Archive for category: Blog

Are you tired of hearing about data breaches yet?

Thought so. It seems the monthly data breach story has turned into the weekly data breach story. As our systems grow more complex, and we further integrate into the digital world, there are more opportunities for our sensitive data to be stolen. Additionally, cyber criminals are finding new ways to monetize their illicit activities, such as through ransomware and illicit dark web marketplaces where stolen data can be bought by identity thieves and sold by hackers. As a result, cybercriminals have never had so much opportunity and monetary incentive for their activities. So, for the foreseeable future, we can expect to see more of the same.

Unfortunately, human resource departments make great targets for cyber thieves because of the sensitive employee data they store, which may include:

• Personal health information
• Personally identifiable information
• Payroll data
• Employee performance ratings
• and more

W-2 data is especially valuable. If it is stolen, it can quickly be converted to ill-gotten gains by filing a fraudulent tax return, used to obtain a loan or credit cards, or any other variety of identity theft. Every tax year, we see dozens of reports about companies that fall victim to W-2 scams and accidentally send their employees’ W-2s to an attacker posing as an insider.

So, what can be done to minimize the risk of data theft from HR departments?

In 2015, three Google researchers published a study that highlights the differences in what experts and non-experts think are the top three things an internet user can do to stay safe online. There are many lessons from this that HR departments can leverage to improve their security. As you might expect, there are areas where experts and non-experts agree and others where there is a significant divergence. Let’s take a look at the key chart from this report and see what sort of lessons we can learn:

The chart above ranks, from left to right, the most effective to least effective cyber defenses according to experts and provides the corresponding perspective of non-experts. (Source)

1. Update System

The biggest lesson from this chart is the first metric shown on the left. One of the most effective cyber-defenses is staying up-to-date with your security patching, yet most people believe this to be unimportant. Many of the businesses that are victimized by ransomware and other cyber-attacks, are victimized because their systems are not patched with the latest security fixes that prevent those attacks from functioning.

Many modern exploits take advantage of weaknesses in Microsoft Office, Microsoft Windows, Adobe Acrobat/Reader (pdf files), Adobe Flash, and other popular software. These exploits are discovered by hackers and security researchers, and generally the big software vendors fix the exploits quickly. But we as users need to configure our software to allow for automatic updates, and, even though it is annoying, allow the updates to install and reboot the computers when practical so they are protected.

What is interesting is that the system update data point is roughly the inverse of “use antivirus.” I would speculate the divergence of thought between experts and non-experts is due to the non-experts having been exposed to antivirus as the center point of home cybersecurity for 20+ years. Antivirus is still a corporate cybersecurity necessity, but experts believe it to be less important than it was in the past, probably due to so many virus detection mechanisms that reside at network layers placed between users and the internet (such as in SPAM filters and firewalls).

2. Use Unique Passwords

In preparation for this article, I logged into my password manager to see how many sites for which I had login credentials stored. I was shocked to see that I had 184 sites stored.  That is 184 businesses that need to keep, maintain, and secure my account information. And there’s probably others not in there!

Many people reuse the same password at a number of websites because the human brain is not great at storing long strings of random characters. Let’s pretend I reuse the same password in each of those 184 sites. Then, let’s pretend one of those sites was hacked and my user ID, email, and password is stolen. That information will likely be sold on the dark web to identity thieves who would take that email, user ID, and password, and start using them to try to log into popular banks, trading accounts, email accounts, and others to try to gain access to sensitive information and ultimately try to monetize my data for themselves. By reusing the passwords in 184 websites, I have created the conditions for widespread damage if there is a data breach in only one.

By using unique passwords, we guarantee that if our user ID and password is stolen from one business, it cannot be used to gain access to another account at another website.

For HR staff who have access to benefits systems, payroll systems, and other systems that store sensitive data, are you using the same password to log into those systems as you use in other personal online accounts? If so, you might be increasing the risk of data theft to your fellow employees.

