2

I am a Senior Architect and am working with a third party vendor. An employee of the third party supplier has presented an Linux foundation certificate to prove that his knowledge is "Expert"; however, when I try to validate his certificate, it shows up as being "Invalid."

What steps should I take?

Improve this question
5
  • 6
    invalid? Fake? Expired? – Kilisi Jun 8 '20 at 9:26
  • 5
    Why should you be taking any steps? – Tymoteusz Paul Jun 8 '20 at 9:30
  • 3
    What is role at your current company? The answer is going to vary a lot if you're a junior software developer or if you're the compliance officer. – Philip Kendall Jun 8 '20 at 9:36
  • 1
    The certification was taken at the beginning of the previous month, according to the date on the cert, the name and number produces invalid certificate. The supplier is using it to justify that they have the capability to do the work required. My role is as senior architect responsible for the platform. – Ourjamie Jun 8 '20 at 11:01
  • 3
    Can you contact the issuing entity and double-check? If it's from just a month ago it may not have been processed online yet. You want to be 100% sure before accusing someone of fraud, which that would be. – Tymoteusz Paul Jun 8 '20 at 14:20
4

There are several independent aspects here:

  • Does the person have the knowledge which he/she claimed to have (e.g. certificate is outdated, but work experience is there)
  • Did he/she commit fraud or falsify the document in the strict sense?
  • Is there an (direct or indirect) regulation which actually requires you to have only people with this certificate on this position; (an example would be that your company established this as a requirement to fulfill legal requirements, and that the legal requirements require to take action in case of a - potentially self defined - non conformity)

If only the first point applies, then it depends on your relationship with the supplier and potentially the employee. I am a technical team lead and if something like this would happen, i would greatly appreciate if I get an informal notification from my customers in case something like this is discovered - could be anything from intentionally deceiving the employer to an administrative error (sending an old certification).

If you believe that the second point is true, revoke all access of the employee to critical systems immediately. If you trust the manager, call the manager first, if you don't trust her/him, revoke the access of all of the employers employees and ask the next level representative of the supplier to come in personally. Have your legal department involved immediately.

If you need to this to keep your own regulations, then seek for clarification and ask for the supplier delivering a valid certificate.

Improve this answer
2
  • Presently, the information I have point to the second point, because I could not support this supplier taking over the platform as I did not feel they had the skills necessary. This certificate has now been produced to show that the supplier has the expertise necessary.This cert has been supplied to the management layer above mine who have accepted it without verification – Ourjamie Jun 8 '20 at 11:14
  • I once worked for an employer that faked an entire certification system for their employees, because they refused to pay for it, and it was at most a formality between that employer and their customers was never verified officially by anyone....until the customer i worked for was audited, found my certificate was fraudulent, which thankfully they were kind enough to talk to me about how/where I got it...from my work...to find out they don‘t have the license or right to certify such things! Sooo maybe it‘s the employer doing shady things and not the employee... – morbo Jun 8 '20 at 15:57
3

You simply need to get in contact with them, explain the discrepancy, and ask for them to check the details.

The ball is in their court. They should then get into contact with the 3rd party certification authority to get this resolved, or supply an updated certificate.

You also need to write into the contract that the third party vendor will be held liable for any loss incurred due to misleading conduct. This is probably pretty standard terms in any case, but it may be worthwhile highlighting to them.

Improve this answer
1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .