If you’re thinking about cyber security, you should also think about behaviour change

It’s no longer an option to view cyber attacks as something that happens to someone else, some other organisation, or just a technical issue.  It’s now standard practice for all large organisations to have measures in place to protect themselves and their assets, and these measures often include an element of culture and behaviour change .

I’ve recently been involved in a project where I helped a client change the way their workforce viewed cyber security and embed a set of new highly-secure behaviours.

The project has been very successful and I’ve even found my own behaviour changing as a result – I’ve signed up for a password manager and my laptop is now a veritable fort knox!

So what do we mean by cyber security?

In its simplest terms, cyber security is the protection of an individual’s or organisation’s cyber assets.

To protect cyber assets you need to worry about physical security as well as cyber security.  This is where you need to think about the culture and behaviours of the organisation – there’s no point having great firewalls in place, if you leave the door to your server room open!

What is a cyber threat?

There are a number of different types of cyber threat, including state-sponsored attacks, insider threats, cybercrime, cyberterrorism, physical threats (staff members leaving doors or computers unlocked) and ‘hacktivism’ (hacking a system for social or political gain). Each company will have a different profile in terms of which of these threats are the most probable and how serious the consequences of a breach could be.

How does an organisation protect itself against cyber attack?

If people don’t understand, endorse and actively support cyber security consistently throughout an organisation, it’s just a matter of time before the best of systems will be compromised.

As change professionals, the area we add value is in helping our clients identify and embed the behaviours that will support the other measures (such as technological protection) they have in place. This isn’t just a ‘nice to have’ – if people don’t understand, endorse and actively support cyber security consistently throughout an organisation, it’s just a matter of time before the best of systems will be compromised.

Affecting large-scale behavioural change

Let’s be clear about one thing: change is hard! I get uncomfortable changing my brand of toothpaste. So effecting meaningful, lasting change can’t just be a top-down approach.  For behaviours to adapt, and for change to be truly adopted, all affected staff need to take ownership and understand the importance of the change.

Here are some key methods and approaches we use at Afiniti to help our clients ensure long-term and sustainable behavioural change is achieved across the whole organisation.

1.       Build sustainable toolkits and communications

This can’t be a one-off short-burst campaign, it needs to be rolled out over a period of time for the desired behaviours to become embedded as second nature.

To help maintain a high level of interest throughout the project, try a mix of communication styles from hard-hitting and informative to softer, more subliminal messaging.

And lastly, by using a blend of channels and methods, plus appropriate language and tone, you can ensure your key messages reach all intended audience groups.

2.       Co-create and utilise real people to generate awareness and validate the programme

Take the time to understand people’s opinions and insights into their areas of work, and then involve them in the project planning and execution. This way you’ll not only gain a more rounded understanding of the business needs, but people will feel invested in the project from the beginning.

Once people feel on board and understand the importance of the changes, work with them to create content such as short videos and workshops.  This type of user-generated content can really help with marketing to external audience groups, so why not reap the benefit for your internal communications efforts too?  It’s often cheaper, more authentic and more trusted by internal audiences.

Check out our vBlog of top tips for creating user-generated content

3.       Use creative and eye-catching visual assets

As they say ‘an image can convey a thousand words’ and this is certainly true when you’re trying to present a set of important key messages. Trying to condense a long white paper into a punchy animation or presentation can be a difficult thing to do, but it also forces you to concentrate on the things that really matter and helps to bring ideas and concepts to life.

4.       Create a security champions network

By giving tools and training to a group of security champions, you can create a community which supports the wider workforce on a day-to-day basis.  The champions can share experiences, best practice and be a point of call for questions, ideas and concerns. It also really helps to see respected colleagues modelling the desired behaviours.

Read our article on Making change stick by getting the whole team on board

It’s important to bear in mind that changing behaviours and mindsets doesn’t happen overnight, these things take time to embed. The tools and approaches above will help you maintain momentum and create the emotional engagement you need to embed the desired ways-of-working on a permanent basis.

If you have any interesting insights, or experiences of behaviour change related to cyber security, we’d be interested in hearing from you, so leave us a comment.

Agility – moving beyond the buzzword

Why adopt an agile mindset?

A lot of our clients appreciate the benefits of adopting an agile mindset, as well as agile working practices.  And this makes a great deal of sense, after all, we’re living in an age of major business disruption and innovation.  Modern business must deal with a plethora of challenges, from regulation, compliance and new technologies, to the economy and exploitation of big data.  Most of these challenges can also represent opportunities, if you’re in the right shape to take advantage of them.

