Deloitte's Davies adds: "People risk shouldn't be enveloped into another risk area. It needs to be elevated to top table. In terms of capability, if you get it right, HR and ERM working together allows for responsive planning and improves change management, as HR can be proactive. If you get it right, strategic risk management should also be able to engage all employees across the organisation."

Once HR has defined what it considers to be its most pressing people-related risks, there comes the more challenging step of starting the conversation with ERM and getting HR a seat on, or at least a say in, the board-level risk committee. "The path between HR and risk is not a well-worn path," says Young. "If companies aren't talking about HR risk holistically, it's probably the fault of risk management more than HR," adds The Conference Board's Hexter. "But senior leaders are missing a huge trick."

And if the bigger barrier to conversation and even potential partnership is on the risk side, the onus is on HR to try to overcome that. "It is really incumbent on HR people to explain the story to the risk-management guys, because risk management doesn't understand HR," says Cappelli. "HR has to be able to explain all the aspects of people risk and spell it out. But at the moment, it seems the HR guys aren't jumping up and down saying this is important. They are not thinking about tying it to business strategy at all."

As ever, it comes down to language. "To get more visibility [around people risks], HR needs to change its language to the language of business," says Young. "You need to be able to talk about these issues not in HR terminology, but the language of the business. Businesses are used to risk management, so if you can frame people issues in risk, you automatically get people's attention. Talk risk, and there will be visibility right to the top of the board."

In order to "talk risk", as Young puts it, HR directors need to realise that they have at their fingertips the one thing that is almost certain to make risk managers sit up and take notice: data. "HR has a big element of data," says Deloitte's Thompson. "But historically I don't know many organisations that have fed it into the mix [when it comes to risk management]. HR can be woolly and not quantitative, so the risk guys will say it's not worth the paper. But if you make it more intuitive for them, they will pay attention."

And for risk to take people risks seriously, that means hard, quantitative data. "HR has something else [aside from an understanding of culture] that is important," says Young. "It has data that will impress and interest risk. It's not resistance so much as lack of awareness that HR really has the numbers. If HR shows some of the data and insight they have, a risk person will see that it will help them to be more successful. HR would be interested to see the data that HR has, and risk has the framework that HR can use."