Critical Incident Management

Policies governing IT human resources differ from those used in other business units because they require some stringency. Polices and procedures to hire the best-possible candidates will decrease human resource risk factors and raise the possibilities of "getting the biggest bang for the buck." IT employees are very different than others in the business world. They have very specialized skills, training, certifications, and experience that are very portable. Consequently, many IT employees feel more loyalty to their profession than to the company, requiring policies and procedures to accommodate these differences if the business unit is to function at the level that is normal for the profession and if the turnover rate is to be minimized.

Getting the Best Candidates for the Position

There are successful procedures for obtaining the best IT candidates when combined with the more-traditional methods:

• Pay a meaningful bounty to current employees for recruiting and hiring qualified people.

• The Human Resources management office should have a standardized procedure for screening employment candidates so only qualified candidates are considered. Often the creation of forms requiring basic information as to the candidate's education, training, professional experience, professional certifications, and professional recommendations provide an effective mechanism of measuring the candidates for jobs. Accepting résumés is a traditional first step in developing a qualified candidate pool but some candidates have an ability to mischaracterize their abilities, so it is recommended the standard job form is sent to candidates who appear most qualified.

  Experience Note

  While conducting an audit of a Human Resources management unit, a stack of resumes was reviewed as part of the audit program. The auditor was shown job requirements for a systems analyst and a submitted resume where a candidate purported to have 15 years of IT management experience. The Human Resources manager sent a standardized experience form for completion to the candidate, requesting a detailed explanation of his management experience. After completion, the form reflected the candidate had been a data entry supervisor where he was responsible for several data entry specialists and had never worked with the actual network or anything that would qualify that person in systems analysis or development.

• Consult with the person leaving a position that can describe the job better than anyone else. In the event of a new position, locate persons who are in the same or similar position for their input.

• After the most qualified candidates are found, confirm their work experience at their previous employer. This is a frequently ignored area. Take the time to speak with their former supervisor and ask job performance questions. Determine if this person is eligible for rehire.

• If there is a bonding or other similar requirement, obtain a waiver from the candidates and obtain a credit report.

• Do not forget to verify their professional references. It is recommended that each qualified candidate provide at least three. It is recommended the references should be thoroughly interviewed about the qualifications of the candidate.

• In the case of very-sensitive positions, require a complete background investigation to be performed by a competent and experienced firm. These background investigations should be required every few years of employees in sensitive positions. They are worth the time and expense.

• Avoid nepotism. The controls needed for IT business operations are stringent at best; hiring relatives may cause unnecessary problems. Individuals related to each other tend not to abide by the same rules as nonrelatives. Often they tend to cover up more errors and have higher rates of orchestrated thefts and embezzlements.

Job Interviews

Candidate interviews are a necessary part of the selection procedure. They usually begin after the candidates have passed preliminary screening processes.

Structured interviews are generally characterized by a list of questions suitable for interviewers with little training to ask. The questions can be divided among the interviewers or repeated using different versions looking for response consistency. This approach is very restricted and narrow.

Semistructured interviews are usually characterized by only a few major questions prepared by the interviewers in advance. Conducting this interview requires a higher degree of technical skill and preparation but allows for more flexibility than the structured interview approach. At this time, the interviewers are more able to probe the areas that seem to merit more detail from the candidate.

The unstructured interview is best conducted by senior managers and very experienced interviewers. Topical areas are covered during the interview, but the interviewer retains the freedom to adapt to the individual candidate. The reliability of this interviewing method may be questioned at some time but if it is conducted carefully and thoughtfully, it does provide the interviewer with substantial information about each person.

As soon as the candidate interview is concluded, each participating interviewer should document his objective analysis of the candidate in writing. These notes and analyses should be archived and maintained in the event of future litigation. The interviewers should make an informed recommendation to the hiring manager. If the decision is close, the hiring manager may wish to speak with the interviewers or even have a second interview with the candidates.

Performance Reviews

Most companies have employee performance review procedures in place. IT systems professionals may require specialized procedures as their performance is a function of ability as well as professional skill and personal effort. Following are several procedures that should be considered when addressing individual performance matters:

• There should be formalized criteria against which an employee's performance is measured. This criteria is not merely a job description; rather, this document sets out the performance expectation of the employee in that job. It is important that the performance criteria match the level of professional expectation for each position level. For example, if an employee is an entry-level programmer, the performance measurement criteria should be geared toward that of an entry-level programmer.

• Consider job performance measurement criteria that have unacceptable levels, acceptable levels, and truly exceptional levels of performance.

• Job performance criteria should escalate with the employee's escalating abilities.

• There should be monetary and other award incentives for employees who perform well.

• Employees should read and acknowledge their job performance criteria.

• Consider a formalized career path for employees. Can they increase their responsibilities and pay according to formalized methods?

• Performance evaluations should be face-to-face at least annually. Senior managers need to speak with their employees and let them know how they are doing. Managers should seriously consider having semiannual performance reviews so the employee is not shocked at his annual performance review. If someone is doing very well, he should be acknowledged.

• Spot awards recognize employees in a particular task. These tokens are generally something a senior manager has available to hand to an employee, recognizing his good work on the spot.

Employee Termination

To protect the organization, senior managers should use special termination procedures, as departing employees have many opportunities to vent animosity with destructive results. These are a few examples of special procedures when dealing with employee terminations:

• Employee is notified away from the work area.

• Employee's systems passwords are removed before the notice is delivered.

• Employee immediately returns company identification and any company property including tokens, smart cards, laptops, etc.

• Employee is accompanied as he packs his belongings and is escorted from the building. In some cases, the organization may want to pack the employee's personal items and send them to his residence. At no time is the employee left unaccompanied after termination notice is delivered. If transportation is required, it should be provided.

• The internal auditing unit is notified and all employee activities in the network and workstation are audited for a period of 90 days. It is a frequent occurrence that employees with a feeling they are going to be terminated will do damage in that time period.

Employee Departures on Good Terms

Employees departing on good terms, for a variety of reasons, should have an exit interview by someone other than their direct manager. This interview has the purpose of learning exactly why the employee is leaving. Data collected from departing employees may indicate undesirable situations or conditions exist and need correction.

In all cases, as soon as the employee gives notice of departure it is prudent to notify the auditors. After the person leaves the organization, his network and workstation activities should be audited for a period of at least 90 days. This action will attempt to discover if the employee is leaving with intellectual property belonging to the organization, and determine if there are any retaliatory events waiting to happen in his absence.