70,000+
Retail workers onboarded
Integrated into mandatory testing workflows across Singapore’s retail ecosystem.
Designing for Compliance at National Scale:
Building Singapore's Retail Mall Business Resilience During COVID-19
The Brief
In 2021, Enterprise Singapore — a statutory board under Singapore's Ministry of Trade and Industry — needed someone to operationalise the government's COVID-19 Safe Management Measures (SMMs) across the country's retail sector. That someone was me: an Assistant Development Partner, and the sole person accountable for 220 shopping malls and large standalone stores outside of Orchard Road.
The brief, such as it was, was not handed down fully formed. The scope evolved rapidly alongside the COVID-19 policy itself, and much of what I ended up doing I defined myself as the situation demanded.
In broad terms, my mandate covered five daunting, interlocking responsibilities:
1) Translate national policy directives into operational playbooks that mall managers and retail businesses could actually act on
2) Drive adoption of Vaccination-Differentiated Safe Management Measures (VDS) across 220 properties
3) Design and manage the end-to-end ART test kit distribution and testing compliance pipeline. It started as "Vaccinate or Regular Test” regime (VoRT) for just 5,000 retail workers who are unvaccinated. However, it would eventually expand exponentially to the "Fast And Easy Test Rostered Routine Testing" regime (FETRRT) that covered 70,000+ retail workers islandwide
4) Design and draft all sector-facing communications — briefing decks, checklists, bilingual posters, FAQ libraries, patch updates
5) Monitor compliance and coordinate on-ground response, including the deployment of Safe Distancing Ambassadors¹ to manage incidents and enforce safe management rules
Multi-lingual Posters designed to
communicate COVID-19 SMMs to the Public
Who is in the (COVID-19) Room?
The Policy Landscape
When I inherited the portfolio, the operational baseline was VoRT — Vaccinate or Regular Test. Under VoRT, only unvaccinated retail workers were required to test, twice weekly. The applicable universe was a small, identifiable subset of the workforce. The kit distribution pipeline and SRS onboarding infrastructure had been partially established by my predecessor. My starting point was to stabilise what existed.
That stability didn't last long. Between mid-2021 and end-2022, the government issued multiple waves of directives, each one requiring immediate operationalisation across 220 properties, often within days of announcement. VDS launched. VoRT was updated. Recovery windows were revised. Upload deadlines tightened. Supervisor requirements changed. Every change required a patch communication to every mall manager in my portfolio and even other government agencies, often within 24 hours.
The Day Everything Changed
On 27 September 2021, the retail sector transitioned from targeted testing of unvaccinated workers to universal mandatory testing under FETRRT — Fast and Easy Test Rostered Routine Testing. Every individual working in a mall, large standalone store, or supermarket outlet was now required to test once every seven days, regardless of vaccination status.
I was just over a year into my first job after graduating from university. The system I inherited was minimal and not built for this scale. Within weeks, my compliance universe expanded from a few thousand workers to over 50,000, and eventually to more than 70,000 at peak, across 220 properties. I had roughly two weeks to take full ownership and scale every operational pipeline: ART kit distribution, SRS onboarding, ESSS protocols, compliance tracking. All of it, simultaneously, in real time.
I was doing this without an institutional handover. My predecessor had left prior to the rollout. Much of the operational and stakeholder context had to be rebuilt from scratch, while coordinating across multiple government agencies and private sector operators, none of whom were waiting for me to catch up.
Every moving part was under pressure. Headcounts shifted constantly as tenants turned over. Businesses that hadn't onboarded during VoRT were now scrambling to comply. ART kit supply chains strained under sudden demand spikes. The system held not because it was stable, but because it was actively managed and rebuilt for the scale it now needed to carry.
I was doing this without an institutional handover. My predecessor had left prior to the rollout. Much of the operational and stakeholder context had to be rebuilt from scratch, while coordinating across multiple government agencies and private sector operators, none of whom were waiting for me to catch up. Every moving part was under pressure. Headcounts shifted constantly as tenants turned over. Businesses that hadn't onboarded during VoRT were now scrambling to comply. ART kit supply chains strained under sudden demand spikes. The system held not because it was stable, but because it was actively managed and rebuilt for the scale it now needed to carry.
The Actual Advisory: Announcing the FETRRT regime and
providing cursory guidance to Retail stakeholders.
Who Was I Designing For?
To build a system that worked, I first had to understand who was inside it. The government directives were written for regulators, not for the people who had to carry them out.
FETRRT didn't land equally on everyone. It landed on four groups, each with different needs, different constraints, and different ways of failing.
The System that I built
The work divided into three interlocking layers, each one dependent on the others. If Layer 1 failed, nobody understood the policy. If Layer 2 failed, nobody had ART kits to test with or a way to log results. If Layer 3 failed, the compliance data was meaningless and the system had no teeth.
