I am privileged to meet with our CEO, Ron Scheese, for lunch every few weeks as part of Andesa’s Mentoring Program. In one of those sessions, Ron asked me to observe ways that employees exemplify our company’s values (or perhaps ways they do not) and report my observations at our next meeting.
When one walks into Andesa Services’ main office, they can immediately tell, at least on the surface, that the company’s values are visible and thus seemingly important. These values are Respect, Integrity, Courage, Honesty, Initiative, and Responsibility, or as they are known internally “RICHIR.” Many companies tout their corporate values proudly through prominent displays, and ensure new employees learn about them during orientation. Many times, that’s about where it ends. At Andesa, one will find “RICHIR” displayed on a poster near the break room, or on a magnet, or a folder, or a notepad on an employee’s desk. There’s a big focus on values in corporate orientation as well.
But my challenge was to not just notice the prominence of the values on display, but to witness the values in action. From a new employee’s perspective, were the values being lived in our day-to-day work?
As I reflected on each of the values, two examples immediately came to mind. But rather than identify instances of a particular value, my samples included nearly every element of our “RICHIR” framework to some degree. Allow me to explain:
From very early in my time with Andesa, employees were suggesting improvements to security processes to me in my capacity as the Information Security Auditor. These suggestions have been unsolicited. There’s no “bug bounty” or a guaranteed bonus for pointing out areas of improvement. These are employee-owners taking the Initiative to speak up, exhibiting Integrity in their work by pointing out things that don’t look right, and taking Responsibility in maintaining a secure environment for employees and for our clients. They’re also demonstrating Respect by trying to affect change through the proper channels.
Andesa’s Security Incident Response program provided another example of values-based behavior. If an employee becomes aware of a security incident–anything from a suspicious person around the office, to a virus-infected computer, to a massive data breach–they are expected to report it to the Security Incident Response Team. During my tenure with Andesa, about a dozen security incidents have been reported. Fortunately, none of them have been serious. In fact, several have been complete non-issues, but were reported by employees out of an abundance of caution. What struck me about many of these reports, particularly the less-significant ones, was the self-reporting nature of them. Employees did not hesitate to raise their hand and admit they had made a mistake. They showed Courage in pointing out their own errors, regardless of the potential fallout. They demonstrated Honesty and Integrity by not sweeping the incident under the rug and hope no one noticed. They took Responsibility for the incident and took the Initiative to report it so that it could be handled appropriately.
As I reflected further, I was able to compile a comprehensive list of other examples to share of employees living up to Andesa’s values, but the two I describe resonate because they involved so many of our values concurrently, involved multiple employees; and are, of course, near and dear to my Information Security responsibilities.
It has not taken long for me to appreciate that Andesa Services is not a place where the company’s values are given lip service when it’s convenient; but it is a place where employee-owners strive to live them every day.