The Difficulties of People Taking Ownership

July 3, 2024

So, you've got an amazing team of tech savvy folks who love the tech side of things.  

 

They excel in implementing the latest tools and systems, but when it comes to the less glamorous side - like making sure tasks are completed and nobody drops the ball - things start to get a bit messy.

 

How many times have you tried to engage the right people to find out where ownership lies and received no response? And when they finally do respond to you, the answer is "it's not mine" Ever felt like you're playing a game of hot potato? Yeah, we see that too.

 

In conversations with clients, we often come across a common issue: people are eager to use cool new tools, they are far less eager to assume ownership of the "boring stuff".

 

To truly be successful with your GRC (Governance Risk and Compliance) program, people need to clearly understand what they are responsible for, and then be held accountable.

 

To address this gap, we advocate for 3 fundamental steps:

 

#1 Make your best guess to find the right owner 

 

Think of it like this, if more than one person is responsible, that means no one is. You've got to pin down who's responsible for what, even if it means making your best educated guess just to get started. It's better to have assigned ownership to each task even if the assignment isn’t perfect. Trust that giving someone ownership sparks accountability to get things done as long as the next step is being done.

 

#2 Keep everyone routinely accountable

 

Consistency is key here. Set up systems to keep everyone on track and engaged, from regular check-ins to automated reminders and metrics. Let's face it, we're all busy and things can easily slip through the cracks if we aren't careful. By keeping everyone on their toes we ensure that competing priorities don't result in things being forgotten. If we don’t hold people accountable, they likely aren’t going to do it until they absolutely have to.

 

#3 Share the why

 

Ever been given a task without knowing why it matters? That's like trying to solve a puzzle without seeing the picture on the box. When everyone understands the bigger picture and why assigned tasks are important, they're more likely to step up to take ownership and follow through with your goal of a mature GRC program.

 

At the end of the day, when things hit the fan (and they will), you need to know who to engage.

 

This is why, in CPR training, best practices state to delegate specific actions to specific people. The training suggests pointing and making eye contact with one person to dial 911, one person to run to get a helpful supply, one person to get another supply, and so forth. Though bystanders would usually help in an instant, they assume someone else is going to do it so they end up doing nothing instead. By the leader taking charge and delegating effectively, emergency personnel can respond faster, and the injured parties can get the help they need.

 

When it comes to applying these principles to your program, clarity saves time, reduces stress, and ensures that things get done when they need to. This gets you closer to meeting the overall objective of a mature Cyber GRC program.

 

Invest the time upfront to save time later and get the right result/outcome.

 

At Hotman Group, we’re all about simplifying the complex. By engaging people to take ownership, you steer clear of chaos and instead create clear accountability to run your program like a well-oiled machine.

You May Like These Posts

Supply Chain Security: Managing Risk Beyond Your Vendors

When it comes to third-party supply chain security, there’s a big difference between doing it and doing it right. Every vendor you work with brings their own vendors into the mix—so who truly owns the risk? In this session, we’ll explore how to identify, assess, and mitigate supply chain risks at every level without overburdening […]

The Difficulties of People Taking Ownership

So, you've got an amazing team of tech savvy folks who love the tech side of things.     They excel in implementing the latest tools and systems, but when it comes to the less glamorous side - like making sure tasks are completed and nobody drops the ball - things start to get a bit […]

Security Awareness Training – Verizon 2025 Data Breach Investigations Report

In this 15-minute training, the HG team breaks down the most critical findings from Verizon’s 2025 Data Breach Investigations Report (DBIR)—and what they mean for real-world security programs. We cover the sharp rise in third-party breaches, the growing threat of GenAI misuse, and the continued dominance of ransomware and credential-based attacks. You’ll walk away with […]

Bridging the Gap: Why Cybersecurity Tools Alone Aren’t Enough

Investing in the latest cybersecurity tools doesn’t automatically mean you’re secure. Many leaders feel the initial promise of a new solution—only to realize it’s not delivering the protection they expected. So, what’s missing? In this session, we’ll break down where the responsibility of the tool ends and where your team’s role begins. We’ll uncover why […]

Security Awareness Training – Artificial Intelligence & Emerging Security Risks

Join us for an essential Security Awareness Training session focused on the evolving landscape of Artificial Intelligence (AI) and the emerging security risks that come with it. In this session, we explore how AI is being used in everyday tools—and how it's also creating new opportunities for threat actors. This training emphasizes awareness, responsible usage, […]

The Audit Trap: Why Passing isn’t Protection

Think passing an audit means your cybersecurity program is solid? Think again. Many organizations unknowingly expose themselves to greater risk by relying on compliance checkmarks rather than a true security strategy. In this session, we’ll uncover the hidden dangers of audit-driven security, why "passing" may leave you more vulnerable, and the real steps leaders must […]

Choosing the Right Cybersecurity Framework: A Practical Guide for Leaders

Speakers: Cheri Hotman and Tanya WadeHosted by: Hotman Group   Why Choosing the Right Framework Matters   Passing an audit is no longer enough. Many organizations still treat cybersecurity as a one-time project, something to "check off" rather than an integrated, living part of their business operations.   During this session, Cheri Hotman and Tanya […]

Security Awareness Training – Social Engineering

Join us for an essential Security Awareness Training session focused on Social Engineering. In this session, we delve into the critical importance of cybersecurity awareness and how you, as an individual, serve as the first line of defense against cyber threats.   Key Topics Covered:   Why This Matters: Remember: Technology alone cannot protect you. […]

Why Maturity Matters: Overcoming GRC Cognitive Overload with the Maturity Model

Please join Kayne McGladrey, author of the GRC Maturity Model and Cheri Hotman as they explore the GRC (Governance, Risk, and Compliance) Maturity Model, a powerful tool for organizations to assess and enhance their cybersecurity practices. Achieving maturity in GRC is crucial for navigating complex regulatory landscapes and boosting overall effectiveness. Through self-assessments, organizations can […]

Post A Comment

Leave a Reply

Your email address will not be published.

Most companies look at
their cybersecurity
piecemeal, inadvertently
putting themselves at risk.
With Hotman Group, we
approach cyber security
strategically, with a plan so
you can be fully protected.

Hotman Group is an SBA

Certified Woman-Owned Business

Hotman Group, LLC

Fort Worth, TX

Privacy Policy | Terms of Service | All Rights Reserved © Hotman Group, LLC