Chris McClean serves Security & Risk Professionals. See the full Analyst bio.
Visit Forrester.com to learn how we make Security & Risk Professionals successful every day.
Don’t Forbid Employees From Using The Escalator, Give Them Reasons To Use The Stairs
Posted by Chris McClean on March 27, 2012
- 330 Recommendations
- 0 comments
Guest post from Researcher Nick Hayes.

If you had to go up one level in a train station, would you take the stairs or use the escalator? Most people would choose the escalator. But what if the staircase played musical notes like an interactive piano? This may change things, right? A couple of years ago, Volkswagen began sponsoring an initiative called The Fun Theory that tested the degree to which they could change people’s behavior for the better by introducing an element of fun. In one example, they found that by adding a unique element to the stairs – transforming it into an interactive piano – they were able to increase staircase use by 66%. You can watch the short video here.
You can apply this same principle to your training and awareness programs -- find your own piano staircase, and use it to begin guiding people to choose the right thing on their own. Chris and I have been working on a report that stresses the importance of organizational culture in the development of risk and compliance programs. Throughout the research process, we asked risk and compliance professionals and vendors in the space the same question: “How are you influencing and promoting positive behavior?”
You can create new technical controls and policies, and you can require employees to sign attestations all day, but these efforts have minimal value (or worse) when there’s no positive reinforcement. When compliance and risk management are considered obligatory tasks, rather than meaningful efforts that the company values, it diminishes the perceived importance of ethical behavior.
Instead, engage employees using different multimedia channels, and maybe even add in touches of humor and fun.
This may involve inserting humor into your newsletters or incorporating gamification techniques into your training programs, but it could also mean communicating your message in straightforward language that explains why certain rules are important and developing incentives to encourage the appropriate behavior. Ultimately, what Forrester recommends is that you work to shape your training and awareness program to reflect the characteristics your company values. Whether your company’s culture is more hierarchical or fosters a more collaborative tone, use the techniques that fit your organization best, and run with them.
For a more comprehensive view on the topic, keep a look out for our report, “Drive Change Management For Governance, Risk, And Compliance: Best Practices For Establishing A Culture Of Risk Management And Compliance.” It should be published mid- to late-April.
And as always, keep the conversation going in the comments section and on our online community. We’d love to hear your take.
Best regards,
Nick
search forrester's blogs
Secure the digital business future.
Attend Forrester’s Forum for Security & Risk Professionals EMEA, June 10-11, London UK
Analyst Blogs
- Andras Cser (31)
- Andrew Rose (17)
- Chris McClean (54)
- Christopher Sherman (1)
- Edward Ferrara (20)
- Eve Maler (19)
- Heidi Shey (9)
- John Kindervag (28)
- Khalid Kark (13)
- Laura Koetzle (2)
- Nick Hayes (5)
- Rick Holland (20)
- Stephanie Balaouras (50)
Top Categories
- GRC (21)
- Enterprise Risk Management (10)
- Governance Risk and Compliance (2)
- IT Risk Management (2)
- IT security (2)
- acquisitions (1)
- BC/DR (1)
- BT Resiliency (1)
- Business continuity (1)
- business technology resiliency (1)
- See all
Archives
- March 2013 (1)
- February 2013 (1)
- November 2012 (1)
- May 2012 (2)
- March 2012 (1)
- November 2011 (1)
- October 2011 (1)
- September 2011 (1)
- May 2011 (1)
- February 2011 (2)
- January 2011 (1)
- December 2010 (1)
- November 2010 (1)
- See all