Targeted Advisory case study
Speed Was Never the Risk in Hiring. Skipped Competition Was.
The situation
The question behind the question.
This organisation’s HR team had rewritten its recruitment rules as flexible guidelines. The aim was speed: time to fill down from 85 days to 70, because unfilled vacancies had been flagged as a corporate risk. The guidelines were already in use but had never been formally published. At senior leadership’s request, internal audit commissioned an independent review, advisory rather than an audit: did the move from rules to guidelines still manage the risks?
“Tell us whether our new recruitment guidelines manage the risks.”
Find where flexibility skips a check, compare each hiring step with peers, rate the risk there, and recommend the few checks that let the organisation hire faster without losing trust.
How we worked
How the work unfolded.
Read rules and practice
We started with paper and practice side by side, as 2 independent reviewers. About a dozen documents, from the HR manual and the new guidelines to search-firm contracts and the risk report, were read against what people did. Interviews covered the recruitment team, the staff council, legal counsel, people leadership and internal candidates. The gap was clear early: practice had moved ahead of the published policy.
Compare step by step
Then the peers. 7 organisations, from a pharmaceutical company and a private bank to UN agencies and a global health fund, were compared across 7 hiring steps, from defining the need to the formal offer. The sharpest contrast was on exceptions: peers tied every direct hire to a mechanism, a runner-up from a completed competition, announced openly, or a named successor. Here, a direct hire only had to serve the organisation’s interests. On a 4-level talent acquisition maturity model, the organisation was approaching level 2, where more than half of organisations sit.
Rate where the risk sits
Then 6 risks, rated high, medium or low across operational, legal and reputational exposure. None was high, and speed itself was rated low. The 3 medium risks shared one pattern: hiring without competition, through direct hires or a single search firm; practice running ahead of policy; and naming a lead candidate early, used only twice, and by none of the 7 peers. The risk was not in speed. It sat wherever competition was skipped.
Recommend, then answer
Then 16 recommendations in 6 groups, each marked as aligned with the guidelines, needing an amendment, or already under way: a minimum 7-day posting, clear conditions for direct hire, search firms chosen competitively, no lead candidate, a target for internal versus external hires, 3 KPIs (time to fill, recruiter workload, internal hire rate), and a matrix of who initiates, supports, validates and approves. To close the gap with practice, the updated policy would go back through the staff council and legal, then to leadership for formal approval and publication. HR’s 43 written comments were each answered before the final report.
Flexibility, with a check
The step. Compare each hiring step with peers, not the policy as a whole.
The risk. Rate it where competition is skipped, not where speed is gained.
The owner. Name who initiates, validates and approves every exception.
Speed was never the risk. Flexibility is safe when every skipped competition has an owner and a check.
What moved
What changed, and what didn't.
The review was accepted with its 16 recommendations. It gave HR and internal audit one shared reading of where the guidelines held and where they needed a check, and HR took it into its next priorities, with internal audit offering support as the rules were revised.
The review looked at the policy, not the team’s performance, and the comparison stayed qualitative: a new recruitment system meant reliable hiring metrics were not yet available. Diversity outcomes were not measured, and no plan was set to track which recommendations were implemented or when the updated policy would be approved.
What we'd say to a peer
Moving recruitment from rules to guidelines can cut time to fill, and speed is rarely the risk. The risk sits where competition is skipped: a direct hire, a single search firm, a lead candidate named early. Tie every exception to a mechanism, as peers do, name who validates and who approves, and publish the policy before practice outruns it.
Own approach in 4 steps; document review and stakeholder interviews; 7-peer benchmark across 7 hiring steps; Bersin talent acquisition maturity model; Gartner recruitment KPIs; high/medium/low risk rating; decision-authority matrix.
WeAreHuman@Work
One piece of evidence on sustainable work, every Sunday. Free, and one click to leave.
Get the weekly edition