• First Reference
  • About us
  • Contact us
  • Blog Signup 📨

First Reference Talks

Discussions on Human Resources, Employment Law, Payroll and Internal Controls

  • Home
  • About
  • Archives
  • Conference
  • Resources
  • Buy Policies
You are here: Home / Business / Is it really possible to control employees' use of company computers?

By Jeffrey Sherman, MBA, FCPA, FCA | 3 Minutes Read January 19, 2015

Is it really possible to control employees' use of company computers?

All users of company IT systems are responsible for knowing and complying with company policies for acceptable usage, and conducting themselves accordingly when using company IT resources. Policies should address any risks you expect to encounter, including security, IT resource capacities, system responsiveness and throughput, and issues of potential legal liability to the company.

System access and acceptable use

Countless risks may result from inappropriate use of your company’s information technology resources: unauthorized for instance, system and data access, various system failures, and system compromise from virus attacks, spyware, Trojan Horses, worms, and other forms of malware. Your policies for appropriate IT use are intended to prevent exceeding planned and budgeted IT resource capacities and misuse of resources for non-business-related activities, such as viewing or collecting pornographic material, gambling, criminal pursuits, personal use and personal business pursuits unrelated to the business objectives of the company.
Other examples of misuse include, but are not limited to:

  • Using an account or user identifier that the user is not authorized to use
  • Interfering with the normal operation of any element of the company’s IT systems
  • Installing or running a program that may damage or interfere with the proper operation of IT systems
  • Attempting to bypass security or data protection schemes, or uncovering security loopholes
  • Violating terms of software licensing agreements or copyright laws
  • Accessing privileged data or software without the explicit consent of the owner

These activities may be more common than you like to think! Consider this case of a supervisor who circulated pornography to co-workers and vendors.

Data access and data protection

A worker may use various methods to access certain data. For example, a Microsoft Word document can be opened not only with Word but also with other basic document applications, such as Notepad and WordPad. However, modifying a Word document with these applications may permanently corrupt the file and make it inaccessible.
Similarly, for a relational database, there are various utilities and a native SQL language available to access or manipulate the data. Here also, accessing the database using available utilities may make some or all of the data unavailable to other applications.
Users must have a good understanding of the underlying data structure to view and especially to update the data with any program other than the one intended by the data designer. Simply viewing the data may not damage it, but this action may make the data unavailable to other applications for some period of time.
For data that is intended to be accessed by multiple users simultaneously, it is necessary to provide interfaces that allow multi-user access while maintaining data integrity and preventing data corruption. When a user needs to take a set of data offline for updating purposes, the data must be subjected to a check-out protection mechanism to prevent all other users from updating while the data is offline. When the updating user has completed updating and replacing the data, a check-in process frees up the data for other users to update. Without the check-out mechanism, any data updates done while the data is offline would be negated when the original user replaced the data. Most operating systems have the ability to lock data in this way.

Internet access

As the laptop, tablet and smartphone have become more ubiquitous than land-line telephones, it is becoming common to treat them in a similar manner: employees are expected to use them primarily for business purposes, but a limited amount of personal use is tolerated. One problematic area has been Internet access. Without clear rules, some will take advantage or engage in excessive non-productive activities. The need for rules will depend upon the corporate culture and other factors, such as the seniority of employees and their ability to understand implied limits. In many cases clear rules are necessary so that employees understand what is and is not appropriate.
Use of the web constitutes such an important tool for research that in many cases overly precise restrictions may be counter-productive. However, users must be clear that the Internet may not be used:

  • To access offensive material
  • To engage in activities that are risky to the user and company IT systems
  • To engage in activities that waste productivity and resources
  • To expose the company to embarrassment, violation of human rights codes or laws, or possible litigation by offended employees, clients or government agencies
  • For any commercial activity other than company business

Risky activities and productivity and resource-wasters on the Internet include unauthorized personal use, especially accessing dating, gambling and gaming sites, participating in chat rooms, shopping and downloading streaming audio, video and other files that use excessive network bandwidth. Downloading any files or enabling the execution of any active content downloaded from unknown Internet sites is especially risky since this can result in the import of malware onto company systems.

Conclusion

Policies can help you manage employees’ and others’ use of company IT resources, and dramatically reduce the potential risk to you and your assets. To do so effectively, however, it’s crucial to assess IT risks, understand your IT resources and goals, and clarify your users’ online activities and expected conduct before developing or updating IT policies and other internal controls.
Information Technology PolicyPro published by First Reference has the sample policies and commentaries you need to manage your employees company IT resources.

  • About
  • Latest Posts
Jeffrey Sherman, MBA, FCPA, FCA
CFO at Atrium Mortgage Investment Corporation (TSX:AI)
Jeffrey is CFO of Atrium Mortgage Investment Corporation (TSX:AI), a director of several companies and has had over 20 years of executive management experience. His interests include corporate governance, risk management, accounting and finance, restructuring and start-up enterprises.

Jeffrey is a popular presenter, and was an adjunct professor at York University for 15 years. He is a frequent course director and course author for many organizations, including provincial bodies of Chartered Professional Accountants across Canada.

He has written over 20 books including: Canadian Treasury Management, Canadian Risk Management, and Financial Instruments: A Guide for Financial Managers (all published by Thomson-Reuters/Carswell), as well as Finance and Accounting PolicyPro and Information Technology PolicyPro (guides to governance, procedures, and internal control), and Cash Management Toolkit for Small and Medium Businesses (all published by Chartered Professional Accountants of Canada [CPA Canada]).
Latest posts by Jeffrey Sherman, MBA, FCPA, FCA (see all)
  • How does IT recovery planning differ from business continuity planning? - August 4, 2015
  • How to manage bank accounts: the basics - July 6, 2015
  • Refresher on financial statistics and metrics - April 6, 2015

Article by Jeffrey Sherman, MBA, FCPA, FCA / Business, Finance and Accounting, Information Technology, Payroll, Privacy / acceptable use, Employee computer use, end-user, HR, Human Resources, internet access, IT policies, IT resources, IT risk, IT risk assessment, legal compliance, legal liability, malware, manage IT risks, resource capacity, risk assessment, risk management, unauthorized access

Share with a friend or colleague

Get the Latest Posts in your Inbox for Free!

About Jeffrey Sherman, MBA, FCPA, FCA

Jeffrey is CFO of Atrium Mortgage Investment Corporation (TSX:AI), a director of several companies and has had over 20 years of executive management experience. His interests include corporate governance, risk management, accounting and finance, restructuring and start-up enterprises.

Jeffrey is a popular presenter, and was an adjunct professor at York University for 15 years. He is a frequent course director and course author for many organizations, including provincial bodies of Chartered Professional Accountants across Canada.

He has written over 20 books including: Canadian Treasury Management, Canadian Risk Management, and Financial Instruments: A Guide for Financial Managers (all published by Thomson-Reuters/Carswell), as well as Finance and Accounting PolicyPro and Information Technology PolicyPro (guides to governance, procedures, and internal control), and Cash Management Toolkit for Small and Medium Businesses (all published by Chartered Professional Accountants of Canada [CPA Canada]).

Footer

About us

Established in 1995, First Reference is the leading publisher of up to date, practical and authoritative HR compliance and policy databases that are essential to ensure organizations meet their due diligence and duty of care requirements.

First Reference Talks

  • Home
  • About
  • Archives
  • Conference
  • Resources
  • Buy Policies

Main Menu

  • About First Reference
  • Resources
  • Contact us
  • 1 800 750 8175

Stay Connected

  • Facebook
  • LinkedIn
  • Twitter
  • YouTube

We welcome your comments on our blog articles. However, we do not respond to specific legal questions in this space.
We do not provide any form of legal advice or legal opinion. Please consult a lawyer in your jurisdiction or try one of our products.


Copyright © 2009 - 2022 · First Reference Inc. · All Rights Reserved
Legal and Copyright Notices · Publisher's Disclaimer · Privacy Policy · Accessibility Policy