6

I wonder which response to this situation is best:

You work in an IT department and one the user from your company (but not IT department) asks you to change a timestamp. For example: "please update the records to change the shipping time 3 hours earlier than it is" or "please update the database records from 'ticket treated on XX/XX/XXXX hh:mm' to the same time but the day before".

Your (IT) managers told you to always fit whatever request the users are doing.

What is the proper answer to this? If you do it then you are lying to end-customers and if you don't your hierarchy might not appreciate that you did not fit the users' request...

Improve this question
12
  • 6
    If your hierarchy are asking you to do this, then perhaps you don't want to be working for this hierarchy, as they are asking you to be do ethically challenged things. Personally, I would decline on the basis of ethics, and if the matter was pushed then I wouldn't have any issues writing that job off. Your location does matter with regard to this question, as if you are in a "right to work" area of the US then you could be sacked for standing up for your ethics, whereas in the UK you would be protected for doing the same thing.
    – user34687
    Jul 7, 2016 at 10:09
  • 5
    The ethics depend on the reason for altering the records. Was the ticket actually treated on the time that it says? If it is being altered to deceive, then it is unethical. If it is being altered to correct an error, then it is fine.
    – Brandin
    Jul 7, 2016 at 10:26
  • 1
    This is a borderline legal question and while ethics are a separate thing they are also affected by location/jurisdiction. This needs a rewrite to clarify the question and ensure that it's on-topic. VTC.
    – Lilienthal ♦
    Jul 7, 2016 at 10:38
  • 3
    Just respond that you need to know the reason before making the change. How they respond will probably tell you whether the request was ethical or not.
    – Brandin
    Jul 7, 2016 at 12:23
  • 2
    Whatever route you take, please have written confirmations of whatever your manager tells you to do.
    – svavil
    Jul 11, 2016 at 8:58

5 Answers 5

Reset to default
20

You need additional information.

It happens a lot when the data being added to the system is wrong. For example what if a device that logs package arrivals at a facility had the wrong date set on it and thus all the packages coming in got logged with bad data which needs to be fixed.

In an ideal world changing traceability data should also be traceable. As in you have documents and logs detailing that you changed a value from X to Y, and those logs are auditable. Those documents should also say why you need to change the information. If you are not getting the why written down somewhere, then you should refuse to change it until it is. If you do not then years from now someone could put you in the hot seat and ask you why did you change the information.

Improve this answer
1
  • 2
    Yes, you can also be putting yourself at legal risk changing such things in the backend and avoiding the business rules and internal controls (one reason why it is stupid to put such things in the application and not the database, but I digress) particularly if the change has any financial implications. If the record changes are audited, you will be the one who gets the blame if it comes to a legal dispute with the customer. All such changes should be documented in a notes field which references at a minimum the work ticket requesting the change so the reason can be researched later.
    – HLGEM
    Jul 7, 2016 at 16:53
4

"Your (IT) managers told you to always fit whatever request the users are doing." Your managers might not have anticipated that a user requests something that might be illegal or damaging the company.

"please update the records to change the shipping time 3 hours earlier than it is" or "please update the database records from 'ticket treated on XX/XX/XXXX hh:mm' to the same time but the day before" - your database records should say the truth. If the shipping date or ticket treatment date are incorrect then this can be changed; there are systems where a record of the change would be required (for example with a comment "fixing incorrect date entry"). If someone changes for example a correct shipping time so they don't get blamed when the shipment arrives too late, then you should not change it.

It's up to your manager to decide and how to handle this; "do whatever the user asks" means your manager isn't doing their job. So bring it to you manager, and explain that do to the nature of the request you thought you should check with them before completing it.

Improve this answer
1
  • @Chad Good change.
    – gnasher729
    Jul 12, 2016 at 20:48
3

Your (IT) managers told you to always fit whatever request the users are doing.

You don't know it is a lie. You don't know if the original data is valid. You are not in a position to certify the data and I am suggesting you don't want to insert yourself there.

Even if you ask for a reason you don't know if the reason is valid.

This is something you need to ask your boss.

Boss, does always fit whatever request the users are doing include changing data? I am getting numerous request to change shipping time. It is easy enough to do. My question is if that is something I should be doing.

Improve this answer
2
  • Exactly. Get paid the same either way. Change it and be done, if involve yourself, will end up adding more work or paperwork.
    – Dan Shaffer
    Jul 7, 2016 at 18:11
  • 2
    @DanShaffer I would suggest that anyone with this attitude has no business adjusting any data in any database.
    – HLGEM
    Jul 12, 2016 at 20:33
2

Your (IT) managers told you to always fit whatever request the users are doing.

I urge you to be very cautious and to document fully the request in written form if feasible. Working as an IT auditor, timestamps are one key piece of information I rely on when conducting internal controls testing.

It is entirely possible that the request is benign, but it is also possible that the request to you is in an attempt at collusion between business and IT as part of an illegal fraud. If you make the change, when the changes are audited, your name will be (or should be if change management controls are working) associated with the change.

Albeit how unlikely the possibility, the possibility the motivation is unscrupulous exists. You should find out the reason for the request, and if you suspect its questionable, don't make the change.

Ask yourself: "Do I want my name and reputation to be tainted as an accomplice to illegal / unethical activity?

Improve this answer
1

Are these requests made in writing? i.e. So there is a paper trail?

I think with these kinds of requests I would do the following:

  1. Get additional information as to why this should be changed.
  2. Seek guidance from a manager (written if possible).
  3. Ensure that these requests come through in writing/support ticket etc.

If you have written guidance from a manager to always change dates and you have written proof someone requested the date change, then you should cover your back should something arise from this.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .