Playing the Game of Risk in Workplace Education

In his acclaimed book, “A Theory of Fun for Game Design,” Raph Koster says: “Fun from games arises out of mas­tery. It arises out of comprehension. It is the act of solving puzzles that makes games fun. In other words, with games, learning is the drug.”

Koster, a gam­ing industry thought leader, is focused on challenging designers to get away from the predictable, and therefore boring me­chanics of games, and to look for some­thing new that drives engagement. But he might just as well have been talking to de­signers of employee education programs. And most of them could use his help.

An effective training program starts with a risk-based analysis of who in the company needs to be taught what, and at how deep a level of understanding based on each person's effect on or exposure to a given threat, and the level of risk that threat presents to the organization. OCEG Chair Scott Mitchell says that a great way to figure this out and determine the types and frequency of training and assurance for each role is to use a “Job Ex­posure to Risk Factors Heat Map.”

But that really is just the start, isn't it? Determining how to ensure the required understanding is as important as deciding who needs to know what.

With the advent of online e-learning and the ever younger workforce familiar­ity with video gaming and role playing, research is demonstrating the value of adding a gaming aspect to your education plans. But really, is this anything new? For decades, researchers have demon­strated that children learn best through play, and more recently the same findings have been developed for adult workplace education. Before the use of computers for training, and even still today to meet certain high-risk needs, simulation gam­ing in workplace classrooms has been an effective tool.

So what is new? It's the focus, as Koster describes, on the methods or mechanics of the game. The content is the content, but when we can make employees want to engage, and develop a teaching approach that they learn from and actively seek out, we are, no pun intended, ahead of the game. And games that work use a wide va­riety of styles and approaches.

Well-designed games encourage en­gagement, and more engagement means more reinforcement, and that leads to better recollection and application of the information. Situational decision making drives the player to think, not just act. Making wrong choices and seeing the consequences leads to desire to act the right way and gain rewards, be it advanc­ing to the next level of the game, earning a prize for success, or understanding that in the real workplace world the reward may be achievement of personal and organiza­tional objectives.

An added value of gaming beyond teaching in the first instance, and rein­forcing learning on an ongoing basis for those who fall into the hotter regions of the heat map, is the opportunity to track and evaluate the choices the player makes. Seeing a repeated failure to make the right decision may lead to a call for a refresher course, one-on-one training, tracking of behavior on the job, or tagging the indi­vidual as more high risk which may lead to more monitoring or a change in job responsibilities and rights.

Just remember, as one size does not fit all in deciding the content and intensi­ty of training needs for each role or indi­vidual, neither does one size fit all in a gamified learning experience. The suc­cessful use of gaming requires expertise in design and testing of the selected ap­proaches. As Koster says, “Since different brains have different strengths and weak­nesses, different people will have different ideal games.”

Training Based on Risk Exposure: An OCEG Roundtable

Switzer: Today, everyone agrees that formal training is an important part of any compliance or risk-management capability, but that might be where the agreement ends. How do you suggest companies decide on the appropriate amount of training?

Perreault: I believe that this begins with the board and senior management agreeing on risk appetite of the organization so they can identify and rate key risks for which training would be an effective control. Then consider many things. How heavily regulated is their industry?  What geographies do they operate in?  What are the enforcement trends and what are the potential costs associated with enforcement or litigation? Next, assess different employee groups and their risks, which may vary by job function, level in the organization, geography, and other factors, and use a ‘risk-based approach' to define the training needs of each group.  This methodology ensures training is applied strategically to mitigate risk whilst maximizing the return on investment.

Jones: The question the organization should ask is: “If we do not do this training will we prevent the organization from meeting our objectives and strategic plans?” If the answer is “not likely,” then minimum training is probably appropriate.  Sometimes organizations proudly say: “We don't just meet the law, we exceed it.”  If going beyond the bounds of the law does not better enable the organization to meet its objectives, then the activity might just be a waste of resources.  Start by looking where the bets are being placed.  If the company is betting on international expansion, then intensive anti-bribery and corruption intensive training is a necessity for key employees.  Also design training to build and protect sources of value.  If an intangible asset, like a brand, is an important source of value, thoroughly train employees to identify, understand, and react to events or behavior that could impair the brand.

Lynch: The type and amount of time spent on formal training per employee should be based on its culture and values in addition to its risk profile.  I don't think there will ever be a set number of hours that could or should be a standard for formal training across different organizations.  A great way to think about this is to ask, “What do we need employees to believe, think, and do?”  Then it becomes easy to determine what training will best help you accomplish your goals.  Adult learners typically learn best when you follow a 70/20/10 learning approach.  Ten percent of training should be formal, 20 percent through relationships, and 70 percent through on-the-job learning.  The challenge is to understand what content is best suited for a formal environment versus through relationships or on-the-job interaction with a manager.

Switzer: When it comes to determining both the scope and the style of training, one size does not fit all. What are some methods you suggest for determining who should get what?

