3 ms·
Disagree as someone who’s built these, prosecution is an ultimate fallback in AUPs, employee handbooks, etc. HR teams ultimately don’t have a ton of teeth or w
by dogman144 5y ago
Disagree as someone who’s built these, prosecution is an ultimate fallback in AUPs, employee handbooks, etc.
HR teams ultimately don’t have a ton of teeth or willpower unless there are laws involved, and now there is not legal coverage.
- NovemberWhiskey 5y agoIf it matters, I was speaking as someone who led the authorization platform team for a Fortune 100 company. I do suppose this depends significantly on company culture. In my experience: failure to abide by company policy is first-and-foremost a compliance issue; the company policy framework definitely goes above and beyond the scope of "what is criminal". HR is primarily there to provide to manage records of employee conduct (e.g. in case of a pervasive pattern of misconduct across a number of different controls) and a sanctioning mechanism (hard conversation; formal reprimand; separation).
- dogman144 5y agoYeah def a company culture thing. I agree it’s a compliance issue, this is def GRC, and agree with your def of HR. What I notice is HR likes to really move on employees when it has legal protection to do so. What a “pervasive pattern of misconduct” is often has a law behind it in some form, as otherwise you risk a wrongful termination lawsuit. So, if you have a situation where an employee’s pattern of misconduct sources back to only, or at the root, IAM allowing it (say an extreme scenario like consistently nuking prod), there is now some gray area for those wrongful termination suits.