4

I'm a software engineer in a large company. We are a small team and two of the other engineers have been friends since childhood and currently live together. They review each others work and provide feedback on each other.

One of them will typically make a change and the other will approve it. There is no jira, no planning and basically no oversight of what's happening. Nobody else on the team is consulted. We work in a highly regulated industry and I don't think they should be on the same team but management are aware of their friendship and that they live together but seem OK about it.

Is this something that should be raised with compliance or do I just have to accept it?

Edit: Thanks for the comments. This is the financial industry, specifically the stock market. It's highly regulated and every change is supposed to be controlled and properly scrutinised.

Improve this question
10
  • 2
    Is there a reason you think this is in some way violating company policy or regulatory authority? If not, this isn't your battle to fight. If management have given the OK to it, that's all you need to know. The only reason to fight it is if you know (not suspect) that there's something shady going on that either management don't know about, or that puts the company or yourself at risk legally.
    – Xono
    Jun 29, 2021 at 10:13
  • Is the issue to you the lack of oversight/paper trail with them not documenting stuff and just doing it between them? This does fail the "hit by a bus" test
    – R Davies
    Jun 29, 2021 at 10:16
  • 1
    You ask if it should be raised with compliance, do you have any reason to suspect there is some sort of compliance breach? Does the associated regulations mandate Jira tickets or discussing things with every team member?
    – Gregory Currie
    Jun 29, 2021 at 11:35
  • 1
    How that is different from the same set of people seating in the same office and doing exactly the same? Consider to edit to clarify what exactly is your concern.
    – Alexei Levenkov
    Jun 29, 2021 at 20:24
  • 1
    @Amanda So one person can approve another’s changes and have them put into production with no other controls? Why would that only be a problem if those two people were known to be friends? That’s an situation that can be abused by anyone.
    – ColleenV
    Jun 30, 2021 at 14:24

6 Answers 6

Reset to default
14

do I just have to accept it?

You don't have to do anything, it's not your problem if it's even a problem.

Highly regulated industries and compliance have very clear rules on what is and isn't allowed. They also have compliance officers whose role it is to be both aware of all the rules and implications and resolve any issues.

Improve this answer
1
  • 5
    These companies will often also have policies in place about how employees should act if they witness a compliance breach. Not saying that's the case here, or there is even a compliance breach to begin with, but seeing someone breach compliance and knowingly do nothing can get you into hot water.
    – Gregory Currie
    Jun 29, 2021 at 11:32
10

I think you MIGHT have a problem in there, but not the question as you asked.

Your problem might be that there is a part of the team that is doing work without the rest of the team. Which may impact your own work.

If it doesn't impact your work, then you don't have a problem, move on.

If it does then this should be first brought to the team and to the manager only if you can't solve it.

Remember, your problem is not that they're friend living together. Your problem is how the current organization of the team is impacting your own capability to do your part of the job.

Improve this answer
1
  • 1
    "I think you MIGHT have a problem in there, but not the question as you asked." well spotted!
    – iLuvLogix
    Jun 29, 2021 at 11:54
4

To your question specifically, the fact that they're living together, or friends, has nothing to do with their job performance

It's possible they may be violating company policy by not managing their changes through a proper change control process...

However! As someone who has worked at many regulated orgs.... It is sometimes amazing what they decide isn't necessary for change control.

It's entirely possible their manager is aware, and even allowed the work they're doing outside of the change process, if he believed it was minor and wouldn't be of any impact....

I've seen org's with very different definition of what constitutes a 'change', as far as they are worried about.

Now, what I would recommend you do:

  • Completely ignore the fact that they live together or are friends. This is useless information to you or anyone else.
  • If a change is made to a production environment that causes an issue, very delicately ask if it went through a change control review meeting, where people could have been aware that a change to this system was being made.

-- That's really the end of it. The business will sort itself out from there... and if not, it's really not your responsibility / job to spend any time on it.

If it causes any kinds of issues or delays or irritation for you - very politely let your manager know / keep them aware that something has happened that has impacted you, with this system. Really, the fact that a change control wasn't made isn't that relevant to the communication with your manager.... The responsibility on that one will be overviewed more by those employees direct manager and then the person above them

You mention that one person will make a change and the other will approve it - If this is the company policy, that only one other person has to have a set of eyes on it, then theoretically there is nothing 'wrong' with this. If issues arise from this, I would maybe raise to your manager that you'd like more stringent requirements on who can approve change requests.... But if the policy is written that loosely as is, and they're technically following it, the fact that they're buddies doesn't change that they are correctly fulfilling the policy... and businesses don't change these processes often at all... Mostly because if any tweak to the process is suggested, all of the directors and VP's will sit in a room rethinking the entire process and get nowhere after dozens of meetings

Improve this answer
0
2

You should not approach this as a problem caused by the coworkers being friends. I have worked in the financial industry and I understand your worries about the situation. If they mess up, they could end the company and someone could possibly go to jail even if it wasn’t malicious.

If you approach this as a problem caused by your coworkers being friends, you’re basically accusing them of not being able to behave professionally, and since your management has already said the arrangement is OK, you’re implying that they are complicit.

You should approach this as a process problem. If there is an audit, there needs to be documentation that the processes in place to safeguard people’s privacy and prevent insider trading, etc. were followed. If you see a risk that your team could fail an audit, you need to escalate that to your management.

Thinking about ways to improve your team’s processes to mitigate risk is more constructive than worrying about the living arrangements of your coworkers. Bringing a proposal to improve some of the team’s processes to management demonstrates that you are thoughtful and proactive. Complaining about how friendly your coworkers are makes you look like the problem.

Improve this answer
1
  • +1 , surprised there are no upvotes so far on your answer. There is potential of insider trading, segregation of duties violation leading to collusion , fraud, theft etc. Putting in controls to mitigate the risks is the absolute correct way to go
    – Anthony
    Jul 2, 2021 at 13:59
1

I think that without knowing exactly which industry you are working in and which company no-one here can you give you useful advice whether this is something that you should report to compliance.

However I do think it's quite peculiar that if code-reviews are held within your team those two exclusively review each other's work. one of the ideas behind code-reviews is that work is judged by multiple persons in order to add one or more other perspectives. Why limit yourself to always the same other perspective? Another member of the team might have an insight or know something neither of them does.

Improve this answer
1

If you want to change the dynamic without making is a personal issue, in your team meeting, you could consider asking about TDD/BDD style practices. That could change the nature of peer-reviews and improve what you're hinting as low-quality practices.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .