for any output that could affect employment rights or pay.

The company conducted accessibility testing with users with disabilities, introduced alternatives to inaccessible steps, consulted labor representatives where required, and trained managers not to copy sensitive data to personal devices. A revised records schedule defined what belonged in the official employee record and when temporary copies had to be deleted.

Outcome

The revised process took slightly longer for complex hires but reduced unauthorized access, improved employee confidence, and produced clearer audit evidence. The organization also discovered that several “efficiency” metrics had been encouraging unsafe shortcuts. It replaced them with balanced measures: secure access completion, correction rates, accessibility issues resolved, employee understanding, control exceptions, and time to remediate incidents.

Learning points

• Global standardization requires local legal and cultural adaptation.
• Automation increases the need for governance; it does not reduce it.
• A control without evidence cannot be reliably audited.
• Accessibility and labor consultation should occur at design stage.
• Speed is not an adequate measure of onboarding quality.
• Accountability must remain with identifiable organizational decision-makers.

11. Implementation Roadmap and Best Practices

Organizations seeking to strengthen onboarding governance can proceed in stages.

Stage 1: Diagnose

Map the onboarding journey, systems, data types, jurisdictions, vendors, decision points, and affected stakeholders. Interview new employees, managers, IT personnel, accessibility specialists, and employee representatives. Identify informal workarounds, because they often reveal weaknesses in formal controls.

Stage 2: Design

Create a control framework, risk register, records schedule, privacy notices, role-based access matrix, incident routes, AI use policy, and local-law variation process. Define minimum global standards and identify where local requirements override or supplement them.

Stage 3: Implement

Configure systems, train users, test access, validate documents, conduct accessibility reviews, and establish evidence collection. Use pilot groups before large-scale deployment. Do not treat vendor assurances as a substitute for organizational due diligence.

Stage 4: Monitor

Review incidents, complaints, access exceptions, inaccurate records, completion disparities, accommodation requests, and AI performance. Conduct periodic control testing and reassess risks after changes in law, technology, organizational structure, or vendor arrangements.

Stage 5: Improve and remedy

Correct errors promptly, notify affected people where required, provide meaningful remedies, update procedures, and share lessons without blaming individuals unfairly. Governance is credible when it changes behavior after evidence reveals a weakness.

Challenges and Limitations

No governance framework eliminates risk. Legal requirements may conflict across jurisdictions. Privacy-preserving analysis can limit the ability to detect inequity. Excessive controls may delay productive work, while insufficient controls expose employees and the organization to harm. Standardization can improve consistency but suppress legitimate local variation. AI testing may be constrained by small samples or restrictions on collecting demographic information. Audit metrics can become targets and lose their meaning if managers optimize for reported performance rather than genuine control effectiveness.

Professional judgment remains essential. HR leaders must know when to seek specialist legal, privacy, security, accessibility, labor-relations, or technical advice. They must also recognize that a technically correct answer may be socially unacceptable or ethically incomplete.

Contemporary Developments

Several developments are reshaping onboarding governance:

• employment regulators are increasing scrutiny of automated decision systems;
• remote and hybrid work expand identity, device, and cross-border risks;
• employees expect greater transparency about data use and monitoring;
• cyberattacks increasingly exploit social engineering during the first days of employment;
• accessibility expectations are moving from accommodation after failure toward inclusive design;
• organizations are integrating privacy, security, human rights, and AI impact assessments;
• digital identity and automated document verification are becoming more common, increasing both efficiency and surveillance concerns.

The strategic implication is clear: onboarding should be governed as a socio-technical system. Technology, law, organizational design, managerial behavior, and employee experience interact. A control that works in a laboratory may fail when a manager is under time pressure, a worker uses a mobile device, a union agreement differs by site, or an AI answer is trusted without verification.

Chapter Summary

Onboarding is a strategically important governance process, not merely an administrative checklist. It creates employment records, grants access, communicates rights and obligations, and establishes the employee’s first experience of organizational fairness and trust.

Effective governance integrates employment law, privacy, cybersecurity, records management, labor relations, equity, accessibility, ethics, and responsible AI. Key principles include purpose limitation, data minimization, transparency, least privilege, role-based access, accurate records, defined retention, meaningful human oversight, local-law adaptation, and clear accountability.

A risk-based system links policies to procedures, controls, evidence, monitoring, and corrective action. RACI allocation, risk registers, impact assessments, audit testing, incident reporting, and accessible appeal mechanisms make responsibility visible. AI can support onboarding, but it must operate within approved purposes, validated boundaries, reliable information sources, human review, monitoring, and remedy processes.

The central managerial lesson is that speed and standardization must not override legality, dignity, security, or equity. Responsible onboarding builds organizational capability while protecting the people whose data, rights, and working lives are affected.

Key Terms

Accountability: The obligation of an identified person or body to answer for decisions, actions, and outcomes.

Accessibility: Designing processes, technologies, and information so that people with disabilities can use them effectively.

AI impact assessment: A structured evaluation of the legal, ethical, privacy, security, fairness, and operational effects of an AI system.

Data minimization: Collecting and using no more personal data than is necessary for a legitimate purpose.

Data subject: An identifiable person to whom personal data relates.

Governance: Structures and processes for directing, controlling, monitoring, and holding an organization accountable.

Joiner–mover–leaver: An identity-lifecycle model covering entry, role change, and departure.

Least privilege: Granting only the access necessary for an individual’s current responsibilities.

Legal hold: A suspension of ordinary records disposal because litigation, investigation, or regulatory action is anticipated or underway.

Labor relations: The management of relationships and rights involving employees, unions, and collective representation.

Personal data: Information relating to an identified or identifiable individual.

Privacy by design: Incorporating privacy protections into systems and processes from the beginning.

Purpose limitation: Using information only for specified, legitimate, and compatible purposes.

RACI: A responsibility model identifying who is Responsible, Accountable, Consulted, and Informed.

Records schedule: A formal specification of what records are retained, by whom, for how long, and how they are disposed of.

Residual risk: The risk remaining after controls have been applied.

Role-based access control: Restricting system permissions according to defined job roles.

Transparency: Providing understandable information about decisions, data use, processes, and responsibilities.

Review Questions

Short Answer Questions

1. How does governance differ from compliance in the context of onboarding?
2. State four principles of privacy-responsible onboarding.
3. What is meant by least privilege?
4. Why are records schedules important in onboarding?
5. Identify two risks associated with AI-enabled onboarding.

Long Answer Questions

1. Explain how an organization can integrate employment law, privacy, cybersecurity, and records management into one onboarding governance system.
2. Discuss why global standardization does not eliminate the need for jurisdiction-specific onboarding processes.
3. Evaluate the ethical importance of accessibility and equity in onboarding.
4. Describe the controls required for responsible AI use in employment-related onboarding.
5. Explain how audit evidence, accountability allocation, and corrective action contribute to effective governance.

Analytical / Application Questions

1. A multinational employer wants to collect passport copies, health information, demographic data, and emergency contacts in one global platform. Analyze the privacy, security, records, and cross-border issues and propose a proportionate design.
2. An AI assistant gives different onboarding answers to employees in different countries and cannot explain its sources. Develop an investigation and remediation plan.
3. A new employee receives excessive system access because the manager bypassed the approval workflow to meet a start date. Analyze the immediate response, control weaknesses, accountability issues, and preventive measures.

Multiple Choice Questions with Answers

Question 1

Which principle requires an organization to collect only the personal information necessary for a legitimate onboarding purpose?

A. Data minimization

B. Purpose expansion

C. Universal disclosure

D. Indefinite retention

Correct Answer: A. Data minimization

Question 2

What is the primary purpose of role-based access control during onboarding?

A. To give every employee identical system access

B. To restrict permissions according to job responsibilities

C. To eliminate the need for manager approval

D. To retain access permanently after employment ends

Correct Answer: B. To restrict permissions according to job responsibilities

Question 3

Which statement best distinguishes ethics from compliance?

A. Ethics applies only to senior executives

B. Compliance is voluntary, whereas ethics is mandatory

C. Ethics considers fairness and harm even when conduct may be technically lawful

D. Ethics concerns only financial reporting

Correct Answer: C. Ethics considers fairness and harm even when conduct may be technically lawful

Question 4

What should an organization do when litigation is reasonably anticipated?

A. Delete all temporary onboarding records

B. Suspend ordinary deletion under a legal hold

C. Allow every employee to edit official records

D. Move records to personal devices

Correct Answer: B. Suspend ordinary deletion under a legal hold

Question 5

Which is an appropriate control for a high-impact AI employment decision?

A. Allow the model to make unreviewable final decisions

B. Use only historical outcomes without validation

C. Provide competent human review and an appeal or correction route

D. Hide the system’s existence from affected employees

Correct Answer: C. Provide competent human review and an appeal or correction route

Question 6

Why can identical onboarding treatment still produce inequitable outcomes?

A. Employees always prefer different policies

B. Employees may have different accessibility, language, technology, or accommodation needs

C. Identical treatment automatically violates labor law

D. Standardization prevents any form of discrimination

Correct Answer: B. Employees may have different accessibility, language, technology, or accommodation needs

Question 7

Which evidence most directly demonstrates that system access was properly authorized?

A. A manager’s informal verbal statement

B. A social-media announcement

C. An access request, approved role, approver, and timestamp in an auditable workflow

D. The employee’s claim that access was necessary

Correct Answer: C. An access request, approved role, approver, and timestamp in an auditable workflow

Question 8

In a RACI model, who is accountable?

A. The person or body that owns the outcome

B. Everyone who receives information

C. Only the external vendor

D. The person who performs every task personally

Correct Answer: A. The person or body that owns the outcome

Question 9

What is a major risk of using an unapproved generative AI service for onboarding data?

A. The service may expose confidential personal information

B. The service always improves data accuracy

C. The service automatically satisfies retention law

D. The service removes the need for privacy notices

Correct Answer: A. The service may expose confidential personal information

Question 10

Which approach best reflects responsible global onboarding governance?

A. Use one process without local variation

B. Let each manager create an undocumented local process

C. Use common control standards with documented jurisdiction-specific adaptations

D. Transfer all accountability to the technology vendor

Correct Answer: C. Use common control standards with documented jurisdiction-specific adaptations