When you boil it down, every business is about people. Your staff and customers, board, executive and decision makers are people. The controls you employ in your risk management practices consider the fallibility of many things including people.
TOM is not a person. TOM is an equation:
TEMPTATION + OPPORTUNITY = MALPRACTICE
While you attempt to reduce opportunity, the reality is that you can never completely predict or understand each individual’s motivators. What you can do is ensure that opportunity is reduced to be as low as reasonably practicable. If a person is tempted, the lack of opportunity disrupts the equation.
While the term ‘malpractice’ includes theft, you are encouraged to think more broadly. Malpractice also includes failure to conform with company values or comply with legislation, regulation, and policies.
Please consider the following question:
“In responding to COVID-19, have I assumed that the controls used in a physical workplace will be effective in the virtual workplace?”
Let’s begin with TEMPTATION:
What can you reasonably know about your team? How aware are you of their personal circumstances? What may have changed? How are they feeling?
Link this to what is happening in your organisation. What do your employees/team members perceive is happening or may happen? Are you adding to or subtracting from their fears and uncertainty?
Now consider OPPORTUNITY:
Think about how you stayed aware of how your employees/team behaved and operated before COVID-19 changed the work environment. In addition to spot checks and audits you could be aware of the ‘vibe’ in your workplace. What you may have taken in subliminally might have indicated something could be awry. Indicators may have included:
- Changes in employee behaviours
- Change in the workplace’s ‘vibe’
- Increased complaints/missed service levels
- A change in the tone and topic of office gossip
Any of these may have indicated that your controls were not operating effectively.
One or more people may have found opportunities to bypass controls. A person deliberately taking an opportunity to bypass a control rarely does so overtly. If we accept that such behaviour existed pre-COVID, then it is plausible that the remote work environment has enabled deviation from correct, conforming, and compliant practice - to be more covert.
Some deviation may be explained by the employee/team member – for example:
“My kids were home from day care and school and driving me nuts. We are all under pressure to get [X] done and I didn’t want to let anyone down. So, I made shortcuts that I thought would be OK. I know I should have asked but I was embarrassed.”
Some deviations have consequences for the employee – for example:
“Last year I stated in the Work from Home workstation set-up that I had an ergonomic desk and chair – that was false. I thought it was just an administrative form and I never expected to be working from home five days a week rather than one day per fortnight. I never expected that I would have experienced a soft tissue injury because of this set up.”
Then there are situations which have always required detailed investigation:
Despite supervision, checking and segregation of duties in the workplace there are many examples of the trusted employee failing to do the right thing pre-COVID. In some cases, those trusted employees have faced criminal charges.
Any of the above may contribute to a problem that derails your current forward momentum.
Back to our initial question:
“In responding to COVID-19, have I assumed that the controls used in a physical workplace will be effective in the virtual workplace?”
A different way to frame that question is:
“In testing my organisation’s controls in the virtual workplace, how have I maintained or reduced ‘opportunity’ to be as low as reasonably practicable?”
To survive, your organisation has compressed years of change into a few months. Consider how your people – staff, leaders, decision makers, customers, and shareholders – have also needed to adapt.
By being aware of TOM - you can better identify how to sustain, improve, or fix your controls for the current environment.
Protecting your people, operations, assets, and reputation is paramount in a crisis or emergency. Tigertail Australia has the background and experience to equip your organisation with the skills to confidently and effectively manage risk, crisis, and emergencies. The Tigertail team has more than 150 years of combined experience. We cover everything, from prevention and preparedness to response and recovery. The team includes Crisis and Emergency Management Leaders, Business Continuity Specialists, Risk Management Advisors, Planners, and Trainers.
Author: Craig Moroz, Senior Associate, Tigertail Australia
W: www.tigertail.com.au T: +61 (0)408 481 931 E: answers@tigertail.com.au
