Challenging the Overconfidence of Compliance

The Big Policy Flop

You’ve done it! After countless edits, checks, proof reading and more changes, all stakeholders have signed off. And then there was the design and formatting, which also had edits and needed sign off. But it’s ready. And you’re proud as punch. It’s practically a work of art.  The policy is clear, concise, and comprehensive and leaves no room for ambiguity. It balances thoroughness with simplicity. The training is also brilliant. The messaging is first class. You’ve got all the key stakeholders lined up to speak about it. And then the launch. You’re so excited.

Of course, everyone is going to be as excited as you are! It’s so important to the organisation. It’s going to give everyone the guidance and information that they need to do their job. It’s useful, it’s important and it’s also beautifully designed.  It’s a no brainer! People are going to fall over themselves wanting to read it right! They’re going to do their training immediately, right!

You check the analytics on the people who completed their training and signed to say they have read the policy. By the end of the week, 10 people have visited the policy site and 4 people completed their training. You suspect that most of these numbers came from the Compliance team.

A few weeks later, even after ‘tone from the top’ emails and engaging short videos, still the analytics show very little engagement.

The above is based on a true story. A real-life situation. In fact, although I have one in mind, it could be one of at least 20 I have seen. And I am sure, if you are reading this, you have experienced this.

In this article I examine the reason for the lack of engagement, despite the company doing everything right, and then consider the solution.

But before I go into this, let me relate this to a personal story.

Too focused on the prize to focus on the opponent

Today I lost at chess. Against a 14-year-old.

Before I lost, I was winning. I was so focused on the prize, winning, that I missed her bishop sneaking out from across the board aiming at my King. Before I knew it, I was in check, my rook was taken from me and the game, for me, was on the downward spiral. After that, I made many errors and ultimately lost.

My friend, her father, smiled at me. He had been the one who taught me chess all those years ago. He said, “you lost as soon as you moved your King onto the White square.” What he meant was “you lost as soon as you moved like no one else was playing”.

What really happened – I severely misjudged my opponent and exhibited a prime example of overconfidence bias (also known as overconfidence syndrome).

“… individuals tend to have excessive faith in their own judgments and abilities.”

Don A. Moore, a prominent researcher in the fields of judgment, decision-making, and behavioural economics, conducted extensive research on forms of overconfidence.

In the paper published in Psychological Review in 2008, “The trouble with overconfidence” Don A. Moore and Paul J. Healy delve into the phenomenon of overconfidence.

They define overconfidence as: “a pervasive cognitive bias in which individuals tend to have excessive faith in their own judgments and abilities. This bias leads people to overestimate the accuracy of their beliefs, predictions, and decisions across various domains.”

Importantly, they highlight the role that motivated reasoning plays. This is where individuals seek out evidence that confirms their pre-existing beliefs while ignoring or discounting contradictory evidence.

My pre-existing belief in my chess example was that I would win. Therefore, my brain did not seek out risks and obvious attacks.

They also found that overconfident individuals may fail to adequately consider alternative viewpoints or seek out additional information, which can hinder their ability to make informed choices. In my case, even though my friend raised his eyebrows and even said ‘that was the wrong move’ I ignored him and continued in my blaze of blissful ignorance, ignoring the attack against me.

And here is the point, if we know that overconfidence is a ‘thing’ and that it does hinder our ability to make informed choices, how much is this coming up for us and for our organisations when it comes to Compliance?

Overconfidence Syndrome (OCS)

If you asked a room full of people to put up their hands if they think that they are good drivers, the vast majority would. But if we’re ALL good drivers, how does that explain road rage incidents, car crashes, speeding and all driving offences and extensive fines that go with driving?

Psychology Today points out that ‘…93 percent of American drivers claim to be better than the median (1), which is statistically impossible(2).

1. Ola Svenson, ‘Are We Less Risky and More Skillful than Our Fellow Drivers?’, Acta Psychologica, 47 (1981), 143–51.
2. Provided everyone agrees on what how to assess driving; Eric van den Steen, ‘Rational Overoptimism (and Other Biases)’, American Economic Review, 94.4 (2004), 1141–51.

I had OCS when I decided I could get out the house in 10 minutes to take the kids to school. Now logically I know that it takes 30 minutes to bundle two small children out of a house with full stomachs and everything else that is needed. But that morning, overconfidence syndrome kicked in!

Now, fortunately I do know better, but let’s say I suffer from ‘Getting Out the House Amnesia’ and every morning I leave 10 minutes when I know we need 30, or even longer. Should I expect a different outcome just because I persuade myself that 10 minutes is enough. No!

