# Getting it Right: A Model for Compliance Assessment

Kwasi Dankwa, Keiichi Nakata

► To cite this version:

Kwasi Dankwa, Keiichi Nakata. Getting it Right: A Model for Compliance Assessment. 18th International Conference on Informatics and Semiotics in Organisations (ICISO), Jul 2018, Reading, United Kingdom. pp.228-237, 10.1007/978-3-319-94541-5_23 . hal-01920728

HAL Id: hal-01920728

https://inria.hal.science/hal-01920728

Submitted on 13 Nov 2018

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>
# Getting it Right: A Model for Compliance Assessment

Kwasi Dankwa and Keiichi Nakata

Informatics Research Centre, Henley Business School, University of Reading, UK

k.d.dankwa@pgr.reading.ac.uk, k.nakata@henley.ac.uk

**Abstract.** Compliance is important for organisations but models and tools to aid understanding of compliance behaviour is limited. This paper argues that the understanding of the interaction between subjects and objects and their intention to comply with requirements of rules and regulations may be a predictor of compliance behaviour. Thus, a Conceptual Compliance Assessment Model (CAM) is developed by extension of Technology Acceptance Model and Activity theory for assessment of compliance behaviour. Data collected and evaluated showed that the awareness and understanding of the mediational tool is critical in realizing the outcome. It also showed that other factors like the perceived usefulness, perceived ease of use, the community and the management set up also affected compliance behaviour. Essentially, the use of CAM will be useful in assessing the compliance activities of subjects which may aid in formulation of behaviour support systems to improve compliance behaviour.

**Keywords:** Compliance Assessment Model, Quality Management System, Activity Theory, Technology Acceptance Model

## 1 Introduction

The quest for organisations to produce safety critical products and to meet customer needs has led to ubiquitous implementation of systems and processes that supports compliance. To these organisations, compliance is a way of ensuring that they get it right at the first time to reduce reworking processes and wastage of resources. Thus, compliance to rules, regulations, policies and standard is essential.

Consequently, tools, frameworks and models have been put in place to assess practice and to ensure that compliance requirements are met. Some of these tools include Compliance Action Framework [1], Analytical Framework for Behaviour Analysis [2] and ICT Approach [3]. However, non-compliances have been reported as most of the existing systems have failed to assess the reasons behind the non-compliance behaviour or the compliance intention. There is therefore the need to consider other tools and approaches that incorporates compliance intentions of agents to aid in the management of non-compliance. The purpose of this research is therefore to develop a conceptual model for the assessment of compliance behaviour that considers the reasons behind the non-compliance behaviour. The paper starts by reviewing tools and models that have been applied in information systems, develop a conceptual model based on the
literature review and evaluate the new conceptual model by assessing compliance be-
haviour to a Quality Management System (QMS).

2 Rational for the Model

2.1 Compliance Behaviour

The study of agents’ attitudes and behaviour has a long history in information systems research and compliance behaviour is no exception. Compliance behaviour have been shown to be impacted by many factors which may include incentives, governance, controls, culture and behavioural issues. Because of this, researches in different disciplines have looked at compliance effects (for example, [1], [2] and [3]) but there are still some gaps in theories and models to support compliance assessment. According to [4], management of compliance relies on the agents’ behaviour to either follow requirements or not. Others [5] indicate that norms within the organisation influence human behaviour which in turn influence compliance to QMS. Accordingly, understanding factors that influences adoption of the rules and regulations and the effects of norms will be useful in understanding non-compliance behaviour. The next sections will therefore review two models that considers acceptance and use of IS and the interaction that exist between the subjects and the objects in the organisation.

2.2 Extension of Technology Acceptance Model (TAM)

Over the year’s researchers have worked to gain a better understanding of technology acceptance and implementation success in order to make the most of technology investments. User acceptance of technology is seen as the demonstrable intention on the part of the user group to employ information technology for the purpose it is set to be used for [6]. Technology Acceptance Model (TAM) is one of the models which has captured the attention of the Information Systems (IS) community. It proposes that the behavioural intention by a user to use a system is influenced by perceived usefulness and perceived ease of use of the system which influences the actual use. Application and extension of TAM will aid the assessment of compliance behaviour because of its use in explaining and predicting acceptance behaviour of agents. Moreover, most of the compliance requirements are formulated into IS, as such the extension of TAM is considered as appropriate; we argue that the factors that influence user behaviour to accept and use technology for the purpose it was introduced can be applicable in assessment of compliance activities. This is because, for a staff to exhibit compliance behaviour, they must accept to follow the rules and regulations as required in consonance with TAM. We further argue that, because compliance is influenced by intention of the user, the success in using TAM to predict acceptance and use of technology can be extended to the analysis of compliance behaviour. According to [7], behavioural intention is the formulated conscious plans to perform or not to perform certain specified future behaviour. Since adherence to set of rules or regulations is a behavioural manifestation of
compliance, we argue that understanding the factors that influence behavioural intention is relevant in analysing compliance behaviour. Consequently, by understanding user's acceptance of compliance requirements, assessment of the reasons for the compliance behaviour can be made. Essentially, use of TAM to assess acceptance of technology may be extended to assess acceptance and compliance to rules and regulations.

