---
# === IDENTITY ===
id: consulting/recipes/oia-autoimmune-scan-execution/2026
canonical_question: "How do you run an organizational autoimmune scan for compliance bypass detection?"
aliases:
  - "Organizational autoimmune scan execution guide"
  - "How to detect compliance bypass and shadow workarounds"
  - "Security fatigue and friction point mapping process"
entity_type: execution_recipe
domain: consulting > recipes > OIA Autoimmune Scan Execution
region: global
jurisdiction: global
temporal_scope: 2026-2027

# === VERIFICATION ===
last_verified: 2026-03-29
confidence: 0.85
version: 1.0
first_published: 2026-03-29

# === TEMPORAL VALIDITY ===
temporal_validity:
  status: evolving
  last_breaking_change: "Initial release — autoimmune scan protocols v1.0"
  next_review: 2026-09-25
  change_sensitivity: high

# === CONSTRAINTS ===
constraints:
  - "Interviews must be voluntary and anonymous — coerced participation produces false data"
  - "Survey response rate must exceed 60% for statistical validity"
  - "Friction classification requires consensus from at least 2 analysts"
  - "Critical severity patterns must be reported to executive sponsor within 24 hours"
  - "Shadow IT identification must not result in punitive action against employees — communicate this upfront"

# === SKIP CONDITIONS ===
skip_this_unit_if:
  - condition: "User needs network analysis, not compliance scanning"
    use_instead: "consulting/recipes/oia-network-analysis-execution/2026"
  - condition: "User needs full OIA engagement plan"
    use_instead: "consulting/recipes/oia-engagement-playbook/2026"
  - condition: "User needs stress testing, not autoimmune detection"
    use_instead: "consulting/recipes/oia-stress-test-execution/2026"

# === AGENT HINTS ===
inputs_needed:
  - key: access_level
    question: "What IT/security log access is available?"
    type: choice
    options: ["full SIEM access", "IT admin logs only", "no log access — survey only", "unknown"]
  - key: org_culture
    question: "How would you describe the organization's culture around compliance?"
    type: choice
    options: ["strict/regulated (finance, healthcare)", "moderate (tech, professional services)", "informal (startup, creative)", "unknown"]
  - key: interview_budget
    question: "How many interviews can be conducted?"
    type: choice
    options: ["5-10 interviews", "10-15 interviews", "15-25 interviews", "survey only — no interviews"]
  - key: sensitivity
    question: "How sensitive is this topic within the organization?"
    type: choice
    options: ["low — leadership supports transparency", "moderate — some defensiveness expected", "high — political landmines possible", "unknown"]

# === EXECUTION METADATA ===
execution:
  required_inputs:
    - name: "Network analysis findings"
      source: "consulting/recipes/oia-network-analysis-execution/2026"
      format: "PDF + CSV"
    - name: "IT/security log access"
      source: "client/IT-security"
      format: "SIEM queries or log exports"
    - name: "Employee survey distribution list"
      source: "client/HR"
      format: "email list"

  outputs:
    - name: "Autoimmune pattern inventory"
      format: "spreadsheet + PDF"
      description: "Classified compliance bypass patterns with severity scores and remediation priority"
    - name: "Friction point map"
      format: "PDF"
      description: "Visual map of protective vs paralyzing friction across departments"
    - name: "Security fatigue scorecard"
      format: "PDF + JSON"
      description: "Department-level security fatigue metrics"

  tools_required:
    - name: "SIEM platform"
      purpose: "Query IT/security logs for compliance bypass patterns"
      tier: "enterprise"
      cost: "$0 (client's existing SIEM)"
      alternatives: ["IT admin log exports", "manual audit"]
    - name: "Survey tool"
      purpose: "Anonymous friction diary and security fatigue assessment"
      tier: "free"
      cost: "$0 (Google Forms) to $100 (Typeform)"
      alternatives: ["SurveyMonkey", "Microsoft Forms"]
    - name: "Video conferencing"
      purpose: "Structured interviews with employees"
      tier: "free"
      cost: "$0"
      alternatives: ["in-person interviews"]

  credentials_needed:
    - service: "SIEM/IT logs"
      type: "Read-only access"
      where_to_get: "Client IT security team"
      free_tier_limits: "N/A — client provides access"

  estimated_duration: "3-5 days"
  estimated_cost: "$0-$500 (survey tools)"

