The Difficulties of People Taking Ownership

July 3, 2024

So, you've got an amazing team of tech savvy folks who love the tech side of things.  

 

They excel in implementing the latest tools and systems, but when it comes to the less glamorous side - like making sure tasks are completed and nobody drops the ball - things start to get a bit messy.

 

How many times have you tried to engage the right people to find out where ownership lies and received no response? And when they finally do respond to you, the answer is "it's not mine" Ever felt like you're playing a game of hot potato? Yeah, we see that too.

 

In conversations with clients, we often come across a common issue: people are eager to use cool new tools, they are far less eager to assume ownership of the "boring stuff".

 

To truly be successful with your GRC (Governance Risk and Compliance) program, people need to clearly understand what they are responsible for, and then be held accountable.

 

To address this gap, we advocate for 3 fundamental steps:

 

#1 Make your best guess to find the right owner 

 

Think of it like this, if more than one person is responsible, that means no one is. You've got to pin down who's responsible for what, even if it means making your best educated guess just to get started. It's better to have assigned ownership to each task even if the assignment isn’t perfect. Trust that giving someone ownership sparks accountability to get things done as long as the next step is being done.

 

#2 Keep everyone routinely accountable

 

Consistency is key here. Set up systems to keep everyone on track and engaged, from regular check-ins to automated reminders and metrics. Let's face it, we're all busy and things can easily slip through the cracks if we aren't careful. By keeping everyone on their toes we ensure that competing priorities don't result in things being forgotten. If we don’t hold people accountable, they likely aren’t going to do it until they absolutely have to.

 

#3 Share the why

 

Ever been given a task without knowing why it matters? That's like trying to solve a puzzle without seeing the picture on the box. When everyone understands the bigger picture and why assigned tasks are important, they're more likely to step up to take ownership and follow through with your goal of a mature GRC program.

 

At the end of the day, when things hit the fan (and they will), you need to know who to engage.

 

This is why, in CPR training, best practices state to delegate specific actions to specific people. The training suggests pointing and making eye contact with one person to dial 911, one person to run to get a helpful supply, one person to get another supply, and so forth. Though bystanders would usually help in an instant, they assume someone else is going to do it so they end up doing nothing instead. By the leader taking charge and delegating effectively, emergency personnel can respond faster, and the injured parties can get the help they need.

 

When it comes to applying these principles to your program, clarity saves time, reduces stress, and ensures that things get done when they need to. This gets you closer to meeting the overall objective of a mature Cyber GRC program.

 

Invest the time upfront to save time later and get the right result/outcome.

 

At Hotman Group, we’re all about simplifying the complex. By engaging people to take ownership, you steer clear of chaos and instead create clear accountability to run your program like a well-oiled machine.

You May Like These Posts

CMMC Compliance: Cutting Through the Confusion

  Cybersecurity leaders want to know, in plain terms, what they need to do when it comes to CMMC to ensure compliance and customer contractual obligations. Join us for a conversation with cybersecurity experts about what’s actually needed to stay on track with CMMC compliance. We’ll dive into the real gaps you may be facing […]

Supply Chain Security: Managing Risk Beyond Your Vendors

When it comes to third-party supply chain security, there’s a big difference between doing it and doing it right. Every vendor you work with brings their own vendors into the mix—so who truly owns the risk? In this session, we’ll explore how to identify, assess, and mitigate supply chain risks at every level without overburdening […]

The Difficulties of People Taking Ownership

So, you've got an amazing team of tech savvy folks who love the tech side of things.     They excel in implementing the latest tools and systems, but when it comes to the less glamorous side - like making sure tasks are completed and nobody drops the ball - things start to get a bit […]

Why Maturity Matters: Overcoming GRC Cognitive Overload with the Maturity Model

Please join Kayne McGladrey, author of the GRC Maturity Model and Cheri Hotman as they explore the GRC (Governance, Risk, and Compliance) Maturity Model, a powerful tool for organizations to assess and enhance their cybersecurity practices. Achieving maturity in GRC is crucial for navigating complex regulatory landscapes and boosting overall effectiveness. Through self-assessments, organizations can […]

Security Awareness Training – Verizon 2025 Data Breach Investigations Report

In this 15-minute training, the HG team breaks down the most critical findings from Verizon’s 2025 Data Breach Investigations Report (DBIR)—and what they mean for real-world security programs. We cover the sharp rise in third-party breaches, the growing threat of GenAI misuse, and the continued dominance of ransomware and credential-based attacks. You’ll walk away with […]

Security Awareness Training – Social Engineering

Join us for an essential Security Awareness Training session focused on Social Engineering. In this session, we delve into the critical importance of cybersecurity awareness and how you, as an individual, serve as the first line of defense against cyber threats.   Key Topics Covered:   Why This Matters: Remember: Technology alone cannot protect you. […]

The Audit Trap: Why Passing isn’t Protection

Think passing an audit means your cybersecurity program is solid? Think again. Many organizations unknowingly expose themselves to greater risk by relying on compliance checkmarks rather than a true security strategy. In this session, we’ll uncover the hidden dangers of audit-driven security, why "passing" may leave you more vulnerable, and the real steps leaders must […]

Why Cybersecurity is as much Art as Science

In this kickoff episode of The Art of Cybersecurity, host Cheri Hotman shares why this podcast exists and what listeners can expect. Cyber isn’t just science or technology — it’s art. It’s messy, constrained, people-driven, and ultimately about mitigating risk to protect people and data. Cheri cuts through the noise of “easy button” tools, audit-passing […]

Choosing the Right Cybersecurity Framework: A Practical Guide for Leaders

Speakers: Cheri Hotman and Tanya WadeHosted by: Hotman Group   Why Choosing the Right Framework Matters   Passing an audit is no longer enough. Many organizations still treat cybersecurity as a one-time project, something to "check off" rather than an integrated, living part of their business operations.   During this session, Cheri Hotman and Tanya […]

Post A Comment

Leave a Reply

Your email address will not be published.

Too many leaders settle
for checkboxes and false
confidence—leaving their
business exposed and
under constant pressure
from customers.
With Hotman Group, you
get a right-sized program
that protects what matters
and proves trust.

Hotman Group is an SBA

Certified Woman-Owned Business

Hotman Group, LLC

Fort Worth, TX

Privacy Policy | Terms of Service | All Rights Reserved © Hotman Group, LLC