Beyond the Iron Maiden - The Evolution of Compliance Culture

I just returned from Germany where I spent a few days to see family. A must visit on these trips home is always Rothenburg o.d. Tauber. The medieval town located in Northern Bavaria is one of my favorite places, and is full of history and things to see and learn about. One of the museums in town is the "Medieval Crime Museum" where visitors can learn about some of the darkest chapters in European history, including how folks in those times were punished for not following the rules. They even have an original Iron Maiden on display!

What you see in the photo is a tool to deliver a punishment called the "Baker's Baptism." When a baker made the bread too small, he (it was most certainly always a man during those days) was put in this cage and dunked in the central fountain until he was out of breath. It was up to the "MC" to determine the timing there and unfortunately for many bakers, their ability to remain underwater was often overestimated.

One must wonder why folks in medieval times opted to not follow the rules, considering that their punishment was so extreme. Being a risk professional, I do often wonder why it sometimes seems so hard for our folks to follow policies and procedures. Of course, life during the Dark Ages was far from what it is today and I would not suggest we start dunking folks under water for not putting a hold on a check or clicking on a link in a phishing test.

What I would encourage you to consider though is the fact that we often don't dig deep enough when trying to determine why people don't "comply." If you see that folks continue to ignore or disregard a certain procedure, ask yourself this:

• Does this rule still make sense or has something changed that requires us to review it?

• Have we trained the why behind this rule sufficiently?

• Do our employees have the right tools to successfully do their jobs and maintain compliant?

I can guarantee that you will often find the reason for non-compliance is much deeper than the "I just don't like to follow rules." As risk and compliance professionals, we can contribute a lot to our overall risk culture by taking the extra step and asking the right questions. It's surely much better than "going medieval" on folks!

Daniela