Managers often complain about the difficulties of getting employees to actually follow security and safety policies.  Rules are frequently 'more observed in the breach than the observance'. It's almost like most people have no understanding of the risks involved.

However, people's understanding of the normal risks that they regularly encounter is surprisingly good. In fact they may understand the risks better than most managers!

Employees know what the real risks are at work, and they all revolve around not getting the job done. Failing to complete tasks assigned is a real and tangible risk that employees deal with every day. Their ability to manage this risk, and hence their performance on the job, is what is continuously measured and rewarded.

The risks of not following security and safety policies are much less real. Maybe the risk will eventuate but probably it won't.  Even if it does happen, the penalties are aren't necessarily that severe and the impact usually affects someone else. In many cases, the penalties for breaches are bourne by those responsible for developing the policy and not by those responsible for following the policy.

Given the choice of following the policies to the letter or getting the job done, it is not surprising that employees make a rational choice of ignoring the policy.   Getting the job done is what the organisation rewards so that is what it gets.

A simplistic answer is to significantly increase the penalities for breaching the policy so that they far outweigh the benefits of doing so.  All this really achieves is placing the employee between a rock and a hard place. They are penalised if they break the rules but aren't rewarded if they don't perform because of them. Not a good environment for a happy, safe and productive workplace.

Road safety experts have grappled with this problem for years.  Drivers regualrly exceed speed limits to gain the reward of reduced travel time, even though speeding increases the chances of an accident and magnifies its impact.  Five minutes saved on every trip is valued higher than avoiding an unlikely accident, particularly as they won't necessarily be paying the true cost.  Harsher penalties and greater enforcement only have a limited effect - drivers slow down for speed cameras but resume speeding when out of range.

Where road safety programs have been most effective is where they have recognised the motivations behind driver behaviour.  One successful approach is to recognise that drivers want to get from point A to point B as quickly as possible and build roads that are capable of doing that by removing dangerous curves and providing sufficient capacity, rest facilities,  overtaking opportunities, etc. The condition of the road is no longer an impediment to getting from A to B.  Not only does this reduce risk but it also increases efficency.

The other successful approach is the one used for drink driving.  Thirty years ago in Australia it was perfectly acceptable to drive your car whilst drunk.  Today the majority of drivers would not even consider drinking if they had to drive nor would they allow others to drive after too much to drink.  Whilst drink driving laws and strong enforcement is partly responsible, it was the culture change involving people's attitude towards drink driving that has the biggest effect.   Early in the introduction of drink driving laws, people found guilty were publically shamed by having their names published in the newspaper.  The message was repeated through advertising campaigns and the publicising of cases involving high profile individuals - driink driving is shameful.  It has taken a long time but today drink driving is culturally unacceptable.

The same two approaches can be used for security and safety risks in your organisation.

Where possible remove the dangers and make it easier to complete the task in a safe environment. Your organisation will benefit from both the reduced risk and the increased efficiency.

Alternatively, change the perception of the risk in your organisation's culture.  Reward the desired behaviour and make the undesired behaviour shameful.  Peer pressure is a much stronger enforcer than rules and policies will ever be.

When developing policies and procedures, it is important to look at the bigger picture and determine the motivations behind undesirable behaviours. Trying to change behaviour through rules alone is a hard way of going about it.