Higher up doesn't carry around their security badge and asks others to let them in. What should I do about this security issue?

Question

Every six months or so, we have to take an online security course that includes training on the security badges we carry around. Basically, our company assigns each employee a security badge, which is needed to get into office areas. We are instructed to not allow others to "piggyback" (i.e. going through a door after someone else uses a badge to open it), or to allow someone in who is waiting for a person with a badge to walk by.

However, the vice president for our division frequently chooses not to carry around her security badge. On a regular basis, she either piggybacks or asks someone to open a door for her if she walks by. She seems to rely on the fact that people know who she is, and the only person I've known who challenged her on this was someone who didn't know who she was (she later joked about this event, saying that she just needs to get to know more people). To my knowledge, this vice president is the only person who regularly flouts the security badge rules.

I am concerned about this double standard in company security. This is the boss of my boss, so I don't have an easy avenue to report this. What should I do?

Edit: To answer some of the comments, this does not appear to be a test where the vice president is just pretending to not have her security badge and anyone who lets her in fails. She does not have her badge on her and anyone who lets her in is politely thanked, with no consequences of any sort ever occurring. It seems that she is genuinely wanting someone to let her in without a badge.

Answer 1

You have a VERY easy avenue to report this: the company Chief of Security.

Dressing down employees for flouting the security rules is specifically in the Chief of Security's job description. It does not matter whether the employee in question is the lowliest janitor or the Chairman, CEO, and President of the company, or anywhere in between.

Answer 2

Well, if the company offered you the security course, they should also have provided you with contacts in case of security breaches.

Report her to your contacts and let them take it from there. Assume (correctly) that they are professionals, let them do their job her, step back from the affray and the flying feathers and focus on looking photogenic :)

Your department or group should be getting a memo from Security reiterating their policy and you know what - just comply with the policy! She'll get her butt burned a couple of times but eventually, she'll settle down into compliance - I am assuming here that she is a totally sane individual who keeps doing what she is doing until she stops getting away with it :)

Answer 3

This is wrong and a poor example for others but it is just plain above your pay grade.

Clearly other people have noticed this including your boss.

You could ask your boss what you should do but I bet he/she will say let it go.

If you have security training then you should have procedure for reporting a security breach. Not sure I would do it but it is an option for you.

Answer 4

I am concerned about this double standard in company security.

Think for a minute why you are concerned here.

• Because everyone should live by the same rules no matter who they are?
• Because this Vice President is a security risk?
• Because I hate this rule, and if I must obey a foolish rule, everyone must?
• Because I follow every process rule to the letter every time?

Then realize that "double standards" like this happen in every company. Everyone in a company is not equal. Maybe you'd be better off just letting this one go, and save your concern for more important matters.

I work in a company with similar security rules. The rules may make sense for headquarters, but in my small office, they really don't. Lots of folks "tailgate" or knock to be buzzed in. It's just not that big of a deal.

I simply won't damage my work relationship with others by being the "badge police". Nor will I accost someone who is walking around without visibly displaying their badge.

This is the boss of my boss, so I don't have an easy avenue to report this. What should I do?

If you really want to pursue it, you should have a chat with your boss. Explain what you see happening, and ask for guidance as to how you should handle it. I'd guess that you'll be told to just let it go, but anything is possible.

Remember that this could not only reflect on you, but also on your boss. You probably don't want to put your boss in a tough spot without at least talking it through.

Answer 5

There is no question here - you must report this. I'll tell you why.

• As @Closetnoc said, if you let in someone who looks like the VP and theft occurs, who will be held responsible? You let them in.
• If the VP is fired and you don't know about it and let them in, who will be held responsible? You let them in.
• If an audit is carried out on security policy, and you let them in, who will be held responsible? You broke policy.

I have seen all of these happen to others.

From a very basic level, you need to protect yourself and your organisation here. Reporting them, or even better, disallowing entry, is the right thing to do, and has the backing of policy - so if it does go to HR or Security Officer then you are in the right.

I have in the past disallowed access to senior partners and even board members as they didn't have passes. Sure, they got annoyed but that is their problem. They ended up realising that I was protecting them as well as myself.

Answer 6

I would not report this to a person directly; that's an avenue for trouble as it won't necessarily be anonymous.

Instead, find your company's anonymous ethics hotline. They should have one if they're of the size you're suggesting; call it in there. It should be staffed by non-employees (some hired company that just does ethics lines or similar) and entirely take you out of the loop.

Otherwise, I'd say it sounds like this behavior is well known enough that reporting it yourself is just adding risk for you; if the head of ISO or similar group doesn't already know of the issue, they're really not doing their job.

Answer 7

It feels unfair, but that's not really the problem. The problem is that the company (as represented by the senior exec's preference) appears to allow "human recognition" as a security validation, but doesn't have a clear policy that describes how to do it.

So your action can be to address the security issue with whoever makes security policy, with a request like this:

Currently there is a convention that senior staff are permitted to enter without badges. This is difficult to manage for new security staff and allows for confident tricksters to gain entry based on bluff. Can we start a photobook or photo wall of senior executives who will be entering without identification, so that security staff can have clarity about who is or is not permitted to enter without a badge.

