Culture (survey) wars
Many companies have employee surveys titled “engagement, culture, feedback, etc.” HR often controls this process. They often don’t work (well). The reasons vary, but some common themes emerge:
🚦 They’re not anonymous
🚦 They’re hard to answer
🚦 They’re too long
🚦 Who cares?
Gathering feedback from employees about risk is essential. Most issues (evidential and anecdotal experience) stem not from control failures but from human (in)action. If you can conduct your own (risk, integrity, compliance, etc.) survey, it’s gold.
If we are to make any risk or compliance program work, we need to understand:
👉 Knowledge gaps – who doesn’t know what to do
👉 Accessibility issues – who isn’t getting supported
👉 Accountability – most issues stem from fear and/or orders
👉 Trust – psych safety, speak-up, and team-level decision-making
When we gather this data, it’s proving to be as powerful as any other risk management technique I’ve seen. But we’re not going to get it through HR and their survey.
The image above is a sample of questions from a market-leading culture survey company. HOJ (the acronym we use in our family when you “had one job”). It’s rubbish.
- Question 1 asks us to estimate someone’s impact on unspecified others, “Which employees?” A manager could play favourites and support a select few while neglecting the others.
- Question 2 assumes learning and development are synonyms and fails to define “well” (a variable construct when most of us have worked with total cretins who think they’re rockstars).
- Question 3: quality and improvements are not the same, and “top priorities” for whom?
Those who know me will know I judge my work similarly ruthlessly, and I look back on questions I used six or even three months ago and cringe. We must be that critical because gathering this vital risk data is essential. The benefits are manifold, but two clear themes emerge:
- We now know who needs what (kind of support)
- We need data – senior leads get data and listen when we speak it
This [link] will take you to a sample report highlighting the output’s utility.
First, we need to correct the common issues:
💪 Ensure no one group of respondents is smaller than five people – preserving a level of anonymity.
💪 Opt for simple questions about personal experience (“I and my”), avoid compound questions and multiple variables.
💪 Keep the question set to 20 questions or below (normally 3-4 minutes to complete).
💪 Communicate with respondents quickly and transparently. “Who cares” stems from not knowing what (if anything) happens with the responses.
In 22 years of risk work, this is one of the top three tools I’d rely on to build an effective risk culture. But you don’t get many shots, so when you get yours, get it right.