I live in a country with a passionately unhelpful bureaucracy. The briefest trawl of local Facebook community pages helps understand why—a small but vocal cadre of our population loves complaining and using the catchphrase that leads to more misery, “Somebody needs to do something about…”.
In this context, we get around 80 notices and posters in an NHS clinic waiting room. The medical staff at this clinic are excellent. The admin staff generally ‘help’ when intentionally not helping becomes harder work than helping. It’s, therefore, not much of a surprise to see a hastily compiled “mission statement” (Hippocratic Oath not enough?), see below, hidden in an obscure corner, dwarfed by lengthy and earnest missives telling us how we can or can’t speak to the reception staff, what we can and can’t come to the clinic for, how we should sit, breath, not breath (on others), who to call about what and when. A total overload of drivel, massively undermining the “mission.”
In this context, where a cadre of faceless bureaucrats waste time on this platitudinous waffle, is it any wonder there is cynicism about compliance?
Recently, I read this piece:
“Villain: Veolia, the waste disposal company, for refusing to allow one of its London street cleaners to accept a gift of £3,000. The contractor told 63-year-old Paul Spiers that Bromley Council’s rules forbade him from accepting the money locals had raised for him to go on holiday. Happily, a travel agent then set up a competition for a free trip with particular criteria: applicants had to “love Elvis Presley, be aged between 62 and 64, be loved by the local community, be a street cleaner in Beckenham and have the surname Spiers”. Spiers “won”, and this time Veolia had no objections.”
A relative also sent me a clip of Clarkson’s Farm, where a local council had forbidden him from selling any produce not made within a 15-mile radius of the farm shop. As he contemplated hauling t-shirts and other items off the shelf, they came up with an idea. If people bought one Brussell sprout for £20, they’d get a free t-shirt.
When I see circumventing of rules using this level of lateral creativity, one (or some) of the following has happened:
🚦 The rule is daft. 🚦 The intention behind the rule has not been communicated correctly. 🚦 People have lost respect for their leaders. 🚦 Incentives aren’t aligned with risk (realistic, relevant). 🚦 Management has stifled smart people’s voices.
If the rule rebellion comes from within your organisation, that’s good news. We can change those rules.
It gets messy when the resistance to these rules happens outside our walls. I recently had a call with a procurement specialist after a payment was rejected for the 5th time, where they suggested “hacking” some of the form fields. The designers of the rules appear not to have contemplated the possibility that a domestic US government department might need to contract with organisations outside the US tax system. We had to “hack” tax codes and filings. While the work I had done for them was legitimate, as I saw how confidently the procurement officer circumvented controls, I would be willing to bet this “supplier onboarding and payment portal” will create more risks than it reduces.
Where do I see the stupidest rules?
🤦🏻♂️ Third-party management (one-size-fits-none systems designed by descendants of Inquisition torturers). 🤦🏻♂️ Gifts and entertainment policies that read like a high-school mathematics problem fed into mid-2000s Google Translate (Chinese to Liki, and Liki to English). 🤦🏻♂️ Expenses, finance, and timesheet logging systems with the responsiveness and intuitive design you get from a primary schooler’s first coding experiment: “Helo Wolrd [sic].” 🤦🏻♂️ Speak-up systems that ask you to contact HR (your HR may be great, but you’d be the exception - HR is to protecting employees what politicians are to honesty). 🤦🏻♂️ Conflicts of interest and other work vs personal life contractual clauses that expect the same unflinching fealty from the gig and minimum-wage workers that are expected of ExCo.
How is this so? Because many of the people who draft rules have never worked in your organisation. Often, it’s the fault of us filthy charlatans, ‘the advisors’. Other culprits include fiats from lenders, investors, and clients. They demand that you adhere to standards designed for their business to cover their butts. Often, these businesses are “traditional” (i.e., old school), and their policies might not fit the more agile and newer businesses they’re dictating to. It’s like a European medieval knight requiring that a modern military diver don a full suit of armour.
That’s the bad news. The good news is that you can generally identify where the problems lie (risk and compliance user experience surveys) in ~3 minutes of your employees’ time. If you’d like to learn more, let me know.
Fraud finding of the week
Looking at the leadership scores this week, it’s not surprising that no one has (yet) answered yes to the question, “Are fraud risk management responsibilities integrated into senior executive performance evaluations?” Fraud has long been a poor relation to other economic crime and regulatory requirements. While not surprising, it’s odd. Fraud is the area that brings down most executive teams - misreporting, misrepresentation, misuse, and yes, bribery, corruption, conflicts of interest, money laundering, and kickbacks that could (and often do) often fall into a definition of fraud.
But this week, I wanted to highlight an issue that stems from a lack of leadership on fraud. Only 33% of respondents have clearly assigned roles and responsibilities for fraud risk management. Where the head leads, the tail follows.
If you need to make the dreaded “business case” for fraud risk management to your executive team and want to bounce your ideas off someone, it’s become something of a pastime over the past month. Get in touch!