Okay, I need unique passwords. But how do I remember all these passwords? I alluded to it before; password managers can be great to generate and store long, complex, and unique passwords. A password manager securely stores your passwords in a way that makes them retrievable by you and hopefully nobody else. They generally also have user conveniences that make it so that you don’t have to manually key in the long password.

What happens if the password manager gets hacked? This is a valid concern and ultimately it boils down to a personal decision. You have to ask yourself if you think the security benefit from having long, complex, and unique passwords from a password manager is greater than the risk that the password manager is hacked and all the data is stolen and decrypted.

The general consensus among security experts is that the benefit does outweigh the risk. Just looking at the chart above, we can see that four of the top five recommendations all relate to having strong authentication, and number five is “use a password manager.”

3. Use two-factor authentication

Another area of great divergence between experts and non-experts relates to something called two-factor authentication (2FA), also sometimes called multi-factor authentication (MFA). Most 2FA solutions typically require three pieces of information from users to access their accounts:

• a user ID (something the user knows)
• a password (something the user knows)
• a token of some variety that is generated by a device carried by the user (something the user has)

The third item can be an access card, a mobile phone, or a key fob with a rotating pin code. Here’s an example of how they work:

You visit a website, enter your user ID and password, and authenticate. The website sends a temporary authorization pin code to your mobile phone in a text message. You receive the text on your phone, enter the pin code into the website, and access the account online. Without your phone, you would not have been able to log in.

A cybersecurity attacker who wants to bypass these protections needs more than just your user ID and password; they also need a physical device. With 2FA, the risk of unauthorized access from stolen or sold login credentials is greatly reduced. And yes, employees do sell passwords.

The great news with 2FA is that it is becoming more widely adopted every day. Many of the HR systems providers, such as payroll and benefits websites, offer the option to set up 2FA quickly and easily. HR departments should look into the online systems they use and try to enable 2FA if it is an available function. If it is not available, try to encourage your service provider to add the capability. User feedback is critical for developers to improve software.

There is obviously much more to think about with respect to corporate cybersecurity, but HR departments would be wise to consider the highly rated security measures identified by Google and discussed in this article to help keep their data safe.

Article contributed to Inspiring HR, LLC by Chris Moschella, CPA, CISA with Keiter.  

Keiter provides a wide-variety of cybersecurity services to their clients including, but not limited to: cybersecurity risk assessments, policy analysis, audit, penetration testing and vulnerability scanning, security awareness testing, custom phishing campaigns, and more. You can also check out Keiter’s collection of free cybersecurity resources. Organizations ready to tackle cybersecurity for the entire business can download Keiter’s free whitepaper.

Click the link to view the recent blog: Ditching the Annual Review or check back for more on human resources, payroll, insurance and benefits.

NOT SURE HOW TO HAVE TOUGH CONVERSATIONS WITH EMPLOYEES WHEN YOU CAN’T “CALL HR”?  NO PROBLEM!  THIS WILL HELP YOU NAVIGATE THE MOST COMMON CHALLENGES.

Are you in what we call a “catch all” position? You run the office or operations, which by the way includes HR? Are you generally trained on following labor laws and organizing hiring and employee management? Or are you learning as you go? Either way, from time to time, you face out of the ordinary challenges you aren’t sure how to respond to.

It is true that some employee management challenges need the guidance of a trained professional.  Access to an HR consultant or even an attorney, the more expensive option, is a great option. But you can put yourself in a position to handle common inquires and challenges. Sounds easier and cheaper, right? And if you are that “go to” or “catch all”, I’m willing to bet you want to improve at leading and build your confidence in what can be solved.

Here’s a list of the most common employee management challenges we see every day, with guidance on how to initially respond to and then see through to a solution.

Recruiting & Hiring

Job Applicant asks:

1. How are your hiring decisions made?

Answer: Our interview process generally runs for X weeks at which time we will select and offer the position to the most qualified candidate.

2. Why are drug tests or background checks required?

Answer: Because of how we are licensed and regulated (or in the interest of workplace safety) we require all applicants who have been offered a position to pass a drug test (or background check) as a condition of employment.