But this is what I have seen in organizations over the past 30 years. A policy, training and follow-up email is sent out. There may even be a workshop and a ‘tone from the top’ message.

• Yet, we are surprised when people still send confidential information to their Gmail account to work on ‘at home’.
• Or when people don’t register a benefit or conflict of interest, because ‘it’s not relevant’. Or when an invoice is paid to a personal bank account, following a recent change of account details of an existing supplier.
• Or how about the manager who signs off expenses repeatedly without checking, resulting in almost a $1million fraud.
• And, how about the manager who, instead of using the company’s template signs the other side’s terms without checking with Legal, causing it to enter into a 3-year agreement which is highly prejudicial.

We know logically that people are unique, unpredictable and forget things. But I have lost count the number of times when I have seen OCS by Compliance teams in their confidence in company employees’ ability to comply with all the different compliance activities we have painstakingly put in place.

I’ve heard so many versions of the following phrases that I could have created an annual calendar for the last 30 years with phrases such as:

“But it was in the policy”

“They did the annual training”.

In my experience, it’s not that employees intentionally want to ‘do the wrong thing’. It is often a genuine lack of awareness, even if we think they ‘should know’.

Beyond Policy: Elevating Compliance into Culture

Back to my true story of the beautifully crafted policy and training. It’s now clear to me that this was most certainly a case of OCS. Overconfidence that other people in the organisation would be as excited as we were. Overconfidence that they would see its importance in the same way that we did. But just like in my chess match, I misjudged the other players. My predetermined beliefs and excitement about the product that we had produced, led me to fail to consider what my audience would really be thinking and what would get them to engage in the product as earnestly as we did.

Do not do this!

The truth is that they don’t need more or different; they do need a reason.

The answer is not to saunter off into a lonely zoom room with an audience of no one. It’s not to accept defeat and come to the realisation that other things in the organisation will need to take precedence. And it’s not to accept that this ‘if just how things are’.

It’s also not to start working on the ‘next big thing’ (training, video and comms) sure that this will inspire them. Putting controls on top of controls is like adding plaster on top of a plaster to a nasty wound. It stops the healing process. And in this case, the additional controls just bombard the employees with more things to watch, do and learn about. The truth is that they don’t need more or different; they do need a reason.

Do this! Mitigating OCS

Moore and Healy’s paper, referred to above, is a great place to start.

They propose encouraging individuals to adopt a more critical and reflective approach to decision-making, promoting greater awareness of cognitive biases, and providing feedback mechanisms to improve calibration and accuracy.

So how can we be more critical and reflective when we are launching that new policy or training?

Firstly, put yourself in the shoes of your audience. What inspires, moves, encourages them? It’s unlikely to be what inspires, moves and motivates you and your team. But everyone, has a point of sale. By this, I mean the ‘thing’ that moves them to action. The ‘thing’ that resonates with them.

That’s why, when developing a new policy, training and other controls, we need to put as much time identifying how to connect your message with your audience, as we do with ensuring that the policy and training meets the legal requirements. Because if no one reads it and no one remembers it and no one acts on it, it doesn’t matter how great it is, or how much time or cost you put into it.

Think of the policy and training not as a control to enforce behaviour, but as my friend Debbie Danon mentioned about the work I do:

“an opportunity for strengthening business relationships and building a positive, human-centred brand.”

So instead of relying on hope or partaking in OCS, you use the training and policy to connect with your audience and strengthen your own brand and services in a way that your audience will want to find out more.

The Post frame – How to connect with your audience

Here is how I have used connection in my work:

1. I never guess. I start by genuinely understanding the audience’s needs, interests, and challenges. Listening is key; pay close attention to feedback and the questions they ask. You can do this in several ways:

• pre-launch policy/training survey,
• send the policy and training to random people in different teams and seek feedback. How does this fit in with their work lives?

2. From this I can share stories and experiences that resonate on a personal level. And these do not need to be stories in the training, you can share the stories to illustrate the point of the training.

3. Understanding our audience’s needs also gives us the opportunity to consider alternative viewpoints and seek diverse perspectives, this can help counteract our own biases and help with our messaging.

4. Make any interaction feel more like a conversation than a broadcast. So be authentic in your communications and be transparent about your intentions and values.

5. Use the platforms and mediums that your audience prefers, making it easier for them to engage with your content. When I work in-house my pet hate is receiving long emails with tiny text from an external lawyer. I prefer short, sharp emails with comments and analysis and then an attachment for me to read or watch something. How does your audience like you to communicate with them? Feel free to ask.

6. Encourage participation and create opportunities for meaningful engagement, whether through community forums, workshops, drop-in sessions or team meetings. By making your audience feel valued and understood, you create a stronger, more meaningful connection.