Twenty characters. Three symbols. A new password every week. Mora’s security policy was airtight, right up until every monitor in the office grew a yellow sticky note, her own included.

Swap passwords for expense claims, travel approvals or building access, and the story repeats. A rule is written to remove a risk. People find it too hard to follow, so they work around it quietly, and the workaround creates a new risk that nobody is tracking.

Why it happens

Rules are usually written by the people who own the risk, not the people who carry the cost of following it. The security team sees breaches. The finance team sees fraud. Neither sees the sales manager spending forty minutes on one expense claim, or the visitor waiting at reception because the access form needs two more signatures.

So each rule gets a little stricter after every incident, and almost never gets lighter. Over time the cost of complying creeps above the cost of the risk. At that point people make a rational choice. They do the job and skip the rule.

The worst part is that workarounds are invisible. A sticky note does not show up in an audit. A shared login does not trigger an alert. The organisation feels safe because the rule exists on paper, while actual behaviour has moved somewhere else entirely.

What it really costs

There are two bills. The first is time. Rough maths: if a clumsy rule costs each of 500 employees ten extra minutes a week, that is over 80 hours weekly, or roughly two full-time people doing nothing but compliance.

The second bill is risk, and it is the larger one. A simpler rule that people follow protects you. A strict rule that people dodge protects nobody, and it gives leaders false confidence on top. The weekly password change adds no safety if the new password is stuck to the screen.

There is a quieter cost in trust as well. Every rule that people are expected to break teaches them that rules here are for show. That lesson does not stay contained. It spreads to the rules that really matter, such as fire exits and data handling.

What to do instead

1. Run the workaround test. Ask teams which rules they get around, and why. Promise no consequences for honest answers. If many people avoid a rule, treat the rule as the problem.
2. Put both costs on one page. For each rule, estimate the time it takes to follow and the risk it actually prevents. Some rules will prove worth every minute. Others will turn out to guard against something that has never happened here.
3. Write rules with the people who follow them. Bring a couple of everyday users into the room whenever a policy is drafted or revised. They will spot the sticky-note moment before it happens.
4. Make the right way the easy way. A password manager with single sign-on beats a twenty-character rule. Pre-approved travel within set limits beats a three-level approval chain for a routine client visit.

Expect some pushback from the owners of the risk. Their worry is fair: a lighter rule feels like a weaker defence. The answer is to show them what is happening today, with the workarounds counted, rather than what the policy document says is happening. A rule nobody follows is already weaker than it looks.

The goal is a rule that people follow without thinking about it. That is a design problem, and it rarely gets solved by adding another clause.

Through the EXD lens

The password story sits in the Technology dimension of the EXD Framework, which asks whether the tools and systems people use help them work or get in their way. Security and ease are not natural enemies; well-designed systems deliver both. Tracking this dimension every quarter picks up rising friction early, before it hardens into habits nobody admits to.

Try this tomorrow: ask your team “Which rule do you quietly get around?” and write down every answer without arguing with any of them.

Mora & Kai is a cartoon series from iDream about the small frictions that make work harder. Each strip maps to one of the five dimensions of the EXD Framework: People, Process, Place, Technology and Culture.

Where is friction building up in your organisation? An EXD Audit finds it and puts a cost on it. Or bring your leadership team to the next IIT Hyderabad executive programme on employee experience.