3. I am pregnant (or have another medical condition). How will that affect your hiring decision?

Answer: Our hiring process fully complies with Equal Employment Opportunity standards. No applicant is ever discriminated against, including denied an opportunity for employment, based on any protected condition, including pregnancy.

4. How long will my resume or application be considered for current or other open positions?

Answer: Generally, no less than 1 year.

New Employee Orientation or Onboarding

New Employee asks:

1. I “forgot” to mention I need time off (several days) for an event. Will I be paid?

Answer: Let’s refer to the policy in our Employee Handbook that you received a copy of. (Follow policy).

If no policy, or unclear, answer is: We will handle this according to how we have handled similar situations, although rare, in the past. Generally, the time will be unpaid or (if applicable) you can elect to borrow against your Paid Leave benefits that become effective on X date.

2. What happens if I am late or need to leave early?

Answer: Our attendance policy is described generally in our employee handbook and we ask that you follow it. Anything not answered by policies in our handbook related to attendance or requests for time off can be brought to your supervisor.

3. Is there an option from me to work from home?

Answer: Generally speaking remote work is only offered for qualifying roles and in qualifying situations, in a manner that all rules, requirements and expectation are reasonable and clear. You should discuss this in more detail with your supervisor.

Employee Complaints

Employee tells you or reports that:

1. I am being harassed or discriminated against by my supervisor or another co-worker, but I am not sure I want anything “done” about it yet.

Response: “Thank you for having the courage to report this. This is a serious matter and must be investigated as described in our employee handbook. Please refer to our no retaliation standard and be assured that all efforts will be made to preserve confidentiality up to the point it is no longer reasonable to do so.

2. My supervisor is creating a hostile environment by yelling all the time.

Response: An accusation of a hostile work environment is quite serious and should be investigated if your supervisor is violating our anti-harassment and non-discrimination policy. Describe for me what is going on and then we can decide together how to proceed, including an investigation if necessary.

3. I am having a really hard time with my job duties and just need someone to listen.

Response: This is an open-door environment and I am always happy to hear your concerns. Generally speaking I will hear you out and offer suggestions, including speaking to your supervisor directly so the two of you can keep working together effectively.

4. I can’t get along with this co-worker and need to be moved.

Response: I am sorry you are feeling this way. You are not required to personally like everyone you work with but we do ask that everyone behaves professionally. In the interest of team play I would like the two of you to consider scheduling a time to work through your differences; with my help or the help of your supervisor.

Employee Requests

Employee asks or tells you:

1. I am in a lot of pain from X and need the next four Fridays off for physical therapy.

Response: We would be happy to accommodate you. Are you able to provide a note from your treating physician who states the need for this time off?

2. My child is sick and I need to leave early. Can I work from home?

Response: I am sorry to hear that. Your supervisor should be told immediately so back up coverage or the option to work from home can be discussed and ironed out.

3. I am having a baby and will need FMLA time off. How does this work?

Response A: Congratulations! Since we are a company with less than 50 employees we are not required to offer FMLA specifically. However, we do have a process when requesting unpaid leave for any qualifying medical condition. Please refer to the policy in our Employee Handbook and then see me with additional questions.

Response B: Congratulations! Since we are a company with more than 50 employees you will find our FMLA policy in our employee handbook. I will need your request in writing (use form) and ask that this form (certification of health care provider) be completed and returned, preferably before your last day of work before leave.

4. My medical issue may require me to take longer than 12 weeks of FMLA. How will that be handled and what happens to my health insurance?

Response: Once FMLA is exhausted we will move you to inactive status, at which time you will no longer be able to satisfy eligibility requirements with our health insurance carrier. During inactive status we ask that you continue to provide periodic updates on your progress and intention to return to work. After 12 weeks, your group health coverage will be terminated and you will be offered a chance to continue coverage through COBRA.

5. My doctor has released me to light duty, but I’d rather stay home until I can work my regular job.

Response: Unfortunately, that is not an option. If your treating physician has released you to safely work in an available alternate role while you recover from your injuries, we expect that you do so unless you are eligible for FMLA. If you are not eligible for FMLA, and do not wish to return to work, you are free to voluntarily resign.

