Extending HUMA™
People GRC
Govern the whole employee lifecycle.
HUMA™ began as a model for governing AI in workforce decisions. People GRC applies the same structure — ownership, risk, decision rights, controls, evidence and continuous monitoring — across the full employee lifecycle, beyond AI alone.
Most people processes are governed informally: the practice exists, but the accountability, the control and the evidence are assumed rather than documented.
Four Pillars
The same discipline, applied to people.
01
Governance
Who owns each people process, who decides, who reviews and who remains accountable when an outcome is challenged.
02
Risk
Where employment, privacy, fairness, safety and regulatory exposure actually sits — classified by impact on people, not just on the organization.
03
Compliance
Translating obligations and internal policy into controls that operate, with evidence a reviewer can follow.
04
Evidence
Documentation that demonstrates a decision was made the way the organization says it makes decisions.
The Employee Lifecycle
Six stages. Each one a governance surface.
Every stage carries decisions that affect a person's livelihood. Each one needs an owner, a risk view, defined controls and evidence those controls operated.
01
Attract & Hire
Where risk sits
Sourcing, screening, assessment, selection and offer decisions.
Controls & evidence
Documented selection criteria, adverse-impact review, candidate notice, vendor and tooling oversight, retention of decision records.
02
Onboard & Verify
Where risk sits
Identity, eligibility, background checks, credentialing and access provisioning.
Controls & evidence
Standard verification workflow, exception handling, segregation of duties, evidence of completion.
03
Pay & Reward
Where risk sits
Compensation setting, pay changes, incentives, equity and benefits administration.
Controls & evidence
Pay decision rights, approval thresholds, periodic equity review, auditable change history.
04
Perform & Develop
Where risk sits
Goal setting, ratings, calibration, promotion, succession and learning.
Controls & evidence
Calibration standards, manager review, appeal path, documented rationale for material outcomes.
05
Monitor & Protect
Where risk sits
Workplace monitoring, employee data use, privacy, safety and investigations.
Controls & evidence
Purpose limitation, employee transparency, access control, retention schedules, incident escalation.
06
Change & Exit
Where risk sits
Restructuring, reductions, transfers, offboarding and post-employment obligations.
Controls & evidence
Selection documentation, approval chain, access revocation, records retention, lessons captured.
One lifecycle model, extended.
People GRC does not replace the HUMA™ lifecycle. It reuses it — the same four movements, applied to people processes whether or not AI is involved.
Assess where people decisions are made and by whom. Design ownership, decision rights and control requirements. Implement documentation and evidence. Govern continuously as policy, regulation and the organization change.
People GRC is an educational model published by Regavon. It is not legal advice and is not endorsed or certified by any standards body or regulator.
Start with AI. Extend to people.
Workforce AI Diligence is the first application of this model. The HUMA™ Command Center prototype shows what governing it in one operating view could look like.