This led me to think about how organisations message around agility (agility in terms of organisational culture and mindset, not Agile Project Management – although these two concepts are most definitely not mutually exclusive), and how they ensure everyone is on the same page with regard to what it actually means to be agile.  Agility can often be seen as an abstract concept that is not grounded in the operational reality of an organisation; I often hear conversations around agility along the lines of, ‘but what does it really mean for us?’ Or ‘agility means speed over quality’.

 What does agile really mean for an organisation and its people?

Agility does not mean unplanned or risky, quite the opposite in fact. The goal is to be nimble and flexible – ready to pounce on opportunities, or to change course to avoid inevitable problems. To be agile, an organisation and the people within it must have a clear goal in mind with waypoints to check if the plan is on target.

Here are five principles to help you convey what agility really means in the context of your organisation:

  • Stability – to be agile and adaptive the organisation and its processes must be stable. That is stability in the sense of the organisation’s propensity for flexibility, reliability and resilience.  This is where stability and predictability should be seen as enablers for agility – many large organisations have these attributes – use them to your advantage.
  • Flexibility – this is the ability to course-correct mid project/initiative or in more extreme cases to change direction entirely.  This requires people within the organisation to accept that, ‘what was right then may not be right now’.  This is where the real mindset and behaviour change comes in, so take time get the right message across.
  • Speed – a primary benefit of agility is the speed with which things happen, while maintaining the quality of output.  This could be getting a new drug to patients, taking advantage of an emerging technology or an untapped market opportunity.  This is an output of an agile organisation, not a personal trait to ‘do things fast’.  It comes from a stable base and flexibility of mindset.
  • Culture – think about the culture of your organisation.  How do the behaviours and accepted norms fit to the principles of agility?  Tune in to those cultural aspects that align with agility and think carefully about how to message around those that may be in conflict.  This is not insurmountable and can be achieved by following a process to find the answer which is right for your organisation.
  • Get creative – we know that the best messages are ‘sticky’ in that that they are easily communicated, get re-used and tell a story.   A great way of achieving this is to represent your agile story visually.  With clear and concise thinking, which is represented with a visual identity, you will get a better spread of awareness and desire to engage with these new agile principles.  Check out our blog post on The Impact of Storytelling on Change Programmes.


In summary, the only way an organisation can adopt an agile mindset is when all of its people truly understand the principles of agile, the advantages to the business and the benefits to them as individuals.


If you have any further ideas on what agile means to you or your business, or experiences of how you or your organisation adopted an agile mindset, then get in touch via the comments below.

How does change management fit with project management?

There is, understandably, some confusion about how change management activities sit alongside project management.

After all, project management provides for comms and learning, so what’s the need for additional change management?
Looking at the success rate of projects, we can see there is great additional need for a structured approach to managing the people aspect of change.

Working at portfolio level – transformational change

This looks at projects from a portfolio, organisational perspective. If your organisation is faced with complex transformation, involving multiple projects, typical project management activities around comms and learning will not be enough to steer the organisation’s people towards a desired future state – efforts at the project level will simply be too fragmented. Change management allows for a portfolio top-down view of the way in which a business’s people will move from the present state to a future desired state.

Designing change with people in mind

At the beginning, project management includes a focus on initial stakeholder analysis, mapping and communications planning. However, change management goes further to plot the impact of the change/s on the organisation and teams.

This is the important part, without the buy-in and engagement of the organisation’s people, the project is likely to encounter negativity and push-back, with project managers spending precious time fighting fires and rescuing relationships.

The change management team will get to grips with the culture and beliefs of the different teams involved, understanding that potentially, each of these groups have their own unique attributes and preferences.  Feedback will be gathered directly from people on how the proposed changes could affect them, and how their day-to-day working may be impacted.

Building this initial picture and understanding of the organisation’s teams is the first step in a structured approach to the people aspect of change. Next the change management team will carry out impact analysis, change readiness assessment, and initial stakeholder research in order to outline a strategy to manage resistance and fulfil communication and engagement roles.

Factoring people in at the beginning means that barriers to adoption can be clearly identified and proactively dealt with.

Adding depth to the delivery of change to people

Articulating the reasons for the change, from a people and business perspective, comes directly from having the above people-focused approach to planning and strategy. A clearer vision comes from conveying the wider context of change and what that will mean for people. The story of why the change is happening is given a broader strategic level context.

From that it is easier to produce the blueprint for a visual identity, and a set of messages that create impact for teams and individuals. Inspiring people with a story, the context for the change and what it will mean for them are all made possible by the more structured people-focused planning and strategy which is afforded by change management.

