Four workplace policy categories and monitoring risks

Four categories of product get sold into this area, and they carry very different risk. One of them can create the problem it claims to manage, and it is the one with the best sales material.

No product is named here. The categories, and the questions worth asking, outlast any recommendation.

What to take away

Policy administration is the boring category and the one that actually helps.
Monitoring products are the highest-risk purchase in this area, and the risk lands on the buyer, not the vendor.
Nothing here is a substitute for a named owner, a written procedure, and local legal review.

The four categories

Policy administration. Where the current version lives, who has read it, what the previous versions said, and when the next review is. Unglamorous, cheap, and the one that solves a problem organizations actually have. Most cannot produce the version of a policy that was in force on a given date.

Four workplace policy tool categories

Policy administration

Core job: Version control
Main value: Solves real problem
Cost: Cheap
Risk level: Low

Case management

Core job: Intake and records
Main value: Consistency and record
Cost: Moderate
Risk level: Low

Training and attestation

Core job: Deliver and record
Main value: Evidentiary proof
Cost: Low
Risk level: Medium

Monitoring

Core job: Observe activity
Main value: Security oversight
Cost: High risk
Risk level: Risky purchase

Case management. Intake, routing, records, and timescales for individual matters. Value here is mostly in consistency and in the record. A matter handled without a file is a matter you cannot defend or learn from.

Training and attestation. Delivering the document and recording that people saw it. The attestation is evidentiary rather than educational: a click-through does not produce understanding, and treating it as though it does is the standard failure.

Monitoring. Software that observes employee activity, on organization systems or beyond them. This is a category apart and the rest of this page is mostly about it.

Why monitoring is the risky purchase

Three reasons, and none of them is about the software working badly.

What an employer may monitor, what it must disclose, and what it may do with the results differ substantially by jurisdiction. Notice is frequently a requirement rather than a courtesy. A tool that can be configured to do more than you are permitted to do puts the entire compliance burden on your configuration choices.

In the United States, the Electronic Communications Privacy Act (ECPA) may apply to the interception of electronic communications, and state laws may add requirements. Its application depends on the technology and circumstances, so have counsel assess the proposed configuration rather than relying on a vendor's compliance claim.

Capability drifts into practice. A tool bought for a security purpose gets consulted during a conduct matter, because it is there. Unless the boundary is written down and technically enforced, security monitoring and conduct monitoring merge, and every security alert becomes a potential disciplinary matter.

Discovery during a dispute damages trust well beyond the individual case. Whatever is monitored should be described in the policy, in the same document, before it happens.

The buying test

Question	What a weak answer sounds like
What exactly does it collect, field by field?	A description of features rather than data
Who inside our organization can see the output?	Everyone with an admin login
Can we restrict it to organization systems?	A configuration option with no enforcement
What is retained, and can we set the period?	Indefinite by default
Can an employee see their own record?	Not supported
Does it act automatically on anything?	Yes, described as advisory
Can we export and delete everything on exit?	Reports only
What does the vendor say about our legal position?	That the product makes you compliant

The last row is the one to press hardest. A vendor asserting that a product makes you compliant is asserting a conclusion about your organization it is not in a position to reach. That claim belongs to counsel where you employ people.

Buying test questions

What exactly does it collect, field by field?
Who inside our organization can see the output?
Can we restrict it to organization systems?
What is retained, and can we set the period?
Can an employee see their own record?
Does it act automatically on anything?
Can we export and delete everything on exit?
What does the vendor say about our legal position?

What to do before buying anything

Four steps, in order, and most organizations discover they need less tooling after the second.

Four steps before buying

Write down what you actually do today
Write the procedure
Fix the policy text
Then decide what a tool would add

Write down what you actually do today.Which systems are monitored, by what, seen by whom. In most organizations this has never been written down and does not match what anyone believes.
Write the procedure.Specify who receives a report, who decides, who hears an appeal, what evidence is preserved, and how it is handled.
Fix the policy text.Review clauses for clear limits on purpose, scope, notice, access, and use of results.
Then decide what a tool would add.Usually policy administration first, case management second, and monitoring only where a specific security need names it.

What not to buy

Anything that scores or ranks employees on behavior. The output is a number that will be used in decisions it cannot support, and the people using it will not know how it was produced.

What not to buy

Anything that scores or ranks employees
Anything monitoring personal accounts or devices
Attestation as a substitute for training
Anything that cannot export

Anything that monitors personal accounts or non-work devices. Aside from the question of whether it is permitted where you are, it converts an employment relationship into a surveillance one and the cost is paid in everything else.

Attestation as a substitute for training. Recording that people clicked is not the same as attaching the moment of reading to the moment of relevance, which is the point made in why guidelines fail.

Anything that cannot export. Your records have to outlive the subscription, and in this area they are the material any later review depends on.

Where obligations set the specification

Some capabilities exist because a body requires something of employers: notice, record keeping, or handling of concerns raised by workers. Where that is so, the requirement sets the specification, not the vendor, and it differs by market.

The Occupational Safety and Health Administration (OSHA) publishes guidance on employer workplace safety responsibilities. It is one example of an authority that can set obligations; identify the regulators and requirements that apply to your workplace with counsel.

Record the underlying obligation separately from the product that helps you meet it. Keep the authority, applicable requirement, and relevant policy or procedure together so that when the tool is replaced, nobody has to reconstruct what the requirement was.

Common questions

Is any monitoring acceptable?

Proportionate, disclosed, purpose-limited monitoring of organization systems is ordinary in most places. The word doing the work is disclosed: describe what actually happens, in the policy, before it happens.

We already own a tool that does more than we use. Is that a problem?

It is a configuration and governance question rather than a purchase one. Write down what is switched on, who may switch more on, and what approval that needs. Unrecorded capability is what turns into unplanned practice.

How do we evaluate a case management system?

Run three concluded matters through it on paper. If the file it would have produced is not enough to explain the outcome to somebody who was not there, it is not solving the problem you have.