# === DISTRIBUTION ===
canonical_source: "https://knowledgelib.io/consulting/recipes/oia-autoimmune-scan-execution/2026"
suggested_citation: "Source: knowledgelib.io — AI Knowledge Library (verified 2026-03-29)"

# === RELATED UNITS ===
related_kos:
  depends_on:
    - id: "consulting/recipes/oia-network-analysis-execution/2026"
      label: "Network analysis findings used to target interviews"
  feeds_into:
    - id: "consulting/recipes/oia-stress-test-execution/2026"
      label: "Stress test design informed by autoimmune findings"
  related_to:
    - id: "consulting/oia/autoimmune-pattern-library/2026"
      label: "Library of known organizational autoimmune patterns"

# === SOURCES ===
sources:
  - id: src1
    title: "Security Fatigue"
    author: Stanton, B. et al.
    url: https://www.nist.gov/publications/security-fatigue
    type: primary_research
    published: 2016-01-01
    reliability: authoritative
  - id: src2
    title: "The $3 Trillion Prize for Busting Bureaucracy"
    author: Hamel, G. & Zanini, M.
    url: https://hbr.org/2016/10/the-3-trillion-prize-for-busting-bureaucracy
    type: industry_report
    published: 2016-10-01
    reliability: high
  - id: src3
    title: "Human error: models and management"
    author: Reason, J.
    url: https://www.bmj.com/content/320/7237/768
    type: academic_paper
    published: 2000-03-18
    reliability: authoritative
  - id: src4
    title: "Incivility in the workplace"
    author: Cortina, L.M. et al.
    url: https://psycnet.apa.org/doi/10.1037/1076-8998.6.1.64
    type: academic_paper
    published: 2001-01-01
    reliability: high
---

# OIA Autoimmune Scan Execution

## Purpose

This recipe executes an organizational autoimmune scan — systematically detecting where the organization's own compliance, approval, and control systems are being routinely bypassed by employees. It produces a classified inventory of autoimmune patterns (compliance bypasses, shadow workarounds, security fatigue indicators) with severity scores and a friction point map distinguishing protective friction from paralyzing friction. [src1, src2]

## Prerequisites
<!-- Agents: verify ALL prerequisites before executing. Missing prerequisites = failed execution. -->

- [ ] **Network analysis findings** from [OIA Network Analysis](/consulting/recipes/oia-network-analysis-execution/2026) — used to target interview selection
- [ ] **IT/security log access** — SIEM read-only access or IT admin log exports
- [ ] **Employee survey distribution list** — from HR, covering all in-scope departments
- [ ] **Executive communication** — sponsor has communicated that findings will not result in punitive action
- [ ] **Survey tool** — Google Forms, Typeform, or equivalent configured and tested

## Constraints
<!-- Hard rules. Agents: enforce throughout execution. -->

- Interviews and surveys must be voluntary and anonymous. Coerced participation produces unreliable data and erodes trust. [src4]
- Survey response rate must exceed 60% for statistical validity. Below 60%, extend window and add interviews.
- Friction classification (protective vs paralyzing) requires consensus from at least 2 analysts to reduce bias. [src3]
- Critical severity patterns (legal/financial exposure) must be reported to executive sponsor within 24 hours of discovery.
- Shadow IT findings must never be used for punitive action — communicate this clearly and repeatedly. [src2]

## Tool Selection Decision

```
Which approach?
├── Full SIEM access + interviews available
│   └── PATH A: Log Analysis + Interviews + Survey — comprehensive
├── IT admin logs + survey only
│   └── PATH B: Log Review + Survey — solid without interviews
├── Survey + interviews only (no log access)
│   └── PATH C: Qualitative Only — adequate for culture assessment
└── Survey only (minimal access)
    └── PATH D: Survey-Only — baseline detection
```

| Path | Tools | Cost | Speed | Output Quality |
|------|-------|------|-------|---------------|
| A: Full | SIEM + interviews + survey | $0-$200 | 4-5 days | Excellent — quantitative + qualitative |
| B: Logs + Survey | IT logs + survey tool | $0-$100 | 3-4 days | Good — quantitative focus |
| C: Qualitative | Interviews + survey | $0-$200 | 3-4 days | Good — rich context, limited coverage |
| D: Survey-Only | Survey tool | $0-$100 | 2-3 days | Adequate — surface-level detection |