Further, change management activities create a network of local support during the project delivery. Change champions are equipped to communicate and endorse the change. Special attention is given to line managers, sponsors and this change network to enable them to fulfil the goal of not just pushing messages out, but receiving input and monitoring how the change is being received and adopted by people.

An IT manager may deliver change focusing on communicating the benefits and training people to use new technology or process. However, change management process takes this further. Feedback and response mechanisms are formalised and structured.  It provides coaching for senior leaders and sponsors on how to identify the root causes of resistance and how to engage and manage resistance when it happens.

Read our article on managing resistance to change.

Training becomes another opportunity to engage with people and obtain their buy-in and genuine participation. Change management activities relating to training focus on how it can be made more interactive, designed for feedback, and feature the organisation’s people in the delivery – all with the core messaging throughout.

Post implementation we find that change management’s people focus means that people are rewarded and acknowledged for their adoption of the new, reinforcing the change after ‘go-live’. Feedback from people improves process and ensures the changes adapt to meet their original goals.

The Social Network: Discovering informal change leaders

When undertaking a change project, whether it be technological or process based, we always look to build a change network to act as champions for the cause throughout the organisation.

The obvious choices for these roles are usually senior leaders, line managers or team leaders, however there is an untapped resource hidden in the formal organisational structure.

Formal business leaders are the natural choice to be change champions but what about the influencers within teams, departments or business units? These types of people tend to be (but not always) the more experienced in the company, typically social within groups and well respected and trusted amongst their peers.

If you could identify and recruit these people to be your change champions not only would you be easing the resistance to change but you’ll be able to gain inside knowledge as to what the real issues are the need addressing.

It may sound next to impossible to find out who the informal influencers are in an organisation but the concept of Social Network Analysis (SNA) makes it a lot easier. SNA is essentially the analysis of informal and social connections between employees and when mapped out looks more like a web of contacts than a formal organisational structure.

It is a true snapshot how a group of people are interconnected and how they share information, and you may be surprised to find out that the influencers aren’t always in a management position.

Carrying out a SNA is a great diagnostic tool to understand the working environment in which you are implementing change but that is only half the battle. Once you’ve identified the key people it’s a matter of taking them from informal influencers into change leaders. A few things to consider when gaining buy-in from this group:

  1. Really help them understand the cause; create belief that this is the best way forward: Sometimes this will be met with resistance, just remember to listen to their concerns and perhaps there may be points that you could act on. Involving the change leader in this will likely lessen the reluctance.
  1. Engage with and involve them on a consistent basis: There is no point in recruiting these influential employees if you don’t nurture the relationship and keep them in the loop. They need to be equipped with the right tools and know that their opinion matters.
  1. Not all influencers will make good change leaders: Keep in mind that although they may have some pull in an informal network, that person may not be suitable to be a change leader. They may not have the willingness to do the extra work or may not be able to see the benefit of the change.

Identifying change leaders through SNA is a great tool to use to get under the hood of an organisation and although this method has been around for decades in an anthropological way, it will prove to be revolutionary in the corporate arena as it can provide insight into the root cause of issues and the informal connections that happen behind the scenes just waiting to be leveraged.

Person-Centred Business Change

How many therapists does it take to change a light bulb?  Apparently just one, but the bulb must want to change.  The old ones are the best – but maybe there’s something here for us in Business Change.

The Person-Centred approach to therapy was developed by Carl Rogers.  Crudely, at the heart of his thinking lies the belief that if people feel secure – safe and valued – they’re more likely to be able to embrace change, and effect it for themselves.  Intuitively, this makes sense, and evidence over decades now can be produced to support the contention.  Rogers identified three ‘core conditions’ that would characterise the attitude of the therapist to the client in effective working: congruence (being genuine); empathy (a deep understanding of what the client is feeling); and an unconditional positive regard for the client (acceptance).

Are there parallels for us as business change practitioners?  Seems to me there are quite a few.

First, and not least, like Person-Centred therapists we do well when we view those facing change as clients, not patients – equals in the relationship.  And, like the corny joke, if they don’t want to embrace change we know that change initiatives are likely to be far less effective than we need them to be.

The core conditions seem to apply as well.  When those leading change programmes are not genuine, when staying on message becomes spin, then those impacted by those programmes invariably sniff that out – and resistance to change grows.  So, congruence matters, and that’s probably pretty well understood.

At Afiniti, we’ve always stressed the need for empathy a deep understanding of those impacted by change – taking the time to understand their current context in depth, learning about what they do, and how they think and feel about it, and about the prospect of change.  We think we pay more attention to this empathetic understanding than many, but its importance really shouldn’t be news to anyone.