Lynch: You have to develop close partnerships with legal, HR, audit, security and other important stakeholders in your organization to get input and ensure everyone feels that their voice is hear. Then they will support decisions about who should get what training. It is also important to seek outside insights.  Work with your training vendor and outside counsel, or do research to understand what laws and regulations have been changed or enacted since you last established training requirements, and regularly reassess the environment your business is operating in.  Key triggers that cause me to look at education plans include significant changes in business strategy, the ERM process, shifts in the regulatory environment, or new internal opportunities.  For example, if the company indicates it is going to start taking more risk to innovate, then this is a trigger for me to think about what behaviors we need team members to be able to display in order to take risk that drives innovation while protecting the business, brand, and customer relationships.

Perreault: You must assess risks by employee groups.  Understand things like: How likely is a group of employees to participate in activity that is related to a particular regulatory area?  How complex is that regulation?  What controls are in place already?  Is this employee group responsible for making sure others comply with policies and regulations?  You also have to consider what you will need to provide to evidence to regulators and courts that the program exists and is effective. Once you get that figured out, you must ensure that you stay on top of changes in legislation and enforcement, and revise policy, procedures, and training accordingly.  This is a constant challenge and the more complex or regulated your business, the more likely you will need to employ software and services to track regulatory change and enforcements and tie those to your internal policies and training.  Once you have all of this tied down, you can start to establish the right rhythm and mix of methods and approaches to engage the workforce and ensure maximum retention of key information. 

Jones: Determining the scope and style of training should have several input sources.  Most organizations have three- to five-year strategic plans, and training programs should be designed to support those plans and initiatives. One good analogy is that a training initiative should be like a physical fitness regime.  You cannot exercise the same muscle every time to make significant improvements, and you cannot ignore the diet.  A culture is like a diet.  If the organization designs and delivers great training but the culture is toxic, probably no improvement will be made.

Switzer: Knowing that training is effective is critical. But what does that really mean? Is it enough to test understanding at the end of a course? How do you suggest ongoing evaluation of effectiveness and the relationship between the training and the desired effect on behavior? 

OCEG ROUNDTABLE PANELISTS

Carole Switzer,Moderator

President,

OCEG

Earl M. (Chip) Jones, III,

Shareholder,

Littler

Alisha Lynch,

Education Leader, Ethics &,

Compliance, Dell

Steve Perreault,

Global Head of eLearning GRC,

Thomson Reuters

Source: OCEG.

Jones: Whenever a training initiative is first designed, the organization should consider what it will use to determine effectiveness. For training aimed at low risks, testing understanding at the end of the course may be sufficient.  In high-risk areas, however, additional measures will be required.  The organization should establish controls like periodic certifications, specific approval processes, and audit techniques to assess training effectiveness and resulting compliance.

Lynch: To determine impact and measure ROI of training, most learning professions believe you must go deeper than a knowledge check at the end of a course.  Many use some version of Kirkpatrick's Model around measurement.  I would encourage ethics & compliance professionals to reach out to learning leaders in their organization and understand how they measure impact.  But before you can do this, you must first understand what knowledge, skills, and behavior employees must possess; how this will help their team accomplish their goals; and how these team contributions help the organization accomplish its strategic priorities.  Understanding the connection between ethics and compliance and the business is an imperative if you want to be able to effectively determine ROI, because this will help you deploy effective measurements that ask the right questions in both a qualitative and quantitative way.

Perreault: Measuring effectiveness begins with understanding your objectives, which—in a compliance setting—you want to have organized around a defined taxonomy.  This way you can tie the training back to the relevant regulatory risks that you are trying to manage and any changes in those risks. You need to determine the purpose of the training.  Is it being used as a control, as remediation, or as a risk assessment tool?  And is your goal to raise awareness, impart knowledge, or teach application?  If you are looking to measure awareness, maybe you follow up a training event with a survey.  A test is probably the right tool for measuring knowledge.  If your objective is to get an understanding of the ability to apply knowledge, then you may want to use interactive scenarios or game-based training.  Ideally you record all of these interactions in a learning management system that is tied to your organization's HR systems so that you can easily cross-reference training data with other indicators.  For example, can you associate the completion of training—or better yet the scores on assessments or games—with a subsequent reduction in customer complaints in a particular area?  The more you are able to demonstrate the effectiveness of your training efforts, the greater the future investment in the training function is likely to be.

Switzer: Some circumstances clearly call for live, classroom education while others are obviously better suited to online e-learning. In just a few words, what are the factors that should be considered in determining which way to go, or whether to provide both methods of training for a particular subject? 

Perreault: There are a number of factors to consider in addition to the risk level for each subject area and employee.  Is the employee group very large and geographically dispersed?  What is the cost of travel to do training in person?  What is the opportunity cost to simultaneously pull a group of employees away from their day-to-day activities?  How critical is the need for recordkeeping, measurement, and having the ability to analyze data about the training? 

Jones: One important factor to consider is whether two-way communications will be required.  If training in high-risk or mission-critical areas, organizations should want participants to have the opportunity to ask questions about specific situations and have trainers who can provide immediate feedback and answers.

Lynch: The best way I have found to do this is to understand what you are trying to accomplish first.   By shifting the conversation away from “risks” and into the world of behavior you can better determine what type of training vehicle is best suited for what you are trying to accomplish, or if creative communications rather than any formal training will better help you accomplish your objectives.  My advice is to get clear on what knowledge employees need to have so you can have meaningful conversations about how to accomplish that.