## 2.3 Extension of Activity Theory

Activity theory is a conceptual framework with “activity” being the foundational concept. This is understood as useful as it develops interaction between the subjects and the world objects [8]. An activity is defined by an object and this may be material thing, a plan or a common idea which is manipulatable by the participants of the activity [9]. According to [10] activity theory has been found to be effective in providing insights into all aspects of interactions and contradictions in processes. Its application in this research is therefore relevant as the processes within the organisation involves activities. As the subjects interact with the object by use of the tools and rules [11], the outcome of the interaction may be assessed. This interaction between the subject and the object is mainly characterized by two key aspects; the subjects of activities have needs which should be met. With organisations having needs, we argue that this theory will allow for the activities of the subjects to meet these needs to be assessed. It affords a process of reviewing the factors that are critical to the interaction between the subject and the object.

The next sections describe the conceptual model development, collection of data and evaluation of data.

# 3 Methodology

To meet the objective of the research, a design is considered that seek to understand the subjects view of a QMS. To do this, a conceptual model was developed by an extension of TAM with constructs in Activity Theory. Questions were formulated from the factors of the model and staff were interviewed to ascertain their views on the reasons behind non-compliance behaviour to a QMS.

## 3.1 Compliance Assessment Model

The proposed conceptual model, called Compliance Assessment Model (CAM) was developed as a synthesis of TAM and Activity Theory (Figure 1). CAM is based on the premise that; the subject has a need and interacts with the object to attain the outcome. This interaction by the subject is achieved by use of mediational means; tools, rules and division of labour. The compliant use of the tools by the subject is influenced by the perceived usefulness and perceived ease of use of the tools.
<figure><img src="image_2.png" /><figcaption>Fig. 1. Compliance Assessment Model</figcaption></figure>

## 3.2 Data Collection

The purpose of this section was to facilitate the collection of data for analysis. The data collection process enabled collection of information from all the relevant sources in the sample population. This was to allow for the answering of the research problem and to aid evaluation of the outcomes. To do this, the data collection was performed by use of purposeful sampling method. Seven staff members (table 1) from different departments and staff grades in “a healthcare product provider” were selected for the interview. The selection of staff was based on their interaction with QMS and interviews were conducted over a period of 1 month with each interview lasting between 1 – 2 hours using questions generated from the constructs of the conceptual model.

Thematic analysis was then used to analyze the data gathered from the interviews.

<table><caption>Table 1. Showing Job Titles of Staff Interviewed</caption><thead><tr><th>Staff</th><th>A</th><th>B</th><th>C</th><th>D</th><th>E</th><th>F</th><th>G</th></tr></thead><tbody><tr><td>Job Title</td><td>Deputy head of lab</td><td>Lab manager</td><td>Biomedical Scientist<br>Team manager</td><td>Trainee Biomedical Scientist</td><td>Director of Lab</td><td>Assistant QA Manager</td><td>Team supervisor in lab</td></tr></tbody></table>

## 3.3 Summary of Interview Data

The data collected from the interviews are summarized below.
**Tool/ Mediation.** The criticality of the QMS was expressed by staff. Staff E stated, "QMS is critical to the process and used to manage the quality of the products in the organisation. It has contributed to increasing the quality of patient output and has helped to improve patient engraftment outcome and failed engraftment is now very rare". Also, staff B indicated "I see it as a fundamental part of the provision of healthcare services and products".

**Subject Attitude.** Most of the staff indicated that they have accepting attitude towards the QMS, but some had reservations about the QMS in routine use (practice).

"Is good and am open to the use of QMS even though I have occasions where I don't want to face using it" (staff B). "I find it useful at times when making decisions but at times I find it too picky as things that might not be as important in most cases (staff C)".

**Community.** There was expression that the community of staff influence each other in the way they behave towards the QMS. Staff F stated: "The collective attitude of staff in the department impacts on QMS and staff B indicated that "general shared frustration with the QMS within the Lab"".

**Division of Labour.** There was expression by staff that department structure (hierarchy) and stakeholders in other departments influences the way they related to the QMS.

"My staff in the department are influenced by me and they take QMS seriously, but Senior management team do not influence me positively" (staff A). "The managers in the department see the QMS and the QA staff as police and as such this notion is transferred across" (staff D).

**Perceived Usefulness.** Staff expressed that if the QMS is perceived as useful for the task, then they may be inclined to comply all the time. "Yes, I see QMS to be a useful tool as such I use it" (staff G). "I don't think I need the QMS to do my routine process" (staff D).

**Perceived Ease of Use.** Staff expressed that if the QMS is perceived as easy to use, then staff compliance may increase as they will be more inclined to follow always. "I see it as easy to use but again application is varied across staff and department" (staff C). "If QMS is simple, accessible, easy to learn and readily available then it will be followed" (staff G).
**Behavioural Intention.** Some of the staff expressed that they intend to follow QMS always, but others had reservations in following QMS all the time. Staff F indicated "Yes. I see it as part of my day to day stuff, I see QMS as part of the process and so the intention is to use it". Staff B also asserted that they "I intend to comply in all cases but may not be happy doing that".

**Actual Behaviour.** Staff expressed mix-feelings that although they intend to follow the QMS, they do not follow always. "I am more likely to follow the QMS in emergency situation than in less little things due to the clunky nature of the QMS" (staff A). "I generally do but the timing may be the main non-compliance. This is because I know is important and required for the output of our process but following sequential process of the QMS may be difficult" (Staff B).

# 4 Findings and Discussion

## 4.1 Findings

Through the data collection and evaluation, three more constructs were noted: KPI's versus QMS, Resource and time allocation and Misunderstanding/misplaced roles. Summary of the 3 new constructs are stated below:

**KPI's Vs. QMS.** Staff expressed that some of the KPIs tends to contradict the requirements of QMS and as such negatively influences compliance to QMS. Staff B indicated, "Some of the KPI's are to reduce number of quality incidents raised and as such staff will prefer not to raise a lot to meet the KPI". Staff G also stated, "Failure of management structure in line with KPIs etc. have also contributed to the failures in QMS".

**Resource and Time Allocation.** Staff expressed that the resource and time allocations are not always enough to achieve required outcome. "Not enough time given to do the work, but you are expected to do it; only interested in statistics and not the actual process been done effectively" (staff A). "Staff always rushing off their feet (very busy) which leads to the mistakes/errors and to ask them to then complete QI and all related QMS paperwork, they will prefer not to report it" (staff E).

**Misunderstanding/Misplaced Roles.** Staff expressed that there seem to be misunderstanding of roles within the department. Staff E stated, "Frontline people think that they are doing QA work as people in production will expect QA to be raising Qis dealing with issues and not them".

Also, some of the staff indicated that actions of stakeholder's in other departments may impact negatively on them which may lead to non-compliance. "The department
is like a hub so other department not conforming to the QMS will have an impact on
our services as we can't be reliant on their report /results" (staff B).

Figure 2 shows the updated CAM model with the additional constructs based on the findings.

<figure><img src="image_3.png" /><figcaption>Fig. 2. Updated CAM Model</figcaption></figure>

