Governance Law and Order: How to Approach Policy Enforcement

Forward-thinking organizations have a pretty good sense of why they must have official policies that govern the way they classify, protect, retain, and dispose of their business-critical information – even if they haven’t yet implemented formal programs in those arenas.

But here’s the thing: without the will to actually enforce those policies, they’ll likely find themselves having moved the compliance needle barely at all! So making sure people understand that your wish is their command has to be part of the thinking as well.

Scare ’Em Straight

For sure, most everyone will be a good enough corporate citizen to do the right thing for its own sake. But others will silently shout “Don’t tell me how to do my job!” and drag their feet toward conformity – if they make any move toward it at all.

Most of the time, what these folks need is a tangible “Or Else!” to coax them into line. But simply issuing diktats is an ineffective way to reduce contentiousness and engender cooperation. Instead, consider a staged approach such as the following:

• Especially at the start, check everybody’s work to see that information is being tagged properly, documents are being stored in a repository rather than a shared drive, etc. By introducing accountability into the equation, you’ll tap into most everybody’s desire to avoid shame, embarrassment, and possible punishment, and thus trigger a reflexive internal alarm to comply – such as when a police cruiser just happens to pull behind you on the highway.

• Include proper governance behavior on the list of criteria you use when conducting annual performance reviews. Tie something to employees’ ability to be paid more and/or promoted, and watch the antennae quiver! This is a longer-term strategy as its very nature dictates that it needs to be rolled out over time, and its more private promulgation means its import likely will spread slowly via word of mouth as employees whisper “I didn’t know they really meant it!” to each other.

• Make habitual non-compliance a fireable offense! This is no one’s first resort, and it’s not a consequence you want to impose lightly, but it’s necessary to be able to play this card should someone simply refuse to play along. Otherwise, all you’re doing is saying governance is important, but should push come to shove, it’s not THAT important.

Good Cop, Bad Cop

The fear of being fired and, to a lesser extent, of receiving a small or no raise or bonus syncs well with research results from the University of Opole and the University of Wroclaw in Poland. According to an article summarizing the findings, “some […] experiments indicate that people who experience fear then relief get the sense knocked out of them. They become compliant, and go along with suggestions without thinking.” (See the original paper here.)

What this tells me is that, as much as we’d all like to focus on positive reinforcement as a way to engender compliance, it is sometimes necessary to be less than nice to make the point. If this sounds like the underpinnings of the old Good Cop/Bad Cop routine, that’s because it is – and the reason it applies here is because it works.

It’s Psychology, Not Technology

The issues we’re touching on now are rooted in the fundamentals of human psychology and thus are far beyond the scope of this post. (If you’re interested, ask me about my work in Change Management.) But you must factor them into your planning because they ultimately will make or break your ability to enforce the governance policies you know you need to have.