On the Frontlines: The Culture Risk of an Organizationwide COVID-19 Vaccination Policy

As a result of the vaccines, many countries have begun to relax their COVID-19 regulations and protocols. Organizations have followed suit by shifting operations from remote working to being physically in the office, at least part-time. These organizations have been banking on the goodwill of their employees to be vaccinated, but this has not been the case.

Because of the availability of information — and misinformation — about the vaccines and their safety from various sources online, many people have decided to wait before taking the vaccine or have refused to get it at all. For organizations, it is important to use information filtering and keep an open line of communication to consistently supply employees with factual information to reduce the fear of taking the COVID-19 vaccine.

Some organizations have decided to implement a policy that all employees must be vaccinated. Such a mandate can present a significant risk to the company's culture.

Management must be educated and aware that not all employees will want to take the vaccine. It is then important for the organization to establish a policy that is sensitive to the views of those employees, but still accomplishes the organization's objectives. Policies should always have a top-down approach in rollout, but a bottom-up approach when sensitizing it to the workforce.

Usually, policies begin with the organization's board, which should develop a general idea of what a vaccination policy should include. This should start with the company's values and ethics.

If the company values having a healthy workforce and wants to provide a safe environment for customers, this is a great starting place to build the policy. Questions the board should consider include:

• Will there be a deadline for employees to have received the vaccine?
• Will there be increased educational sessions with employees to reduce the risk that employees will fear taking the vaccine?
• Will there be exceptions to the policy?
• Will the data be used as a benchmark to normalize the work environment?

For management, it will be important to determine the procedures and details of monitoring the vaccine mandate policy to ensure that it is successful. Communicating with employees on a personal level will be key. Management must use its leadership skills to motivate and encourage employees about the benefits of taking the vaccine. This must be done with great respect and should be done in person — as long as that is safe — to offer a personal touch. Moreover, reporting must be included in the procedures, to keep the board abreast of any updates.

Inevitably, internal audit will be required to assess the effectiveness of the policy. We should start with the effectiveness of its rollout and its impact on the culture:

• Was there an increase of employee complaints or whistleblowing activities?
• Was there a spike in resignations from the company, especially from positions that were determined to be key personnel?
• Was there an increase in employees who spoke out against the company publicly or on social media?
• Was there a general increase in negative comments about the organization on social media?

These are only some of the risks that internal audit must look at to determine the policy's impact. Auditors also must verify that the policy is rooted in the company's ethics and values, and that they are consistently communicated across company lines.

Reviewing and reporting on the accuracy of the vaccination numbers will be the last test of the policy's effectiveness. If the company is close to 100% vaccinated with minimal residual risks associated, internal auditors should be able to provide reasonable assurance that the company's objectives were achieved.