When should organizations treat behavioral risk as a workflow problem rather than a people problem?

Why Repeated Unsafe Behavior Usually Signals a Workflow Issue

Behavioral risk becomes a workflow problem when the same action keeps happening because the surrounding process makes the unsafe choice easy, faster, or less disruptive than the safe one. That is often more actionable than treating it as an individual discipline issue, because the root cause may be poor defaults, extra approval steps, unclear ownership, or tools that force people to improvise. Security teams should look for repetition, not just one-off mistakes, because repeated patterns often reveal design failure rather than knowledge failure. For broader control context, NIST Cybersecurity Framework 2.0 is useful for aligning the response to governance, protection, and continuous improvement. In practice, many security teams discover the workflow defect only after the unsafe shortcut has already become normalised across a team.

How Teams Distinguish Process Friction from Individual Carelessness

The practical test is whether the behavior persists after guidance and whether the same pattern appears across more than one person or team. If a user keeps forwarding sensitive mail externally, reusing passwords, or requesting exceptions, that is often a sign that the approved path is too slow, too hard to find, or not workable in context. At that point, the right response is to examine the workflow itself: where the control creates delay, where the instruction is ambiguous, and where the secure path lacks an obvious default.

Teams usually get the clearest signal when they compare intent, frequency, and workaround behavior:

• One-off error plus quick correction usually points to coaching.
• Repeated behavior after feedback usually points to process design.
• Shared behavior across multiple users usually points to a system-level friction point.
• Workarounds that save time but bypass policy usually point to a control that is too costly to follow.

This is not a call to ignore accountability. It is a call to separate deliberate non-compliance from predictable human adaptation to a bad workflow. The distinction matters because process fixes, such as safer defaults, clearer handoffs, pre-approved alternatives, or automation, often reduce recurrence more effectively than repeat reminders. Where the workflow spans identity, access, or approvals, the strongest clue is usually that people can complete the job only by stepping outside the intended control path. That guidance breaks down when the behavior is clearly malicious, deceptive, or tied to deliberate abuse of trust.

When the Exception Is the Signal, Not the Outlier

Tighter process control often reduces unsafe behavior, but it can also increase delay and manual effort, so organisations have to balance consistency against operational load. The hard cases are usually exceptions that have become routine. If staff keep asking for the same waiver, bypassing the same step, or using the same unofficial tool, the exception may be telling you that the standard workflow does not match real work.

Guidance versus consensus is important here. There is broad agreement that repeated unsafe patterns deserve process review, but teams differ on how quickly to remove individual accountability from the discussion. A sensible rule is to treat the workflow as the primary candidate once the pattern is repeatable, cross-user, and resistant to coaching. If the pattern stays concentrated in one person despite a workable process, then the issue is more likely behavioral than structural.

Organizations also need to watch for the hidden trade-off: making the process safer can make it less convenient, and if the secure path becomes too burdensome, people will continue to route around it. The goal is not to eliminate human judgment. It is to make the secure path the path of least resistance. That is where the distinction between behavior and workflow becomes operationally useful.

Practitioner Guidance

What to prioritise: Treat recurrence, not the first occurrence, as the decision point. If the same unsafe behavior survives coaching, the workflow deserves review before the person is blamed again.

Decision rule: If the pattern is shared, repeatable, and linked to a cumbersome or unclear process, redesign the workflow; if it remains isolated and intentional, escalate as a performance or conduct issue.

What to verify: Check whether users have a realistic secure alternative, whether the approved path is materially slower than the bypass, and whether policy language creates ambiguity that encourages improvisation.

What practitioners underestimate: People often do not choose the riskiest path because it is preferred; they choose it because it is the only path that lets them finish the task without extra friction.

Practitioner takeaway: The most useful question is not “why did this person do that?” but “what in the workflow keeps making that choice repeatable?”

Related resources from NHI Mgmt Group

• Why do organisations need to treat quantum risk as a present planning issue rather than a future problem?
• When should organisations treat machine access as a high-risk identity problem?
• When does break-fix IT become a security risk rather than just an efficiency problem?
• When should regulators or compliance teams treat an ICO as a fraud risk rather than a normal fundraising effort?