The result might be that you get photocopies of half a dozen executive ID cards up on the wall, or maybe senior execs start carrying badges, but either way you're able to raise the issue without having to call shenanigans on an executive.

Answer 8

I think I would bring the problem directly to her attention, the next time it happens to me. "Ma'am, I can't do that; it would be a violation of our corporate security policy. Perhaps you could have someone bring your badge down to you." I'd say it quietly, so as not to put her on the spot. I'd try to be as helpful and sympathetic as I could be, without violating policy. I'm not trying to make trouble for anyone; I'm trying to prevent it.

Answer 9

I will begin by telling a short story.

Once a member of a management team was let go early in the morning and no e-mail was sent except to a few that would be directly affected. Later in the afternoon, the fired employee walked into the company as easily as they ever had and was able to get into secured areas and do damage without a trace of responsibility. The police could do virtually nothing.

The fact that someone routinely forgets their badge may come by honestly. At one place where the company was located in several buildings up and down the street, it was not that uncommon for one of us to forget their badge and need help. All well and good. However, routinely forgetting their badge may be a simple form of narcissism even if it does not seem to be. It could be a lighter form of "the rules are... [fill in the blank]" just in the same way anyone up and down the chain of command may feel. I have seen very good people fall into this category without realizing it. It does not mean that they necessarily feel superior. It actually becomes a habit that is enabled over time by being recognized and not realizing the effect of not following the rules as closely as everyone else.

Forgetting fairness for a moment since too many of us seek a fairer world that will never be, what is important is that it is bothersome regardless of how slight the offense may actually be.

For this reason, the problem should be resolved.

If you can talk frankly and openly with your own boss without judgement or reprisal, then I suggest that you say little, but say enough. Nobody likes a tattle-tale, so avoid it as much as possible while adding respect for all concerned. For example,

I have noticed that a member of management, I will not say who because I believe that they genuinely mean no harm, forgets their badge quite a lot and requires someone to let them into secure areas. While this is completely understandable from time to time, if I let them into the secure area and something were to go wrong, then it is I who is looked upon as being responsible. Can you keep an eye out and see if you can rectify the problem so that we as a team can feel better about the problem? Thanks!

If you cannot trust your boss, then same speech can be given to HR or security. By couching it in the way you have, people will understand the problem and hopefully protect you as a genuinely concerned member of a corporate team. You may want to ask to remain anonymous as not to embarrass anyone.

To add some humor to this answer, the company that was located in several buildings up and down the street bought a huge building, refit it, and during the process, in the IT areas, the instruction was to place magnetic badge readers about butt level. This was questioned by our contractor as a mistake. It was no mistake. Why? If you place the badge in your other pocket, opposite from your wallet, then all you have to is wag your butt near the reader and forgetting your badge far less likely. It was a perfect solution for the IT team (at least)!

Answer 10

In addition to the other answers to anonymously report to the security division, I want to suggest how to handle it if and when you specifically are asked to swipe her through somewhere.

This may be different in your institution, but where I work, the security people take security very seriously. If anyone were to swipe anyone else through they would both face a significant financial penalty and would also likely be let go and perhaps face criminal charges. I would recommend that if you are asked, politely decline, and be as assertive as the situation requires. If you hurt her feelings she may try to get back at you via office politics but (again, this depends on your institution), if you directly violate the written security policy and someone in security finds out, or if something happens, you will be on the hook for it. Be careful, polite, and stick to written policy.

Answer 11

I understand your concern for security and unhappiness with this double-standard, but you won't be telling anyone anything they don't already know.

You have a fairly sophisticated security system, company training program and a person who is in charge. It's not difficult for them to determine that someone who should be entering the office on a regular basis is not using their card to get into the building.

If they are not aware of this, your company has bigger problems. My guess is they just don't care enough about this individual's behavior or they're not in power to do anything about it.

Sorry.

Answer 12

I used to be the security officer (amongst other things) for a medium sized company with several offices. The top management not only did as your VP does, but lost their access cards/badges and refused to pay the replacement fee, etc.

It is an ego thing for them. "Don't you know who I am?" dynamic. By flouting the rules they distinguish themselves from the "workers".

As annoying at it is, challenging such behaviour is an office politics risk and besides, have a look at whose signature is on your paycheck.

Golden Rule: "They who have the gold make the rules."

Answer 13

I am concerned about this double standard in company security. This is the boss of my boss, so I don't have an easy avenue to report this. What should I do?

Is it really a concern for you? That someone should be thinking about this event not you. Yes that is double standard, but world is not perfect place. You need to learn to strike the balance in your life. It's not her but you who need to learn the way the world moves. Why should you be the one to report this incident, when all other took it lightly or pretended so at least. Do you really think all others are fool? May be but it's better to be a fool and be in herd than be alone fight the whole world. Trust me you will find such people every now and then in every company. You cannot escape so learn to live in it without harming others. That VP was given a chance to understand but she chose otherwise and instead made fun of that someone, that shows she is not thinking straight and its worthless to make such people understand. It could backfire though so its always a good idea to step aside from their path as they cannot see straight, do not be a revolutionist. Learn to be a ordinary guy. Live and let live.