Full training attendance, clean audit, and still exposed

Having policies, clean audits and full training attendance in place does not mean an organisation is safe from misconduct or failure. That was the message from speakers at Trust, Conduct and Speak-Up Culture: How People Systems Prevent Institutional Drift, the latest session in AsiaHRM’s LinkedIn Live Governance Series.

AsiaHRM organised the session with support from HRM Asia and ESG-in-a-Box Academy. Led by AsiaHRM founder Rita Tsui, the discussion included Tim Toa, Founder and CEO of Tiger Forensics, a digital forensics and incident response company, along with Alfred Leung, Associate Director of Risk Management and Internal Control at Chinachem Group.

Tsui opened by noting that institutional drift “rarely begins loudly”. It starts instead with tolerated exceptions, unchallenged assumptions and concerns that go unheard.

Toa’s firm is called in after organisations suffer cyberattacks. He said more than 80% of the incidents it has handled involve human error, regardless of the organisation’s size. A common example is login credentials given to third-party vendors that remain active long after the work ends, giving attackers a way in once those credentials surface online.

Larger enterprises usually have a procedure to cover this. What they lack, Toa said, is someone checking that it is followed. “They put it into the procedure, but they assume that people will follow it. Without checking, they have no way to determine which steps are missing.”

Leung said a failure is rarely down to a single lapse. “There could be a chain of errors, and people have been turning a blind eye all the way for quite some time before it actually fails.” He cited Boeing’s aircraft crashes in 2018 and 2019. As he describes it, short-term targets, cost pressure and engineers keeping quiet about suspected safety issues built up over time. At any point in that chain, he said, one person raising a concern and having it acted on could have changed the outcome.

According to Toa, that second step is often missing. In many workplaces in Asia, someone who flags a problem is told by colleagues to let it go or encounters people who want to avoid the extra work. Whether that changes, he said, depends on whether leadership “treasures the people who are telling the truth” or blames them.

Leung has worked in both multinationals and local family businesses. He agreed that open discussion is harder to foster in Asia, though he noted that the Boeing case shows the problem is not unique to the region. For him, it starts with tone at the top: an open-door policy, a clear stance against retaliation, and consistency between what management says and what it does. “If they see the management saying, ‘I’m very transparent, I’m very open to talk’, but then the next day they are doing different things, they will know.”

He also saw a role for HR beyond policy. Heads of HR can hold informal catch-ups with employees across business units and grades, and HR can act as a check and balance for employees who fear being sidelined by a line manager.

Both speakers were critical of organisations that treat compliance as an end in itself. Toa described organisations that work through requirements with a “tick, tick, tick” approach and consider the job done. When drafting policy, Leung has encountered an even lower bar, with colleagues arguing that “the law doesn’t require us to do it”. The law is a minimum, he said, just as no employee expects to be paid only the minimum wage.

He recalled a check from his early years as an auditor, when the audit programme simply asked whether a client had a whistleblower policy and hotline. Leung rang the hotline at midnight to see if anyone would answer. The number was not reachable. “When we, as management or HR, set up some sort of policy, make sure it works.”

Audits carry their own blind spots. Toa noted that an audit captures a single point in time, and controls often lapse once the auditors leave. Leung cautioned against making zero audit findings a KPI, and suggested assessing audit and compliance qualitatively. “We should treat audit as like a body check or health check,” he said. “You really want to know where your weaknesses are, where your problems are, earlier and try to fix them.”

READ MORE: From decision to direction: Where good strategies lose their way

To assess whether any of this work, Toa pointed to phishing awareness training. HR teams often report 100% completion, but that figure means little when employees can start a two-hour video and then turn their attention elsewhere. A better measure, he said, is an unannounced simulated phishing email after the training, which shows how many people still click. Leung also suggested tracking employee turnover, exit interviews and net sentiment scores, which weigh positive and negative mentions of an organisation online.

On using digital signals to detect misconduct without creating a culture of surveillance, Leung said his efforts to monitor data uploads for leaks had been “not very successful”, as a small spreadsheet can easily go undetected. Toa favoured quality assurance built into workflows, with one employee’s work reviewed by another. The purpose, he said, is to catch mistakes, not to police or punish, but it also shows employees that a mechanism exists.

In closing, Toa repeated that compliance procedures are not the end goal. “The key point is the human systems to keep everything in place.” Leung returned to the chain of events behind every failure: “Anyone within the process during the time could be a hero who saved the world.”