Employee Conduct or Work Performance Concerns:

You witness or the supervisor/manager needs helps with:

1. Employee appears or is reported to be intoxicated or “under the influence”.

Response: We have reason to believe you have reported to work in an impaired state. Is there anything we should be aware of?

In the interest of safety and in support of our substance abuse policy I am asking you to submit to a drug test.

Employee gets upset:  I understand why this may bother you. We ask this of anyone for which there is reasonable suspicion. If the results are negative, then you have our apologies.

Employee refuses: Be advised that refusal to do so may result in suspension or termination of employment.

2. Client or co-worker reports or suspects theft.

Response:  Unfortunately, your work area has reported theft for which we must investigate. While we investigate we need to (A) temporarily re-assign you (if this is a reasonable, secure option) or (B) place you on administrative leave (choose from paid or unpaid depending on severity, evidence, circumstances).

3. Top performing employee is suddenly having attendance problems are making a lot of errors.

Response: We have noticed a sudden, negative shift in your work performance. Is there something going on that we should know about or can help you with?

4. Written Warning.

Response:  We are here discussing this because prior verbal warnings about X have not worked.  We are really concerned about your performance and it must improve. Please sign this document and add comments are you see fit. I am also open to any feedback you have on what we can do to support your in improving.

Employee gets upset or defensive: I am sorry you feel that way. This is a job requirement for which we must see improvement.  If you feel this is no longer that place you wish to work you are free to voluntarily resign and we will wish you well in your next endeavor.

Employee refuses to sign: That is your choice. I will just go ahead and write in this line that notes “refused to sign” and you can sign there.

5. Final Warning (Action Plan).

Response:  We have to come to a point for which I feel a very specific plan of improvement needs to be put in front of you, so we can be very clear on what you need to improve on in the next 30 days in order to keep your job. We do not take this step lightly and want you to succeed. But understand this is your final warning for the need to improve on very specific aspects of your work.

Employee gets upset or defensive:  I am sorry you feel that way. This is a job requirement for which we must see improvement. If you feel this is no longer that place you wish to work you are free to voluntarily resign and we will wish you well in your next endeavor.

Employee refuses to sign: I am sorry you feel that way. These are job requirements for which improvement is 100% necessary and required.  If you feel this is no longer that place you wish to work you are free to voluntarily resign and we will wish you well in your next endeavor.

If you are the person within a small business that had HR duties merged into the rest of your role, I’ll end with this. You can learn HR basics! Those new skills and experiences go a long way in advancing your career and your overall effectiveness.  All that is above dips your toe in the water nicely. But keep two things in mind:

1. Don’t go it alone!

There are plenty of affordable and quality external resources out there, like HR consultants, to call on when something gets too tricky or complicated. Minimize risk by understanding when something routine has turned into something with potential legal consequences.

2. HR duties doesn’t mean all the hard conversation are on you.

Before getting too far along in handling an employee challenge, ask yourself “should the leader be handling this”? If the answer is yes, re-direct! HR is an aid, a guide, a support system. They are not there to do the leader’s job for them – including having hard conversations.

This article does not constitute legal advice and there are subtle variations in employment law as it pertains to this topic, depending on where your business operates. It is strongly suggested that you seek consultation or legal counsel before making decisions about policies.

Click the link to view the recent blog: Five Easy Steps to Design Insightful Interview Questions or check back for more on human resources, payroll, insurance and benefits.

It’s no secret that remote environments are growing in popularity; a trend that is being driven by new generations of workers who expect boundaries and desire harmony between work time and personal time.

But remote workplaces do come with challenges.  One often cited is the lack of collective work experiences – including a shared office space – and the negative impact this is assumed to have on the creation of cohesive workplace teams or a unified culture.

The Right Way to Work Remotely

As it turns out, Inspiring HR knows a thing or two about remote work environments. They are a 100% remote business model, with 11 employees scattered throughout the country in a manner that best meets the HR needs for their 100+ customers nationwide.