What then about unconditional positive regard?  The Person-Centred model wouldn’t require us to approve of every action that those impacted by change take, but it would require us to approve of them.  So, how do we really think about those impacted by change?  As a problem to be solved, or as partners?  As individuals with bad attitude, or as people with entirely legitimate concerns and anxieties?  As people of intrinsic value, or as resources to be deployed at will?  Of the three core conditions this one seems the hardest, the one that Change Initiatives are most likely to stumble over.

How many change leaders does it take to change an organisation?  Perhaps one, but maybe it’s not just the organisation that needs to want to change.

Why do we cringe at corporate values?

Ask someone to recite their organisation’s values and the chances are they’ll look embarrassed. They might say “integrity” or “trust,” using a comedy boardroom voice to show they don’t really buy into it all.

But corporate values are shown to work, providing guiding principles for employees and reassurance for customers.*

So is it that people don’t want to be told what they stand for, or is there just something about the word ‘corporate’ that curdles conversation? Maybe the language used to describe corporate values is often too clichéd or full of jargon.

As part of a study, I talked to frontline staff at a large infrastructure client. They shrugged when I asked about their corporate values and I wasn’t too surprised. More than one guy said “Oh. Don’t we have them on our coffee mugs?…” and many said they didn’t see the point of “a load of words” at all.

But there’s a twist, and it came when the same people went on to say what they liked about their organisation. They spoke passionately about working together, how they respect each other’s knowledge and, heart-warmingly, how proud they feel about looking after the British public each day. They were showcasing their corporate values, without realising it.

Behind a business’ own definition of its corporate values is a set of real beliefs, held by employees about their organisation’s identity and their place within it. If corporate values represent the real culture and identity of an organisation, there should be nothing to cringe at.

A successful communications strategy will use the depth given by employee engagement and insights into corporate values, to build a set of meaningful messages around business change.

Do your colleagues know their corporate values and do they care? Maybe the discomfort lies not in the values but the clichéd choice of words used to describe them – are there fresher alternatives to words like ‘Integrity’ or ‘Commitment’? We’d love to hear your feedback.

*Creative communications agency Radley Yeldar conducted research across FTSE100 companies and found 75% of them have corporate values which they publicly state


Further resources 

Change Readiness Assessment

Internal Communications Channel guide

Putting your team on the map

Is your team not getting the recognition and place within the business it deserves? Then you could benefit from team branding.

When we think about successful branding, we often focus on how it inspires loyalty from an external customer base.

What we often forget though, is the power of branding to raise the profile of an internal team and to cement its position within a business. The fact is: branding is an essential part of raising a profile and defining an internal team or department.

Do you really know what everyone else in the business thinks about your team? How do they think you’re adding value? Discovery and team branding can help you with this. Here are some pointers:


Give them something to talk about: design a great team

Whatever you do, remember that your team brand campaign can only be as great as your team itself. So start by having a workshop and brainstorming about your team’s vision and its long term plan. This includes thinking about what employees require from you: What methodology, framework and tools will give weight to the team?

Once your core business objectives are aligned to your brand as team, you can use your communications to drive your profile forwards.[1]


What’s your story?

Once you know your vision and plan, work on how this will transform itself into the story behind your team brand and identity. Designing a communication plan with channels tailored to the needs of your stakeholders will build knowledge and awareness. Consistency is also key, and will ensure your target stakeholders stay engaged and interested in your team.


Creating valuable content

There are plenty of ways to create these valuable conversations and let people know what your team is all about. Branding and templates can create a professionalised feel and stir that recognition. Inviting people to interactive hubs or other face to face events can build understanding of what your team is all about.


It pays to be social

Connected networks and social media are necessary in branding. Today, employees go beyond traditional means to connect across the business and provide information more freely, across many social media.

Communicating about your business through connected networks has become the norm, rather than the exception. In fact, the “rising influence of social media has altered the way we seek, evaluate and engage in work and the employers that offer it.” [2] And as the way employer brands promote themselves changes, so should your communications strategies and plans.


Having an authentic voice

Consider creating real content, by using team members as brand ambassadors, and by letting them talk freely across specific media. In turn, this creates the opportunity for employees to create their own, much more realistic, picture.[3]


I hope this is food for thought. What are your ideas on internal branding?


Find out more about how we helped to put a competency development team on the map.

[1] http://www.slideshare.net/TBWA_Corporate/tbwa-7-trends-to-disrupt-employer-branding

[2] http://www.slideshare.net/thetalentproject/bpx-round-table-employer-branding

[3] http://www.slideshare.net/thetalentproject/bpx-round-table-employer-branding

Building trust in times of corporate change

During business change, there can be great uncertainty and trust becomes more important than ever before. So how can we reassure and engage employees?

