Giving people a way to say a control is unworkable

A workaround is information, not misconduct

When somebody bypasses a control, the usual reading is a discipline problem. The more useful reading is that a control was designed without knowing something, and the person who bypassed it knows what.

Every organisation gets to choose which reading it acts on. The choice determines whether it learns about its unworkable controls from its own staff or from an assessor.

Four properties it needs

No blame attached. Stated explicitly, in writing, by somebody senior. Implied amnesty is not amnesty.

Quick. A response within days, even if the response is that it will take longer. A report into silence teaches everybody watching.

Visible outcome. Something changed, or a reason was given. This is the property most often missing and the one that determines whether a second report ever arrives.

Easy. A named person and a way to reach them that does not require a form. For a shop floor that usually means a person who walks around.

Ask once, openly, and mean it

A single announced exercise: tell us every place where the official way does not work and you have found another way. Nothing happens to anybody who says so; something happens to the process.

Suppliers who run this find between five and twenty things, most of them small, several of them significant, and at least one that nobody in management knew was possible.

It works once. Running it annually turns it into a form.

Three outcomes, all legitimate

Fix the control. Make the compliant route faster, as the entry on the operator's view argues.

Accept the risk formally. Sometimes the workaround is the sensible arrangement and the control was wrong. Document the decision and who took it.

Keep the control and provide the missing thing. The control stands; the reason it was bypassed gets removed.

What is not legitimate is hearing it and doing nothing, because that is the outcome that closes the channel.

What happens when you use it

Reports stop. Workarounds continue and become invisible. The next time something goes wrong, nobody says anything until it cannot be concealed.

That sequence is well documented across safety-critical industries and there is no reason to expect this domain to behave differently.

Where blame is appropriate

Deliberate concealment, repeated behaviour after a fix was provided, and anything involving dishonesty. Distinguishing these from ordinary workarounds is a judgement, and stating the distinction in advance is what makes the no-blame promise credible.

A promise with no stated limit is not believed, because everybody knows there must be one.

Keep it, because it is evidence

A log of reports, responses and changes demonstrates a functioning process to an assessor and it is more persuasive than a policy saying one exists.

Anonymise where the report was made in confidence and keep the substance.

Not the person whose control it is

People do not tell the author that their control is unworkable. Route reports to the compliance owner rather than to whoever implemented the thing, and tell everybody that is where they go.

What did we make harder this month

Put it in the team meeting. It invites the reports that a channel waits for, it is answerable by anybody, and it frames the programme as something with costs that are being managed rather than as a set of rules.

Elsewhere in people

• What compliance actually costs, itemisedWhat compliance actually costs, itemised. What it costs, who decides, and what usually goes wrong.
• Reading a proposal that quotes a certificateReading a proposal that quotes a certificate. What it costs, who decides, and what usually goes wrong.
• What to build and what to buyWhat to build and what to buy. What it costs, who decides, and what usually goes wrong.
• Making the budget case to somebody who resents itMaking the budget case to somebody who resents it. What it costs, who decides, and what usually goes wrong.
• The costs that arrive after the purchase orderThe costs that arrive after the purchase order. What it costs, who decides, and what usually goes wrong.
• Doing this with almost no moneyDoing this with almost no money. What it costs, who decides, and what usually goes wrong.
• Who owns compliance, and why it cannot be nobodyWho owns compliance, and why it cannot be nobody. What it costs, who decides, and what usually goes wrong.
• Running it as a project rather than as a documentRunning it as a project rather than as a document. What it costs, who decides, and what usually goes wrong.
• Reporting to a board that wants one numberReporting to a board that wants one number. What it costs, who decides, and what usually goes wrong.
• When the date slips, which it willWhen the date slips, which it will. What it costs, who decides, and what usually goes wrong.
• Staying compliant after the assessmentStaying compliant after the assessment. What it costs, who decides, and what usually goes wrong.
• Working to two standards at onceWorking to two standards at once. What it costs, who decides, and what usually goes wrong.
• Training that changes what people doTraining that changes what people do. What it costs, who decides, and what usually goes wrong.
• How a control looks from the machineHow a control looks from the machine. What it costs, who decides, and what usually goes wrong.
• Contractors, temps and the visiting engineerContractors, temps and the visiting engineer. What it costs, who decides, and what usually goes wrong.
• Hiring for a role most suppliers have never filledHiring for a role most suppliers have never filled. What it costs, who decides, and what usually goes wrong.
• What staff are told about monitoringWhat staff are told about monitoring. What it costs, who decides, and what usually goes wrong.
• What counts as an incidentWhat counts as an incident. What it costs, who decides, and what usually goes wrong.
• Reporting obligations and their clocksReporting obligations and their clocks. What it costs, who decides, and what usually goes wrong.
• Being able to answer afterwardsBeing able to answer afterwards. What it costs, who decides, and what usually goes wrong.
• The first hour, and who decidesThe first hour, and who decides. What it costs, who decides, and what usually goes wrong.
• Telling a customer something happenedTelling a customer something happened. What it costs, who decides, and what usually goes wrong.
• What changes afterwards, and what shouldWhat changes afterwards, and what should. What it costs, who decides, and what usually goes wrong.
• The other frameworks you have also metThe other frameworks you have also met. What it costs, who decides, and what usually goes wrong.
• Export control, named and not advised onExport control, named and not advised on. What it costs, who decides, and what usually goes wrong.
• Your own suppliers, and what to ask themYour own suppliers, and what to ask them. What it costs, who decides, and what usually goes wrong.
• Suppliers outside the United StatesSuppliers outside the United States. What it costs, who decides, and what usually goes wrong.
• Where the data physically sitsWhere the data physically sits. What it costs, who decides, and what usually goes wrong.
• What is changing, and how to tellWhat is changing, and how to tell. What it costs, who decides, and what usually goes wrong.