## Execution Flow

### Step 1: Compliance Bypass Detection

**Duration**: 4-8 hours
**Tool**: SIEM queries, IT admin logs

Query IT and security logs for patterns indicating systematic compliance bypass. Target indicators:
- Split transactions (amounts just below approval thresholds)
- After-hours system access (work outside normal hours to avoid oversight)
- Shadow IT: unapproved SaaS tools, personal email forwarding, unauthorized file sharing
- Approval chain shortcuts: skipped approval steps, self-approvals, backdated approvals
- Exception request volume: departments with disproportionate exception rates

```
# SIEM query examples (adapt to client's SIEM platform)

# Split transactions — amounts clustering just below threshold
SELECT department, COUNT(*) as split_count
FROM transactions
WHERE amount BETWEEN (approval_threshold * 0.85) AND (approval_threshold * 0.99)
GROUP BY department
HAVING COUNT(*) > 5
ORDER BY split_count DESC;

# Shadow IT — DNS queries to unapproved SaaS domains
SELECT domain, COUNT(DISTINCT user_id) as user_count
FROM dns_logs
WHERE domain NOT IN (approved_saas_list)
  AND domain LIKE '%.com'
  AND timestamp > NOW() - INTERVAL '90 days'
GROUP BY domain
HAVING COUNT(DISTINCT user_id) > 3
ORDER BY user_count DESC;

# After-hours access patterns
SELECT user_id, COUNT(*) as after_hours_count
FROM access_logs
WHERE EXTRACT(HOUR FROM timestamp) NOT BETWEEN 8 AND 18
  AND EXTRACT(DOW FROM timestamp) BETWEEN 1 AND 5
GROUP BY user_id
HAVING COUNT(*) > 20
ORDER BY after_hours_count DESC;
```

**Verify**: Pattern frequency quantified per department. At least 3 bypass categories analyzed.
**If failed**: If SIEM access unavailable, skip to Step 2 (interviews will surface the same patterns qualitatively).

### Step 2: Shadow Workaround Inventory

**Duration**: 1-2 days
**Tool**: 30-minute structured interviews (10-15 employees)

Interview 10-15 employees stratified by department and level (2-3 per department, mix of individual contributors and managers). Use structured friction diary format. [src2]

Interview questions (30 minutes each):
1. "What work task takes more effort than it should? Walk me through the steps."
2. "Are there any rules or processes you routinely work around? What triggers the workaround?"
3. "If you could remove one approval or process, which would it be and why?"
4. "What tools do you use that IT didn't set up for you?"
5. "When was the last time a process blocked you from getting urgent work done? What happened?"

```
# Interview coding template
| Interviewee (anon) | Workaround Description | Trigger | Frequency | Impact | Department |
|---------------------|----------------------|---------|-----------|--------|------------|
| P01 | Splits POs under $5K | Approval chain takes 2 weeks | Weekly | Medium | Engineering |
| P02 | Uses personal Dropbox | Company SharePoint too slow | Daily | High | Marketing |
```

**Verify**: > 80% of scheduled interviews completed. Each department represented.
**If failed**: If interview participation is low, supplement with anonymous online survey (same questions, written responses).