A recent industry benchmarking report (1) found that companies widely agree that there are two main groups that most successfully delivery change communications:

  • Top level leaders, e.g. CEOs or Presidents
  • Frontline supervisors, e.g. managers

From a change management and communications perspective these results are surprising. Both parties are also in control of very different areas. The CEO provides general direction, and the supervisor manages daily activities, and yet they’re both vital in communicating change.


Building trust and showing empathy

When communicating change, delivery through the right spokespeople shows sincerity, support and commitment to change from executives and sponsors. And at the heart of the corporation, both CEOs and supervisors tend to have the required knowledge, respect and influence.

In a recent article (2), Dr Graham Dietz – senior lecturer at Durham Business School – explains that building and restoring corporate trust is not rocket science, “but companies must earn it by finding a blend of ability, kindness and integrity.” CEOs as well as supervisors tend to, or at least should, have these abilities.

CEOs in particular may have additional hurdles to overcome here. The 2012 Edelman Trust Barometer (3) confirms that CEOs “had the biggest drop in their trust level in the barometer’s history”, with only 38% finding these leaders credible.

When it comes to building trust, CEO or senior leaders may well want to consider bridging the large gap between boardroom and reception desk. Establishing a more personal relationship, while remaining completely professional, can help create foster stronger employee relationships. If used well, site visits, social media presence or web-cast communications can be an easy way of building trust.


Telling an interesting story

Every company tells a unique story. Whoever tells it needs to be able to draw in an audience, inform them, and communicate to them. And there lies great opportunity and responsibility in doing it correctly.

Of course, stories can change over time, but there are certain elements, such as themes and facts that must always be accurate and relevant. Great storytelling establishes trust, and can build a workforce that is happy to rely on its leaders. It can give people direction and a shared sense of purpose, even if this direction will change in the future. Today’s employees want to understand the big picture because it gives meaning to change. Importantly, messages within the story should be aligned with the strategic vision behind change.


Only under supervision

Supervisors, on the other hand, who are easily caught up in employees’ daily issues and concerns, may want to consider staying out of political fray, and focus on providing necessary leadership and direction from a distance. Managers deal with more ‘business as usual’ employee issues, but understanding and communicating change is just as essential. Middle managers need to be aware of their role and empowered to fulfil it.

Ultimately, successful change management needs us to identify who needs to play a role in communicating change and to ensure those people have knowledge of the change, communication tools, and a plan to engage people.



Using the power of leadership and change to tackle Tesco’s crisis

If there’s one thing Tesco’s reporting meltdown tells us, it’s that the only way to stay profitable is to be open, transparent and accountable – without trust, profits are in trouble.

The news that Tesco botched its financial reporting to the tune of £250m, and saw large amounts wiped off its share value since Monday 25th September, means that change is now inevitable at the large retailer. As well taking a look at the way it reports its supplier financials, leadership now has to step up and play a vital role in restoring trust and accountability and confidence amongst employees, consumers and investors.

There now seems to be a need for transparency and open, honest behaviour and that must come from the top. Now is the time for leadership to be heard.

A culture of open and honest dialogue

There is sometimes a tendency to mis-report when times are tough. Add to this, suppliers and other commentators have recently spoken out about how Tesco managers tend to report supplier profit. In this context, open and honest exchanges may not be the norm. There might be a tendency towards ‘presenting’ the picture stakeholders and leadership want to see, rather than a difficult reality. This situation might thrive in a retail environment unless it becomes acceptable to admit failure or to raise a hand over concerns. The task here is for leadership to have open and honest dialogue and set this type of communication as a defining feature of Tesco’s culture. Admitting failure is not a bad thing in business. Leaders must really listen to what employees are telling them and act on feedback.

Living the values

There will be some tough decisions about supplier management and subsequent reporting, but whatever changes Tesco makes, leadership is now tasked with restoring trust and belief amongst stakeholders and employees. Talking with conviction and passion about the values that Tesco must hold dear to preserve integrity will set the tone for behaviours throughout the company. Leadership sets the precedent for behaviours and must live and breath the values it wants to see demonstrated by everyone.

Presence and accessibility

It can be tempting, even for those at the top, to hide away but their ears need to be to the ground and they should work closely with internal teams, especially Communications, to ensure they have visibility and are giving employees the big picture and a way forward.

Tesco’s predicament shows us that companies that are not honest and transparent endanger their ongoing success. Leadership always sets core values and the question is whether, at Tesco, it will step up its presence and convince people.