Understand the conditions behind risky decisions
Start with workflows rather than individual scores. Map how staff approve payments, share information, grant access and use external tools. Identify where interruptions or conflicting instructions make the correct action difficult. A workaround may exist because the official process cannot be completed in the time the business expects.
Discuss incidents and near misses with the teams involved. Ask what information was available at the time and whether the approved process was practical. Distinguish deliberate misconduct from mistakes, unclear responsibilities and operational pressure. Reviewing the outcome with hindsight alone can conceal why the decision originally appeared reasonable.
Choose interventions that address the cause
Match each issue to an appropriate response. An unclear payment process may need independent approval; excessive account access needs permission changes. Training helps where knowledge or judgement matters but cannot repair every control weakness. Adding another module without changing an unusable workflow usually leaves the underlying problem intact.
Provide decision aids, verification checklists and named escalation contacts. Test them during realistic situations, including urgent requests and absent managers. Give people a safe alternative when the normal process cannot be completed. A rule that never permits delay conflicts with a rule requiring independent verification.
Use evidence proportionately and fairly
Combine reports, process reviews and relevant security events. Do not assume a training result proves someone will behave the same way in every situation. Check whether differences reflect exposure, accessibility needs or unequal practice opportunities. A finance employee receiving many targeted messages faces a different situation from a rarely targeted role.
Define why personal information is collected, who can access it and how long it is retained. Explain monitoring and involve privacy and employment specialists where appropriate. UK GDPR considerations depend on circumstances; this is not legal advice. Avoid collecting detailed individual behaviour merely because a tool makes it possible.
Review improvements to the working system
Choose measures linked to specific risks: use of payment verification, escalation time and removal of unnecessary access. Evaluate outcomes alongside context rather than one headline score. Rising report numbers may indicate greater confidence in reporting; low numbers may indicate uncertainty about whom to contact.
Invite feedback on whether changes help people work securely without unreasonable friction. Share lessons without naming or embarrassing individuals. Maintain technical safeguards and a tested response plan because improved decisions do not eliminate compromise. Compass is available now; this guidance claims no automated scoring or monitoring capability on its own.