**4.2 Discussion**

The model was developed to assess the adoption and compliant use of the QMS in
place. Data collected and analyzed showed that the tool was seen as relevant by the
staff: "QMS is critical to the process and used to manage the quality of the products in
the organisation" (Staff E). This showed that in order to attain the required outcome,
the awareness of the tool is critical. This supports [11] who indicated that the tool is
relevant to attain the desired transformation. Consequently, the availability and aware-
ness of the tool is important for compliant behaviour. Although all the agents showed
awareness of the importance of the QMS, there were some reservations. This may be
attributed to the presentation of the QMS as a sign in the form of; standard operating
procedures, equipment manuals and policies. The use of the QMS may therefore be
dependent on the interpretation by the agents. As such the training, experience, partic-
ipation in workshop, knowledge and social setup etc. of the department is relevant for
the outcome. Moreover, because the subjects have needs [12] they will require the tools
to attain their needs. Because of this their awareness of the tool is important. Essen-
tially, as the subject aligns their values with the organisation [13], a positive compliance
culture is created that supports compliance behaviour. This was evident in the data col-
lected as staff who accepted the values of the organisation were more willing to com-
pliantly use the QMS. In using the QMS, the perceived usefulness of the tool was shown
to influence the intention of the subjects. As stated by Staff G, "they see the QMS to be
useful and as such they use it". This is consistent with [14], who indicated that perceived
usefulness exhibited stronger and more consistent relationship to adoption and use. Essentially, the acceptance by the subjects that they perceive the QMS to be useful, the more incline they are to exhibit compliance behaviour. Also, the ease of use of the QMS was shown to influence the outcome. Staff C indicated that "compliance behaviour may be enhanced if there is ease of interpretation of the QMS". This supports [15], the possibility of non-compliance behaviour will increase if the procedures are so complicated that the operators cannot clearly understand the context of required actions specified in the procedures. As such, if the QMS is complicated and not easily understood then it will not be compliantly followed.

Data analysis showed that the community in which the subject operated influenced their behaviour. As stated by staff F, "there is collective attitude by staff to follow the QMS compliantly." This is consistent with [16] who stressed that community creates "collective programming of the mind" that makes groups unique and this can influence the pattern on thinking, feeling and potential interactions. As such, although the subjects may have diverse needs, they were all united by the norms within the department which influenced their compliance behaviour. Consequently, the social interactions act as the 'force behind' the observed activities. Importantly, social influence and interaction has a significant impact on the intention to use information systems [7]; in this case the intention to compliantly use the QMS. Thus, the subjects exhibited confidence in their actions through similar activities of peers within the departments which likely influenced the compliance behaviour. Furthermore, as the subjects look up to their managers on a routine basis, their behaviour is shaped by them. The hierarchy influenced the behaviour of staff either negatively or positively. Also, because of the reliance of the subjects on other stakeholders in the 'process chain', the data showed that there was stakeholder influence on compliance behaviour. Here, the subject relied on the output of the processes from their stakeholders. As such the negative output from the stakeholders subsequently influence the subject's behaviour. This is consistent with [5] who stressed that the reliance on the initiator in the 'life cycle' of responsibility ultimately influences the compliance behaviour; positively or negatively. Again, this was extended to stakeholders not fully understanding their roles which influence the interactions between the subjects and the object. Moreover, the resources in place (time, material) was essential in the subject's behaviour in that they influenced their approach to the process. There was evidence in the data as subjects indicated that they may not have enough time and as such may not compliantly follow the QMS. Another factor is the KPI's in place which were also seen to compete with the requirements of the QMS. As the staff strive to meet some of the KPI's they indicated that it affected their compliant use of the QMS. There is indication that staff intention to comply, was critical in their actual compliance behaviour. Staff who indicated that they always intend to comply also indicated that they actually comply to the use of the QMS. This is because the increased intentions may yield increased effort which may increase likelihood of the subject undertaking the behaviour [14]. Importantly, the data collected based on the model demonstrated its utility in assessing compliance behaviour.
## 4.3 Suitability and Benefit of the Updated CAM

From the evaluation of the updated CAM, the following suitability and benefits were observed.

1. The model will be useful in assessing subject intention to use the tool as prescribed which will be useful in predicting the actual use

2. Because the model assesses the impact of the KPI against the tool, it will be useful in helping to set clear KPI's that supports compliance behaviour.

3. The model will be suitable in assessing acceptance and adoption of a new tool and aid subsequent 'in use' evaluation of the tool.

4. The model will be useful in assessing and understanding resources required for interaction between the subject and the object to achieve the outcome.

5. The model will be useful in understanding and defining roles of subjects. This will also help in reviewing the impact of the leadership team on subject behaviour.

6. The model will be suitable in assessing the reasons behind non-compliance behaviour. This will be useful in setting clear actions which will help safety critical organisations to meet regulatory requirements.

## 4.4 Limitations of the Updated CAM

Although the analysis has shown that actual behaviour and as such compliance behaviour can be assessed by use of the conceptual model, the findings cannot be generalised due to the interpretive nature of the research. It is recommended that further research be repeated in other organisations and situations, and an alternative research design (e.g., a quantitative study) be used to enable triangulation.

## 5 Conclusion

This research was set up to develop a Compliance Assessment Model that assesses reasons behind the non-compliance behaviour of agents. The model was developed by synthesis of TAM and Activity Theory. The data collection and evaluation indicated that, the factors from the updated model will be useful in predicting compliance behaviour. This model will be useful in assessing adoption of the compliance requirements and aid observation of the interaction between the subject and object to realise the outcome. Essentially, the use of the CAM model may aid in assessment of compliance behaviour which will be useful in formulating behaviour change support systems to aid compliance.

**Acknowledgement.** The authors would like to thank the Quality Assurance Department at the Blood Establishment for their cooperation and all the staff who took part in the interviews.
References

1. O'Neill, A.: An action framework for compliance and governance. Clinical Governance: An International Journal, 19(4), 342–359. http://doi.org/10.1108/CGIJ-07-2014-0022 (2014).

2. Hirschauer, N., Bavorova, M., Martino, G.: An analytical framework for a behavioural analysis of non-compliance in food supply chains. British Food Journal, 114(9), 1212–1227. http://doi.org/10.1108/00070701211258781 (2012).

3. Governatori, G.: ICT Support for Regulatory Compliance of Business Processes, 21–22. Retrieved from http://arxiv.org/abs/1403.6865 (2014).

4. Warkentin, M., Willison, R.: “Behavioral and policy issues in information systems security: the insider threat”, *European Journal of Information Systems*, Vol. 18 No. 2, pp. 101-105. (2009).

5. Dankwa K., Nakata K.: Making Sense of Non-compliance: A Semiotic Approach. In: Baranauskas M., Liu K., Sun L., Neris V., Bonacin R., Nakata K. (eds) Socially Aware Organisations and Technologies. Impact and Challenges. ICISO 2016. IFIP Advances in Information and Communication Technology, vol 477. Springer, Cham (2009).

6. Dillon, A., Morris, M. G., Davis, G. B., Davis, F. D.: User acceptance of new information technology: theories and models. In M. Williams (ed.) Annual Review of Information Science and Technology, Vol. 31, Medford NJ: Information Today, 3-32. (1996).

7. Venkatesh, V., Morris, M. G., Davis, G. B., Davis, F. D.: User acceptance of information technology: Toward a unified view. MIS quarterly, 425-478. (2003).

8. Kaptelinin, V.: Activity Theory. In: Soegaard, Mads and Dam, Rikke Friis (eds.). "The Encyclopedia of Human-Computer Interaction, 2nd Ed." Aarhus, Denmark: The Interaction Design Foundation [accessed on 18/04/15]. Available online at https://www.interaction-design.org/encyclopedia/activity_theory.html (2014).

9. Kuuti, K.: Activity Theory as a Potential Framework for Human-Computer Interaction Research. In B. Nardi (ed.): Context and Consciousness: Activity Theory and Human-Computer Interaction. Cambridge, MA: MIT press, Chapter 2, pp.17-44. (1996).

10. Abdullah, Z.: Activity Theory as Analytical Tool: A Case Study of Developing Student Teachers' Creativity in Design. *Procedia - Social and Behavioral Sciences*, 131(2010), pp.70-84. Available at:
http://www.sciencedirect.com/science/article/pii/S1877042814029929. (2014).

11. Engstrom, Y.: Learning by expanding: An activity-theoretical approach to developmental research (Helsinki, Orienta – Konsultit). (1987).

12. Kaptelinin, V., Nardi, B. A.: Acting with technology: Activity theory and interaction design. Cambridge, MA: MIT Press. (2006).

13. Jenkinson, D.: Compliance Culture. Journal of Financial Regulation and Compliance, 4(1), 41–46. http://doi.org/10.1108/eb024866 (1996).

14. Davis, F. D.: "Perceived usefulness, perceived ease of use, and user acceptance of information technology", MIS Quarterly 13(3): 319–340 (1989).

15. Park, J., Jung, W.: The operators' non-compliance behaviour to conduct emergency operating procedures - Comparing with the work experience and the complexity of procedural steps. Reliability Engineering and System Safety, 82(2), 115–131. http://doi.org/10.1016/S0951-8320(03)00123-6 (2003).

16. Hofstede, G.: Culture's Consequences: Comparing Values, Behaviours, Institutions, and organizations across nations (2nd edition). Thousand Oaks, California: Sage Publications, Inc (2001).
17. Sang, S.K., Yong, J. Kim.: "The effect of compliance knowledge and compliance support systems on information security compliance behavior", Journal of Knowledge Management, Vol. 21 Issue: 4, pp.986-1010, https://doi.org/10.1108/JKM08-2016-0353 (2017).