A Change in Behavior

In a recent discussion, the following question was discussed. Do negative behaviors by employees working at home still pose a risk for many companies, and if so, what are the behaviors that companies need to monitor?

Much of that discussion centered on some fairly traditional thinking. However, a friend of mine by the name of Hiett Ives, and I have a different perspective, and below is what he concluded from our discussion.

History offers important lessons that have value only when we pay attention to what those lessons tell us. In the days following the attack on the World Trade Center on 9/11/2001 something not talked about very much separated the companies that survived from those that did not.
Those companies with offices in the World Trade Center and downtown Manhattan which had a Business Continuity Program (BCP) in place, over 90% survived and continued in business.  Of those which had no BCP in place, up to 80% of them went out of business. The effects and long-term ramifications of today’s Pandemic are potentially as devastating for those companies that do not have a business continuity plan that takes these types of events into account.
Also not well understood is the impact of these major consequences on employee behavior. Many of these types of plans fail to address such key issues as:
Intracompany behavior dynamics
Risks associated with these new dynamics
Procedures to monitor, mitigate and protect against potential risks

In the context of these three points one question needs careful consideration. Do negative behaviors by employees working at home pose a risk for a company in this new environment, and if so, what are the behaviors that need monitoring?
A New Intra Company Dynamics
The majority of employees worked for companies which, pre-pandemic, required employees to be a physical presence at the workplace, and “telecommuting” was by exception. Whether you were the boss or the worker, traditional thinking said, if you’re not there, you don’t get paid – it’s was the “Dollar for Hours” world, and the methods employers used to monitor your effectiveness were built around the employee being physically present.
The boss had to see you working.  This was the standard, regardless of whether your expertise, contribution, service, or participation might just as easily (and sometimes more effectively) be provided “offsite”. It’s just “How We Did Things”.
Then the COVID -19 pandemic happened, and all companies deemed NONESSENTIAL were told to close their storefronts, offices, places of business, and stop all physical interaction with virtually everyone.
Here is where a company either dusted off their Continuity Plan or had to create one “On the Fly”.  Companies and operations quickly realized, with a little ingenuity, many of those in-house functions can actually be performed “off-site” – in the employee’s home.
And with this realization came the new reality where companies are establishing new ways of getting the job done – and the need to draft an entirely different Business Continuity Plan. The old ways are gone and these new plans need to look at many known risks in completely new ways.
Risks Associated With These New Dynamics
Some risks change, some remain the same, and other risks become more impactful. Behaviors that did not disappear, and have the potential for creating greater risk in the new “at home” environment can include such actions as:
Working on “non-business” items on “company time”
Accessing company material outside their purview and from non-secure workstations

Sharing proprietary company information “out of the house”

These obvious risks, and more, posed “In House” are both amplified by these functions going outside and demand greater attention within the company’s BCP.  One of the major cultural mindset changes needing to be made is to shift from the “Dollars for Hours” to a “Pay for Performance” mentality.
When management codifies this change and workers function under this new approach, a myriad of studies document increases in both productivity and quality of work – all accompanied by higher morale and greater loyalty to the employer. By looking at a perceived risk as productivity enhancement, the whole flavor of the employer/employee relationship changes to one of productivity team.
When your company’s or operation’s BCP concisely documents and enumerates this approach, the likelihood of the system running amuck or an employee or two going rogue or nefarious are greatly reduced.  This being said, it benefits any company to have a strong formalized continuity program, complete with any necessary policies and procedures in place to protect both the company and its employees.
Procedures to Monitor, Mitigate and Protect Against Potential Risks
This is a simultaneous Top-Down and Bottom Up operation regarding at least these communications metrics within this new business model:
Your company’s/operation’s overall information and communications security and its individual operations’ protocols and procedures
What functions can be performed ONLY on company supplied/serviced/monitored equipment and protocols

What material, functions, and/or procedures are accessible via personal equipment, and what level of monitoring is applied

As with the first two, when looked at these from the positive point of view of maximizing company and individual productivity and safety, the monitoring, mitigating, and protection functions become far easier to initiate and implement.

When introduced as integral elements of your company or operation’s continuity plan is more likely to be eagerly accepted as both management and employee have a stake in the company’s success.
Moreover, as risk management and avoidance tools and techniques are introduced and implemented it is quite likely those involved begin providing further enhancements to the system, both for their own and the whole team’s benefit.
Almost every company is facing a daunting challenge as a result of the radically new environment we all operate in. This does not mean existing tools won’t work; it simply means we need to find new ways to use them. So, choose and act.