> If you are tracking the impersonation correctly it should be easy to see internally that the user didn't change the address or request a 401k loan themselves and a system should be in place to ensure that such changes get flagged and reviewed.

Inbound voice is notoriously difficult to establish metrics on. You generally have to review the calls. The HRO company has (literally) millions of participants, and so keeping up with the call volume from all of them is a challenge.