We see the same pattern in almost every sector we work in. A firm recognises that vulnerability matters. Budget is allocated. A project is launched. Training is delivered to frontline teams. A policy is written and signed off. A vulnerability lead is appointed. Measures are reported to the board.
On paper, it looks like progress. In practice, very little has changed for the vulnerable customers the firm set out to protect.
This is not a criticism. The intent behind these actions is almost always genuine. But intent is not the same as impact. And the real measure of a Vulnerable Customer Strategy is whether it has improved customer outcomes, not whether it exists.
The gap between intent and impact
When we carry out Vulnerability Reviews, we often find that firms have done a lot of the right things in isolation. The training was good. The policy is well written. The identification process captures the right flags. But none of these things are connected to what actually happens in vulnerable customer journeys.
A colleague identifies a customer as vulnerable, records it on the system, and then delivers the same journey they would have delivered anyway. The flag exists, but it does not trigger a different route, a different conversation, a different outcome. The vulnerable customer does not notice.
This is the gap we see most often. Not a gap in awareness or in commitment. A gap in embedding. The strategy exists, but it has not been woven into the processes, tools and decisions that shape the vulnerable customer experience day to day.
Why standalone improvements are not enough
Training, policies and identification frameworks are all necessary. But on their own, they are standalone improvements. They sit alongside the business rather than inside it. They depend on individual effort rather than systemic design.
We regularly meet firms that have delivered vulnerability training to hundreds or even thousands of colleagues. The training was well received. Feedback scores were high. But six months later, the colleagues who attended cannot point to a single process that changed as a result. They feel more aware, but not more equipped.
That is because awareness without operational change creates frustration, not capability. Colleagues know what to look for but do not have the tools, processes or support options to respond differently when they find it. The organisation has invested in recognition without investing in response.
In a regulatory environment shaped by Consumer Duty and sector-specific vulnerability obligations, this gap carries real risk. Firms are expected to prevent foreseeable harm across their vulnerable customer journeys. A Vulnerable Customer Strategy that has not been embedded into those journeys does not meet that expectation, however well-intentioned it may be. Reducing vulnerability risk requires more than good intentions.
What embedding actually looks like
Embedding means the way you serve vulnerable customers is designed into your processes, not bolted on afterwards. It means a vulnerability flag leads somewhere. A disclosure triggers a different journey. A colleague who identifies a need has a clear, supported route to meet it.
This requires more than training and more than policy. It starts with vulnerable customer journey mapping: understanding what vulnerable customers actually experience when they interact with your organisation. Not what you think they experience. Not what your quality framework measures. What they tell you, what your colleagues see, and what the data reveals.
We call these our three sources of truth: vulnerable customers, the colleagues who serve them, and the data. All three matter. Miss one and you are designing with a blind spot.
When firms involve vulnerable customers in co-discovery and co-design, the gaps become obvious. And once the gaps are visible, the solutions are often simpler than anyone expected. This is what vulnerability-led service design looks like in practice: starting from the customer, not from the policy.
The test that matters
There is a straightforward way to know whether your Vulnerable Customer Strategy is working. Ask yourself this: if a vulnerable customer contacted your organisation today, would their experience be tangibly different because of the work you have done?
Not different because a colleague chose to go the extra mile. Different because the process was designed for them. Different because the journey anticipated their needs. Different because someone tested it with people who live this reality every day.
If the answer is no, you do not necessarily need to start again. You may have strong foundations. Good practice may already exist in parts of the business. We see this often and we always highlight it. But you probably need to shift your focus from what you have delivered to what you have embedded.
Where firms go from here
The firms that make the biggest difference for vulnerable customers are rarely the ones with the largest budgets. They are the ones that have defined what good looks like, and then focused on embedding change into vulnerable customer journeys rather than running parallel projects alongside them.
They use Inclusive Design to understand what vulnerable customers actually need, co-design solutions with the people affected, test those solutions before they scale, and build colleague capability that lasts beyond a single training session.
They measure customer outcomes that matter: not how many people were trained, but whether vulnerable customers are getting better results. Not whether a policy exists, but whether it has changed the way decisions are made.
And they recognise that this work benefits all customers, not only those in vulnerable circumstances. When you design for the people who find your service hardest to use, you make it better for everyone.
Let’s talk
If this feels familiar, you are not alone. Most firms we work with started exactly here. A Vulnerability Review is a manageable first step. It gives you an honest, independent view of where you are, where the gaps sit, and what to prioritise next.