Six techniques for making compliance more than just a box ticking exercise

The consequences of failing to comply with regulations are well documented, yet we still see a wide variance in risk tolerance in businesses across the UK, from those who ignore the issue to those striving to create a compliant workplace culture.

Putting policies in place is a necessary step towards achieving compliance, but ensuring that policies permeate throughout an organisation to create a culture of compliance, rather than just being seen as a box-ticking exercise, is an ongoing and complex process.

When English Rugby’s three governing bodies asked for our help tackling the long-term risk posed to players by concussion, the aim was cultural change from grass-roots to professional level, ensuring every player, coach and referee adopted new concussion management policies.

To help achieve this, we produced a Concussion Awareness eLearning module which was completed by 100% of professional rugby players, coaches and referees at the start of the 2014-15 season, and has just been shortlisted for three e-learning awards.

Ensuring 100% completion of the module was important, but the real goal was changing the way concussion is treated within the sport. Here are some of the techniques we used to ensure the module was more than just a box-ticking exercise:

Technique 1: Show that the risk is real

Mismanagement of concussion has resulted in life-limiting neurological problems for former rugby players, so it was essential that the Concussion Awareness eLearning module was taken seriously.

To ensure this was the case, the module included a number of recognisable, hard-hitting real life examples of the consequences of concussion mismanagement to players.

In any organisation, failure to comply with regulations puts the organisation and individuals involved at risk. Showing the actual consequences, which can include fines, dismissals or prison sentences, makes sure compliance is taken seriously rather than being seen as just a liability-limiting, box-ticking exercise.

Technique 2: Develop a clear message that learners can take away

Effectively changing culture calls for a campaign with a strong, memorable message.

The Concussion Awareness eLearning module was built around the “Four R’s” of concussion: Recognise, Remove, Recover and Return, which describe the best practise for concussion management, and form the basis of rugby’s concussion management campaign.

By identifying the key messages around desired behaviours and reinforcing them through policies, communications campaigns and training, an organisation’s employees will be able to take them on board and utilise them in their daily work, creating the desired behaviours.

Technique 3: Get interactive

Rugby players are far more motivated by playing rugby than sitting in training rooms, so it was important that the Concussion Awareness module was as interactive and engaging as possible.

Interactive elements utilised included multiple choice questions, video examples of concussions and a symptom identification game, making the module far more engaging than simple text on a page.

In today’s busy working world, full of different tasks competing for learners’ attention, making training interactive is essential to engage learners with subjects and enhance information retention, ultimately leading to a greater cultural impact.

Technique 4: Elicit an emotional response

Training which creates an emotional response is more memorable and far more likely to make a lasting impact on organisational culture – the main goal of the Concussion Awareness module.

That’s why the module starts with a hard hitting video depicting the consequences of mismanaged concussion for a player – a scenario the target audience can easily empathise with – as well as concluding with a scene showing the positive results of managing concussion correctly.

No matter what the subject, delivering content in a way that creates an emotional response will help to ensure employees engage with new policies and training rather than just going through the motions.

Technique 5: Get the buy-in of senior management

When the Concussion Awareness module was launched in 2014, every player, coach and referee received a personalised letter from Rob Andrew, Professional Rugby Director at the Rugby Football Union and former England international.

Showing that the message is coming from the top goes a long way to justifying the need for policies and training, as well as helping to prevent it from being seen as a box-ticking exercise.

In businesses, this can be achieved by sending email, letters, or having senior executives deliver a town hall meeting to encourage staff to take mandatory training seriously.

Technique 6: Tailor the message to the audience

Policies affect different employees in different ways: a middle manager’s responsibilities around a subject like fraud prevention will differ from those of a senior executive or a graduate.

With Concussion Awareness, we created different versions of the module for each of the three target audiences because each has different roles and responsibilities when it comes to concussion.

While generic, cover-all-bases training may keep costs down, making policies and training as specific as possible ensures that employees engage with, take on board and put in place processes that reduce risk of failure to comply with regulations.

With eLearning, this is particularly straightforward to achieve, as all content is digital and can be tailored to meet the needs of specific groups.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

“In a world older and more complete than ours they move finished and complete, gifted with extensions of the senses we have lost or never attained, living by voices we shall never hear.”

Picture of James

James

VinciWorks CEO, VInciWorks

Spending time looking for your parcel around the neighbourhood is a thing of the past. That’s a promise.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.