Putting policies under pressure
A note on LinkeDin led me to an intriguing scientific research study that tested the following five hypotheses:
- People who receive instructions via a written policy about rules will have better
knowledge of these rules than those that do not.
- People who receive a shorter form version of policy about the rules with less text
will have better knowledge of the rules than those who receive a longer training
form.
- People who receive a written policy outlining the rules in a more vernacular and
less legal technical language will have better knowledge of the rules than those
presented with a more formal-legal-styled training text.
- People with better knowledge of rules will also comply more with such rules.
- The more legal rules align with people’s personal and social norms, the higher people score in their knowledge of these legal rules.
The findings do not support the first four hypotheses - in other words, there was no statistically significant improvement in employees' knowledge or conformity with the rules laid down in long-form 'legalese', short-form 'plain English' or pictorial policies.
Regardless of format, the policies were simply not effective, despite (a) the gravity of the subject matter, and (b) the employees being aware of the study's purpose (well, presumably so since the study involved informed consent: maybe the information presented by the researchers to gain consent had as little impact on participants as the policies!).
Oh oh.
However, the findings supported the fifth hypothesis - in other words, employees' knowledge and conformity of the rules reflects their personal and social norms, a form of bias. We are more likely to accept and conform with rules that align with our expectations based on the things we see or perceive are going on around us. That finding, in turn, also has intriguing implications.
If culture trumps policy, then what (if anything) can be done to influence culture? 'Culture' is diffuse and hard to describe, let alone shape or control, so I plan to keep reading and would welcome further studies into that.
Meanwhile, we have here a classic information risk with ineffective mitigating controls so we might:
- Re-evaluate the risk. What are the threats, vulnerabilities and impacts? What else can be done to address any/all of those factors, if the risk is unacceptable? Can we avoid, share or control it better? Or is this an information risk we are forced to accept?
- Anticipate [at least some of] our policies being ineffectual despite our best efforts, leading inevitably to incidents, at least some of which will need to be addressed. [The specific subject matter of the policy in this study may be relevant. Perhaps the findings would be different with other kinds of policies, information security and privacy policies for instance. I doubt it but I don't know for sure.]
- Revise our expectations for corporate policies: although they are valuable and may be necessary for legal reasons (which, along with laws and regulations, are now in some doubt as a result of this research), they have little value in rule-setting. Don't spend all your infosec budget on those finely-crafted policies!
- Increase focus and effort to influence cultural understanding, acceptance and conformity, accepting that 'culture' is a complex social construct that resists change - it seems to move slowly, seemingly resisting or counteracting externally-imposed pressures.