When Inspiring HR’s consultants gathered together for the first time at their inaugural company retreat in March of 2018, it seemed the right time to assess whether it is really possible to build a productive and collegial team within a remote business environment.

From the start, we had our answer.

“For me,” said Inspiring HR’s CIO and Founder Mindy Flanigan, “the most affirming moments of the entire retreat were from that first evening. I watched my team greet one another like long lost friends, even though they had never physically met before.”

As the retreat progressed, a recipe for remote work success came into focus.

Buy-in and support from leadership. Mindy isn’t just Inspiring HR’s leader, she’s also a remote worker herself. As such, she understands the importance of clear communication on matters such as client response time and when her employees are required and not required to be available. She implemented standard operating procedures to keep service levels consistent and provides an environment for team members to seamlessly support one another during vacations or leaves of absence.

Hire remote-ready employees. Successful remote employees are self-motivated, results-orientated and tech-friendly.  They are effective communicators and collaborators who can also work independently and take responsibility for their success rather than looking to “rise with the tide”. Once you find an employee with the right combinations of traits and skills, you must orient them properly. Inspiring HR has a rigorous new hire orientation program that begins on day one. There is a precise checklist to follow so nothing falls through the cracks.  This affirms to their team members that they are valued and allows them to start building their workplace relationships right away.

Communication is key. In order to quickly remove obstacles and keep everyone and everything advancing forward, leaders are required to have regularly scheduled check-ins with the employees they supervise. These one-to-ones are used to review open tasks, connect employees with colleagues best equipped to help them over hurdles, and provide dependable, uninterrupted time to discuss any concerns or issues. For new employees, these one-to-ones occur weekly. For more seasoned employees, they may take place bi-weekly or even monthly.  This constant communication flow also reinforces expectations on deadlines, client service levels, productivity, and professional development so that consultants can effectively self-manage – through block timing and boundaries – the integration of work and personal demands.

Technology and tools make all the difference. At Inspiring HR, they rely on Wrike and Slack to keep their work organized and communication flowing. There are times, however, when a reliable, low-tech option is the best fit for building relationships, as was noted by Sr. HR Consultant Val Juarez: “I have found it important to replace the ‘face time’ I had in an office with picking up the phone and talking to my colleagues about work, to troubleshoot, to brainstorm, and to support each other. Listening to each other in conversation helps their remote team learn and gel.” 

Project work makes the team work. Project work is one of the most effective ways their remote consultants deepen their workplace connections and build awareness about all the expertise available within their dispersed team. With the right tools, we can share their experience and skills with coworkers as easily as if we worked down the hall from one another. Project work also creates an atmosphere of accountability, reliability, and trust that is often absent from remote workplaces, but that is thriving at Inspiring HR.

Remote work lets employees focus on the job. Having a remote environment can eliminate the wasted time, gossip, and friction that plague many companies. When they did come together at their retreat, they jumped right into productive brainstorming sessions at a level that may not have been possible if they had brought their daily baggage to the table with them.

To compete for the newest generations of talent, companies should position themselves as remote-friendly employers. At Inspiring HR, they are a working example of the viability and potential of remote work environments for small businesses.

Click the link to view the recent blog: Effective HR is More Than Enforcing Policies or check back for more on human resources, payroll, insurance and benefits.

THE ANNUAL PERFORMANCE REVIEW WAS ONCE THE DARLING OF THE HR WORLD.

It was designed to document past performance, justify employment actions and salary decisions, and motivate employees to excel – all of which continue to be essential elements of employee management.

Sadly, in most companies the annual performance review struggles to live up to its potential. It’s viewed as onerous and unimportant. Managers and employees alike dread the entire experience.

While the goals of the annual performance review remain important, it’s clearly (past) time to look at the process with fresh eyes and try something different.

Considering a New Approach

According to a survey conducted by Fast Company, 62% of millennials – the largest group in the workforce today – have felt “blindsided” by a performance review.  74% said they generally feel “in the dark” about their performance during the year.   This is hardly a glowing endorsement of the once-a-year process.

It’s important, when looking at any method of reviewing performance, to consider:

• Intent
• Relevance
• Effectiveness

Intent – is the intent simply to check a box so there is something on record when performance starts to go downhill or to be able to assign employees a numerical rating as a way to come up with raise and bonus amounts. If it is actually to talk about performance, is a once a year conversation really satisfying that requirement?

Relevance – A manager giving feedback about an assignment that occurred in January while he or she is sitting with an employee in November isn’t exactly timely. Employees generally don’t want to hear how they did six, eight, 10 months ago.  Chances are, they already know or figure if there were issues, they should have been discussed at the time. What they DO want to know is how they are doing now and what lies ahead.

Effectiveness – Does the review process you are using currently inspire or motivate your employees? Is tying so-so performance to a 1.5% raise getting the results your company is hoping for?

Some interesting options to consider if you are looking at ditching the annual review:

• Micro Reviews: For companies that have a hard time breaking the annual review habit, micro reviews may be the way to go. The process is shorter and happens more frequently, say on a quarterly basis. The recommended focus, however, should be on development, progress, and accomplishments rather than shortcomings, because shortcomings are addressed as soon as they become apparent.
• Ongoing Feedback: For companies ready to do away with reviews all together, weekly, bi-weekly, or monthly one-to-one meetings between managers and their employees with a set agenda could work quite well. During these one-to-ones:
  • Progress toward annual development goals can be gauged
  • Challenges can be discussed – are additional resources needed? Is additional training needed or desired?

Notes should be taken to ensure continuity, especially regarding any issues that come up along with a plan to follow up.  Documentation of these conversations will be key if performance starts to fall and can be used in creating a performance improvement plan if necessary.

• Annual Reflection/Annual Development Plan – assuming feedback has been given all along, an “Annual Reflection” may wrap up the anniversary year nicely. This can be a more formal document about what the employee feels have been his or her accomplishments, general work challenges and development needs or wishes not already on their Development Plan.  Additionally, this is when a manager will revise and update the employee’s Development Plan for the new year, ensuring that any new goals align with the strategic and growth plans for the business.

Revisiting the development plan on a more informal basis periodically throughout the year may be a helpful process to see if any goals need to be tweaked, reset or are no longer appropriate.

Breaking the Link Between Annual Reviews and Compensation Reviews

Doesn’t compensation have to be tied to annual reviews? Not necessarily.  In fact, tying it too closely to the review process may have the opposite effect than what was intended. According to a study conducted by Willis Towers Watson, only 20% of North American employers believe that “pay for performance” actually improves performance. Reducing a year of accomplishments to a numerical rating that essentially assigns a percentage for a raise or bonus may override what the employee hopes to hear regarding feedback – what their progress has been and what the next steps are for their careers.

Compensation discussions separate from performance discussions may be more meaningful as feedback is already being provided and the focus can be on the pay package.

Managing the Roll Out

So, are you convinced? Are you read to ditch the annual review? Great! Here are some ideas on how to get started.

In most cases, eliminating the annual review will be met with equal parts celebration and resistance. Change – even welcome change – can be difficult for an organization and its employees. The best way to get everyone on board is to prepare at a solid plan for rolling out the program that will replace it.

Whether your goal is to downshift to a micro review/annual reflection process or eliminate the annual process completely, you’ll need to:

• Sell it to the C-suite; get their buy-in and active support by tying the new process to strategic business goals
• Purchase or create the tools necessary to support the new process
• Over-communicate the details to managers and employees, including:
  • Why are we doing this?
  • What material changes to the process will they see?
  • How will this directly impact them?
• Training, training, and more training
• Measure results and praise successes
• Be open to making tweaks along the way

As the typical workplace becomes less formal, it makes sense that this informality will be reflected in its business systems, including performance evaluations. Just remember that informality is not an excuse for a lack of feedback or carelessness with the process. Employees need and deserve to know how they are performing, and the goal with any process improvement is to provide them with more feedback, not less.

Click the link to view the recent blog: Imagining the Workplace of the Future or check back for more on human resources, payroll, insurance and benefits.