### Step 3: Security Fatigue Assessment

**Duration**: 4-8 hours
**Tool**: IT security dashboard + anonymous survey

Measure security fatigue indicators — the point where employees stop engaging meaningfully with security controls. [src1]

Metrics to measure:
- MFA prompt frequency (prompts/day per user)
- Approval backlog (average days from request to approval)
- Exception request volume (requests/month per department)
- Policy document read rates (% who open compliance training materials)
- Password reset frequency (indicator of complexity fatigue)

```
# Security Fatigue Survey (anonymous, 5 minutes)
# Scale: 1 (never) to 5 (always)

1. "I click through security prompts without reading them" — [1-5]
2. "I feel overwhelmed by the number of passwords/logins I manage" — [1-5]
3. "I have found faster ways to get my work done that skip some security steps" — [1-5]
4. "I think some security requirements are unnecessary for my role" — [1-5]
5. "I would report a security concern if I noticed one" — [1-5, reverse-scored]
6. "Approval processes slow my work by [hours per week]" — [0, 1-2, 3-5, 5-10, 10+]
7. "Department:" — [dropdown]
```

**Verify**: Fatigue score calculated per department. > 60% survey response rate achieved.
**If failed**: If response rate < 60%, extend survey window by 3 days and have executive sponsor send personal reminder.

### Step 4: Friction Point Mapping

**Duration**: 4-8 hours
**Tool**: Classification matrix (spreadsheet)

For each identified workaround from Steps 1-3, classify as protective friction (necessary control serving a legitimate purpose) or paralyzing friction (control serving hierarchy/tradition without functional value). [src2, src3]

Classification criteria:
- **Protective friction**: Prevents financial loss, legal liability, safety risk, or data breach. Examples: code review, financial audit, safety inspection.
- **Paralyzing friction**: Serves organizational hierarchy, historical precedent, or control preference without measurable risk mitigation. Examples: manager approval for office supplies under $50, mandatory CC on all emails to VP.

```
# Friction Classification Matrix
| ID | Workaround | Friction Type | Risk if Removed | Bypass Frequency | Classification |
|----|-----------|---------------|-----------------|------------------|----------------|
| F01 | Split POs under $5K | Financial approval | Low (< $5K exposure) | Weekly | Paralyzing |
| F02 | Skip code review for hotfix | Code quality gate | High (production risk) | Monthly | Protective |
| F03 | Personal Dropbox for files | Data security | Medium (data leakage) | Daily | Protective (but needs better tooling) |
```

**Verify**: Each friction point classified with consensus from at least 2 analysts. Classification rationale documented.
**If failed**: If analysts disagree on classification, escalate to client stakeholder for context. Some friction is ambiguous by design.

### Step 5: Severity Scoring & Report

**Duration**: 4-8 hours
**Tool**: Scoring rubric + report template

Score each autoimmune pattern on a 4-level severity scale. Produce prioritized pattern inventory with remediation recommendations. [src3]

Severity levels:
- **Low**: Inconvenience — productivity annoyance, no compliance or financial risk
- **Medium**: Productivity loss — measurable time waste, team friction, but no external exposure
- **High**: Compliance risk — potential audit finding, regulatory exposure, customer data risk
- **Critical**: Legal/financial exposure — active violation, potential litigation, significant financial loss

```
# Severity Scoring Template
| ID | Pattern | Severity | Department | Est. Annual Cost | Remediation Priority |
|----|---------|----------|------------|------------------|---------------------|
| A01 | Split PO bypass | Medium | Engineering | $50K lost oversight | P2 — raise threshold |
| A02 | Shadow Dropbox | High | Marketing | $0 direct, high risk | P1 — deploy approved alternative |
| A03 | MFA click-through | High | All | Security exposure | P1 — reduce prompt frequency |
| A04 | Approval backlog | Medium | Finance | $200K delayed projects | P2 — SLA for approvals |
```

**Output files**:
- `autoimmune_pattern_inventory.xlsx` — Complete classified pattern list with severity and remediation
- `friction_point_map.pdf` — Visual map of protective vs paralyzing friction by department
- `security_fatigue_scorecard.pdf` — Department-level fatigue metrics with benchmarks

**Verify**: Top 10 patterns prioritized. All critical-severity patterns flagged to executive sponsor.
**If failed**: If pattern count < 5, broaden interview scope or extend survey to additional departments.

