So, you've got an amazing team of tech savvy folks who love the tech side of things.  

They excel in implementing the latest tools and systems, but when it comes to the less glamorous side - like making sure tasks are completed and nobody drops the ball - things start to get a bit messy.  

How many times have you tried to engage the right people to find out where ownership lies and received no response? And when they finally do respond to you, the answer is "it's not mine" Ever felt like you're playing a game of hot potato? Yeah, we see that too. 

In conversations with clients, we often come across a common issue: people are eager to use cool new tools, they are far less eager to assume ownership of the "boring stuff".

To truly be successful with your GRC (Governance Risk and Compliance) program, people need to clearly understand what they are responsible for, and then be held accountable.  

To address this gap, we advocate for 3 fundamental steps:  

1. Make your best guess to find the right owner 

Think of it like this, if more than one person is responsible, that means no one is. You've got to pin down who's responsible for what, even if it means making your best educated guess just to get started. It's better to have assigned ownership to each task even if the assignment isn’t perfect. Trust that giving someone ownership sparks accountability to get things done as long as the next step is being done. 

2. Keep everyone routinely accountable 

Consistency is key here. Set up systems to keep everyone on track and engaged, from regular check-ins to automated reminders and metrics. Let's face it, we're all busy and things can easily slip through the cracks if we aren't careful. By keeping everyone on their toes we ensure that competing priorities don't result in things being forgotten. If we don’t hold people accountable, they likely aren’t going to do it until they absolutely have to. 

3. Share the why  

Ever been given a task without knowing why it matters? That's like trying to solve a puzzle without seeing the picture on the box. When everyone understands the bigger picture and why assigned tasks are important, they're more likely to step up to take ownership and follow through with your goal of a mature GRC program.  

At the end of the day, when things hit the fan (and they will), you need to know who to engage.  

This is why, in CPR training, best practices state to delegate specific actions to specific people. The training suggests pointing and making eye contact with one person to dial 911, one person to run to get a helpful supply, one person to get another supply, and so forth. Though bystanders would usually help in an instant, they assume someone else is going to do it so they end up doing nothing instead. By the leader taking charge and delegating effectively, emergency personnel can respond faster, and the injured parties can get the help they need.   

When it comes to applying these principles to your program, clarity saves time, reduces stress, and ensures that things get done when they need to. This gets you closer to meeting the overall objective of a mature Cyber GRC program. 

Invest the time upfront to save time later and get the right result/outcome. 

At Hotman Group, we’re all about simplifying the complex. By engaging people to take ownership, you steer clear of chaos and instead create clear accountability to run your program like a well-oiled machine.