To err is human
Human error is the biggest cause of data breaches. It’s a simple fact that people do and will make mistakes. As digitisation of every aspect of our lives accelerates, as data becomes more complex and as the rights of data subjects become more intricate, the more likely it is that human errors will creep in.
So it follows that an organisation whose risk and data protection protocols also accommodate human nature alongside its policies, procedures and controls, will ultimately be more effective.
Speaking up
At HSBC we approach this human factor of risk by fostering a positive speak up culture. What does this mean? Well, we emphasise the importance of the individual - their contribution, their value to the organisation and their judgement. We encourage people to say something if a situation doesn’t feel right or when they realise something has gone wrong, whether it’s their fault or not. Underpinning that is an open, supportive environment. Instead of colleagues keeping quiet because they fear the personal consequences, we help colleagues to speak up about what’s going on and learn from their experiences.
Establishing a culture is an investment. It’s true that positive cultures take time to become well-embedded. But it’s surprising how quickly behaviours can change. Once the conditions are right, people start to shift their thinking and you’ll be rewarded with encouraging outcomes.
Say what you mean, mean what you say
So how have we introduced our speak up culture at HSBC? The key has been ensuring that our top-down message means something for people, firstly, and secondly, that it follows through to what our people actually experience.
Setting the tone from the top is important. How I and other leaders show up and role model the behaviours of speaking up and learning has a big impact on what others feel empowered to do. We tell stories and give examples from our own experiences of when we spoke up, often in difficult or conflicting circumstances or when we felt exposed and vulnerable, to help people relate the speak up concepts we’re advocating to real life situations they might find themselves in. Using panel discussions, webinars, question and answer sessions and blogs, we’ve reached hundreds of colleagues at a time.
Sharing case studies of recent, real-life situations which highlight what our employees have done to reach the right outcomes has also helped to normalise desired behaviours and reinforce the culture. Furthermore, it demonstrates that what happens in practice matches up to the organisational promise.
Psychological safety
Speaking out can make people feel vulnerable so it’s vital that colleagues feel safe. A large degree of that feeling of safety comes directly from other colleagues around us and especially our managers.
For someone to “speak up”, someone else needs to “listen up”. When someone listens, they empower someone to speak. So to regain some psychological safety, we emphasise and practice listening skills particularly amongst out people managers.
When people do have something to say, we’ve put in place multiple ways they can so do. From confidential lines and skip level manager or leader “exchange” meetings, to small team discussions, manager and colleague one-to-ones and electronic platforms to raise concerns.
A constant during change
How a culture holds up when circumstances change is arguably the ultimate test. Covid has resulted in new ways of living, working and doing business. So when our business and employees had to adapt, our people have been able to look to the principles of our culture to guide them through new norms.
Where there’s a will, there’s a way
In an environment where the dominant tone is fear and consequence, people will neither own up nor step up when things go wrong.
Contrast that with an environment which over indexes on openness and learning as a response to mistakes, then people’s behaviour switches, they start taking accountability, exercising good judgement and doing the right thing - willingly.
That’s the key: HSBC’s speak up culture is striving to foster willingness. In our experience, cultivating and enabling a positive speak up culture is allowing us to be more effective in managing risks, especially when we have to adapt to changing circumstances.
“The views and opinions expressed in this blog are those of the author and do not necessarily reflect the official position of the Jersey Data Protection Authority (including the Jersey Office of the Information Commissioner) (the "Authority"). The Authority is not responsible for the accuracy of any of the information supplied by the guest writer/bloggers and the Authority accepts no liability for any errors, omissions or representations. The copyright of this content belongs to the author and any liability with regards to infringement of intellectual property rights remains with them.”
