The challenge: a program that depended too heavily on one person

Principality Building Society had a problem. Their human risk management program relied on specialist manual effort to keep running. And a key stakeholder was transitioning out.

The biggest drain? Chasing people who hadn't completed their security learning each month. Internally, it was the "second most administrative task" after provisioning new starters. It ate time, it didn't scale, and it created a single point of failure.

Something had to change.

‍

What they needed

Principality set four clear goals:

• Keep the program running with zero loss of momentum, regardless of personnel changes.
• Automate the monthly compliance chasing that was consuming specialist time.
• Maintain (or improve) their already-high completion rates.
• Create a cleaner journey from new starter onboarding through to business-as-usual.

The solution: two automated workflows, powered by RESPOND

‍

CybSafe's workflow engine, anchored by RESPOND, gave Principality a self-running structure built around two pillars: new starter onboarding and BAU compliance.

1. New starter automation

New hires are added to a New Starters group the moment they join CybSafe. From there, the workflow handles everything:

• They're assigned a welcome pack of foundational learning modules straight away.
• Timed checks at 30, 60, and 90 days verify they've completed everything.
• Hit the mark? They graduate into the BAU group automatically.
• Miss it? The workflow notifies and escalates to their line manager. No manual chasing needed.

‍

2. BAU compliance — silent, persistent, effective

Once someone graduates, the BAU workflow takes over. A recurring monthly cycle runs in the background, flagging anyone with outstanding learning and sending a single, targeted reminder.

Two smart design choices stand out. Reminders use generic, evergreen wording — so they work across rolling monthly assignments without needing updates. And they don't include deep links. Instead, they point people to a known, trusted corporate access point. That's a deliberate security-first decision to stop the reminders looking like phishing.

‍

The results

The impact was immediate:

• Zero reliance on manual effort. The program runs itself. Monthly compliance chasing is now a background function, not a resource drain.
• Specialist time freed up. The people who used to chase completions now focus on higher-value work.
• Positive feedback from people across the organisation. They appreciate the "every other month" check cadence and the "short, sharp" style of the reminders.
• Cleaner data from day one. Separating new starters from BAU means metrics are accurate and meaningful.

The bigger picture

Principality didn't just fix an admin problem. They built a program that runs independently, survives personnel changes, and delivers a consistent, professional experience across the organisation.

The manual burden is gone. Completion rates hold steady. And the program feels more credible and professional to the people it reaches.

That's what good automation looks like.

‍