I once was an engineer in a company that had an Ironclad Process. Everything... and when I say that, I know you're just thinking "well, lots of things" but I really mean Every thing... was documented in The Process Manual. There were pages upon pages of diagrams and charts and walls of prose in lengths that would make War and Peace feel like a ChatGPT "summarize this" prompt.
These folks knew how to codify things.
You might think that the organization was running like a well-oiled machine, and peak efficiency had been reached.
But you'd be wrong.
If anything, the organization faced more than average chaos. There was a culture of fear: you didn't want to be the one responsible for an outage. You definitely didn't want to be the one responsible if your team missed any of the paperwork required by The Process! Throughout the organization, there was a deep desire to "craft the story correctly"... presenting the data from any situation to senior leadership wasn't about speaking plainly and communicating effectively, it was focused on massaging the narrative to protect egos and reputations.
The dashboard lights were green, but the building was on fire.
The problem isn't that the process has problems... or even that so many rules exist... but that it's measured on Compliance over Candor. When we're not safe to speak freely about problems, we can never get to the point where they can be fixed.
The Symptom: Cargo Cultist Compliance
Part of the problem with having The Process codified in such detail? Following it. When everything has to be held to "the standard", you sort of end up with two choices:
- Define your standard vaguely (which we'd never allow... that's not secure!)
- Define your standard with one or two systems in mind, and then make all the other systems and teams fit their square pegs in the round hole you just made.
Another wrinkle in this situation is something we talked about in People Without Dirty Hands Are Wrong: The Process isn't something that's maintained by the people who do the work of developing software, it's assigned to people who often think of themselves as "non-Technical" folks who read security publications and make decisions about how Developer teams will work.
You see what we created? A Cargo Cult.
This cult learned early on that they can acquire support from leadership by fearmongering:
WE HAVE A MAJOR COMPLIANCE ISSUE THAT THREATENS THE FUTURE OF THE COMPANY!!!
And they became good at doing the things that looked like Good Compliance, but without the substance of actually improving the company's security posture... Security Theater.
It worked, because the lack of psychological safety meant you couldn't question why it had to be this way. A little vigorous hand-waving, and a stack of papers from whatever NIST publication was in the news this week, and anyone who asked "why" was labeled a Security Threat.
The Cause: Trust Issues
Let's take a step back and think about the effects of these choices.
The organization becomes accusatory. When bad things happen, we rush to defend our team from becoming the scapegoat.
Basic behavioral conditioning follows; engineers learn to hide the truth because there's too much Trust Debt accrued.
Auditors uncover the cracks, but the engineers work hard to stay ahead of them. Trust erodes even more as Audit becomes a game of cat-and-mouse rather than an attempt to work together to keep the company positioned for success.
Blind spots in the audit grow. The organization has to continually increase their spending on audits that are less and less effective because the lack of psychological safety means engineers are working harder than ever to avoid interacting with Compliance.
The Cost: Performance Tanks While Everyone Looks Busier Than Ever
Do you see it yet? Your devs work extra hard to tiptoe around the compliance hurdles. Your compliance team works extra hard to add new hurdles. The whole organization slows down while everyone in the organization feels like there's never enough time to actually get any work done.
All because we can't trust each other... because there's no safety between us.
The only way out is for a leader to do something radical: Admit a major knowledge gap or a past failure. But that can't happen because of the lack of psychological safety... even leaders are subject to the pressure that comes from its absence.
The Fix: Psychological Safety
Everyone's incentivized to hide the truth, but we need the truth more than ever. Here are some practical tips for encouraging safety with your team:
Leadership Has To Model It
This isn't a One-and-Done kind of thing... leaders have to start modeling the vulnerability that cultivates trust.
Yeah, I know. That means setting aside egos and admitting "I don't know" or "I was wrong". Nothing awesome was ever easy... but this can be the moment...
Do you have the courage?
Intentionally Practice Accepting Radical Feedback
Ask for feedback, but don't react. Thank them for sharing, work on it... but stop trying to justify why they don't understand.
We are really bad at this, and not just in work relationships! Listening to a critique is one of the hardest things anyone will have to do... and the way we make ourselves feel better in the moment (justifying and rationalizing) actually prevents the critique from working.
Start Measuring Psychological Safety
This one could be tricky; there's no "safety meter" that you can look at to know how much trust there is in your team. But you can measure a related concept...
MTTR (Mean Time to Report, not Resolve). In a safe culture, the gap between a mistake and a report is minutes. In an unsafe culture, it’s days (or until an Audit stumbles upon it).
Blameless Postmortems. A team that feels safe will share details that the organization can learn from. A team that feels unsafe will work to spin the narrative.
Response to Candor. In a safe organization, the response is curiosity. In an unsafe one, you'll find defensiveness.
The Wrap-up: Thinking Backwards
Most leaders will default to a dispassionate sort of ideal. "We don't have the time to think about Psychological Safety, we just need people to get the work done. We have deadlines!!!
They completely miss that building that layer of trust and safety into the organization provides the foundation for velocity. If you aren't afraid to make mistakes, you'll try more stuff. You'll push harder and go faster.
Today, I'm asking you to take the time to set up some metrics that help you understand how safe it is to speak up on your team. I bet you find that when those metrics are aligned, your productivity metrics will improve too. 😉
Top comments (0)