In 2018, the answer depends on your threat and risk analysis results. Which, of course, you have performed, identified the likely scenarios, rated them and made a business decision based on the impact and frequency, according to a proper statistical or quantitative method.
Your individual employee, however, has made his own personal risk analysis and arrived at the result that you indicated, namely:
he cannot take responsibility for his network identity in such case
And he is perfectly correct in that assessment. Even a superficial glance at the situation makes it clear that someone other than him, with minimal technical skills, could impersonate him.
To you the business risk is acceptable (obviously, I mean it's 2018, that the internal network is unencrypted is an intentional decision and not, say, a case of we've-always-done-it-like-that, right?) and you may well be right in that decision. Accepting a risk is a perfectly valid option.
To him the risk is not acceptable. Note that he does not make a business decision for the company with his statement. He makes a personal decision for himself. That is why the two risk analyses can come to different results - different context, risk appetite, impacts.
The correct answer is that you are taking the responsibility that he refuses to take. By running the network unencrypted, and accepting the risk, the company assumes the responsibility for the network identity of the users of that network, as it has decided to not protect them.
I could also be mistaken in my assumptions about your corporate risk management, in which case I recommend doing a risk analysis of this particular fact (unencrypted internal network) and threat (impersonation of users) so that you can either revise the decision of having an unencrypted network, or solidify it with results that show that securing the network would be more expensive than the expected loss.