Operations system — retail COVID-19 compliance
Three interlocking layers — each dependent on the others
Layer 1 — Policy translationBriefing sessions
Facilitated structured briefing sessions for mall managers every time a major policy dropped — VDS, VoRT, FETRRT. Slide decks were designed as operational decision trees, bilingual, built around real edge cases so managers could use them as working references long after the briefing ended.
257
malls directly managed
70,000+
retail workers onboarded
90%+
VDS compliance rate
80%+
weekly ART testing compliance
When the System was Stress-tested
The Hillion Mall Incident
On 31 December 2021, New Year's Eve, I was alerted to a viral TikTok video that had amassed 228,000 views. A 19-year-old had invited people to gather outside Hillion Mall the following day for a mass dance.
Under prevailing safe management measures, social gatherings were capped at five persons. I tracked down the organiser's contact, drafted and sent an advisory email that evening, and coordinated Safe Distancing Ambassadors on the ground for the following morning. The organiser posted a follow-up video calling the event off. No crowd gathered. The story was reported by Mothership.sg the next day. Done solo, on a public holiday.
The Quiet(er) Crisis
The existing model was working. ART kits its ordered at mall level, distributed by mall managers to tenants, tracked through the system I had built and HPB’s SRS. Operationally sound.
What I hadn’t fully accounted for was what it was actually running on: the goodwill of mall managers of 220 malls in Singapore who had been absorbing a government compliance mandate of varying demands on top of their own jobs, for two years, in the most stressful operating environment Singapore’s retail sector had seen.
Goodwill is a depletable resource. By December 2021, the social infrastructure quietly underpinning my compliance model was showing strain. The major commercial landlords had been cooperative throughout, but cooperative has limits. Asking them to run another distribution round under the same model would cost relational capital I couldn’t keep spending.
The better model was UEN-level ordering, i.e., delivering directly to individual retail businesses and they can distribute to outlets on their own. This would have removed the mall intermediary entirely. The real reason to switch now wasn’t that the old model was broken. It was that it had been subsidised by a goodwill reserve that was running low, and I needed to reduce the ask before it hit zero.
The catch: UEN numbers are shared across sectors and government agencies. Any change to ESG’s workflow needed STB and HDB to align simultaneously. Three agencies, one agreed position, by 20 December. I identified the two blockers: (1) no direct retailer contact details, and (2) cross-agency sign-off required, called HPB to confirm feasibility, scrubbed the data, drafted the approval email, and cc’d the relevant parties. The workflow was redesigned in an afternoon.
On Non-Compliance
Not every incident made the news. When malls persistently failed to onboard tenants despite repeated reminders, I escalated to formal reprimands and enforced compliance. It worked.
In one case, a mall manager attempted to push back by citing his employment contract to avoid disseminating FETRRT requirements and ART kits. He repeatedly contacted the public-facing team, over 20 calls in a day, accompanied by abusive emails. The issue was initially brought to our frontline staff managing the hotline, but I stepped in to take over the case, shut down the behaviour, and formally overruled the position with a stern reprimand. Compliance followed.
Different mall managers required different strategies. The role was as much about managing people as it was about managing systems — knowing when to guide, when to absorb pressure, and when to step in decisively.
Outcomes
Over two years, the programme delivered at scale.
90%+
Malls implementing VDS
Shopping malls executed Vaccination-Differentiated Safe Management Measures at scale.
80%+
Weekly ART compliance
Sustained recurring testing adherence across the retail workforce.
Reflections
This project taught me three things I haven't been able to unlearn. The first is about trust architecture. I was not designing for a single user journey: I was designing for a system of journeys that all have to work simultaneously, under conditions of constant change, for people who didn't ask to be part of your system in the first place.
A perfect policy at launch is not possible and not the goal. What matters is whether you've built enough trust with your users that they'll absorb a tenth revision without disengaging. Every patch I issued was a withdrawal from a trust account I had to keep topped up. I topped it up by making every artefact genuinely useful, every briefing honest about what we didn't know yet, and every update as frictionless as possible to act on.
The second is harder: I was designing compliance infrastructure for policy that many people experienced as a restriction on their freedom and their livelihood. The goal was never to make people happy with the policy. It was to make the path of least resistance run through compliance rather than around it, to design the friction out of doing the right thing, so that doing the wrong thing took more effort.
The third was about distributed capacity. At peak, 5,000 enquiries a day were coming in. I was one person. The solution was not to work harder: it was to build a system that distributed the load. I wrote a comprehensive FAQ, briefed colleagues across Enterprise Singapore, and effectively created a first-line response function from people who already existed around me. I didn't have a team. I built one from the people around me, using tools that made their participation possible.
I learnt these lessons at a very formative stage of my career, while I was still figuring out what good work looked like. They have stayed with me ever since, shaping how I approach ambiguity, earn trust, and build systems that allow people to move together.
Chang-Ming
KO
Regional business developer by day,
Multi-disciplinary designer 24/7
Chang-Ming
KO
Chang-Ming Ko, 2026