## Output Schema

```json
{
  "output_type": "autoimmune_scan_report",
  "format": "XLSX + PDF + JSON",
  "files": [
    {"name": "autoimmune_pattern_inventory.xlsx", "description": "Classified bypass patterns with severity scores"},
    {"name": "friction_point_map.pdf", "description": "Protective vs paralyzing friction visualization"},
    {"name": "security_fatigue_scorecard.pdf", "description": "Department-level security fatigue metrics"}
  ],
  "key_metrics": [
    {"name": "total_patterns", "type": "number", "description": "Total autoimmune patterns identified"},
    {"name": "critical_count", "type": "number", "description": "Patterns with critical severity"},
    {"name": "paralyzing_friction_pct", "type": "number", "description": "% of friction classified as paralyzing"},
    {"name": "avg_fatigue_score", "type": "number", "description": "Organization-wide security fatigue average (1-5)"}
  ]
}
```

## Quality Benchmarks

| Quality Metric | Minimum Acceptable | Good | Excellent |
|---------------|-------------------|------|-----------|
| Patterns identified | > 5 | > 10 | > 15 |
| Survey response rate | > 60% | > 75% | > 90% |
| Interview completion rate | > 70% of scheduled | > 85% | > 95% |
| Department coverage | > 50% of departments | > 75% | > 90% |
| Analyst classification agreement | > 70% agreement | > 85% | > 95% |

**If below minimum**: Extend survey window, add interview slots, or broaden SIEM query scope.

## Error Handling

| Error | Likely Cause | Recovery Action |
|-------|-------------|----------------|
| Low survey response (< 60%) | Survey fatigue or lack of trust | Executive sponsor sends personal message, extend deadline, add incentive |
| Interview cancellations | Employee discomfort or scheduling conflicts | Offer written response option, reschedule with manager encouragement |
| SIEM access denied | IT security policy or scope not approved | Escalate to executive sponsor, proceed with qualitative methods only |
| No patterns found | Questions too gentle or culture of silence | Reframe questions around "efficiency improvements" not "rule breaking" |
| Critical pattern discovered mid-scan | Active compliance violation | Report to executive sponsor within 24 hours, document but continue scan |

## Cost Breakdown

| Component | Free Tier | Paid Tier | At Scale |
|-----------|-----------|-----------|----------|
| Survey tool | $0 (Google Forms) | $50 (Typeform) | $200 (SurveyMonkey) |
| Interview time | $0 (consultant time) | $0 | $0 |
| SIEM access | $0 (client existing) | $0 | $0 |
| Analysis tools | $0 (spreadsheet) | $0 | $0 |
| **Total** | **$0** | **$0-$50** | **$0-$500** |

## Anti-Patterns

### Wrong: Treating workarounds as misconduct
Approaching the autoimmune scan as a compliance audit that will punish violators. Result: employees refuse to participate or give sanitized answers, making the scan useless. [src4]

### Correct: Frame as efficiency improvement
Communicate clearly that findings will be used to fix broken processes, not punish people. Shadow workarounds are symptoms of organizational friction, not employee failure. [src2]

### Wrong: Classifying all bypasses as problems
Labeling every compliance bypass as a deficiency. Result: recommending more controls when the organization already has too many, worsening the autoimmune response. [src3]

### Correct: Distinguish protective from paralyzing friction
Some friction is necessary (code review, financial controls). The goal is to remove paralyzing friction while strengthening protective friction. [src2]

### Wrong: Running survey without executive air cover
Sending the survey without executive sponsor communication first. Result: employees assume it is a trap, response rates collapse below useful thresholds. [src1]

### Correct: Executive sponsor sends first communication
Before any survey or interview, have the executive sponsor send a personal message explaining the purpose, anonymity guarantees, and non-punitive intent.

## When This Matters

Use when an agent needs to detect and classify organizational autoimmune patterns — compliance bypasses, shadow workarounds, and security fatigue. This is Step 4 of the OIA engagement lifecycle. Requires network analysis findings to target interview selection. Output feeds into stress test design and the overall OIA health score report.

## Related Units

- [OIA Network Analysis Execution](/consulting/recipes/oia-network-analysis-execution/2026)
- [OIA Stress Test Execution](/consulting/recipes/oia-stress-test-execution/2026)
- [OIA Engagement Playbook](/consulting/recipes/oia-engagement-playbook/2026)
- [Autoimmune Pattern Library](/consulting/oia/autoimmune-pattern-library/2026)