Learning, solved.

A complaint is raised six times across eleven months before it reaches the regulator. Every person who handled it followed the process correctly and closed it in good faith. The case notes were accurate but incomplete, each handover between teams lost a little more history, and a target for closing cases quickly rewarded exactly that. Teams compare the customer’s actual experience against the version the business recorded, and find the distance between the two.

What it teaches: what “resolved” actually means, how targets quietly shape behaviour, why handovers lose context, and how to hear a customer through a process.

Client data leaves the business, and not one step required anybody to act maliciously. A password had been shared across a team for two years because changing it was inconvenient. A credible looking email asked for a file and someone helpful sent it. A colleague noticed something odd, assumed they were imagining it, and said nothing for nine days. A contractor’s access was never revoked when their work finished. Teams map how each ordinary, defensible decision widened the gap.

What it teaches: password hygiene, how to recognise a phish, why unreported near misses are the real vulnerability, and how to make speaking up feel safe rather than embarrassing.

The risk that materialises is one the organisation had already identified. It was logged correctly and rated correctly, then downgraded at a review the person who understood it best could not attend. An escalation was drafted and never sent, because the author assumed it had been raised elsewhere. It reached a board agenda three times and was deferred twice for time. Teams reconstruct a chain of individually reasonable decisions and pinpoint where ownership quietly disappeared.

What it teaches: how escalation routes fail in practice, why ownership has to be explicit, how diluted accountability lets known risks through, and what separates a control from a comfort.

A customer asks for everything the organisation holds about them, and the month starts running. The request lands in a shared inbox and sits for twelve days while people work out whose job it is. When the search begins, their personal data surfaces in places no policy anticipated: a marketing list they never knowingly joined, call recordings kept long past their retention date, a spreadsheet built for a campaign two years ago, and an account note where a colleague described them in terms nobody expected to be read back. Teams decide what must be disclosed, what can properly be withheld, and confront what the response says about how the organisation talks about the people it serves.

What it teaches: what actually counts as personal data, where it quietly accumulates, why retention and consent matter, that informal notes are disclosable too, and the discipline of writing everything as though the customer will read it.

A supplier relationship has become a problem, and no single decision inside it looks wrong. A modest gift was accepted and properly logged. A procurement exception was approved for a genuine deadline. A former colleague joined the supplier and nobody thought it worth mentioning. A contract was renewed without competition because switching looked expensive. Teams put the decisions back in order and identify the point at which the organisation lost the ability to say it acted at arm’s length.

What it teaches: conflicts of interest, incremental drift, why a run of defensible decisions can end somewhere indefensible, and when something needs declaring.

The most useful case is usually the one nobody has written yet. Tell us the outcome you are worried about, or the one you keep having to explain, and we build the investigation around it. You set the learning points, the knowledge people need to hold, and the values you want their decisions tested against. We supply the story, the evidence and the reveal, in your language, with your roles and your systems in it.

What it teaches: exactly what you need it to. Learning points get written into the story rather than bolted on at the end, which is why they survive the session.