How to ask boss for written authorization to violate a strict company policy?

Question

My manager has asked me to violate a company policy that they disagree with. The policy is very strict and violating it normally is considered gross misconduct. The policy is for security and violating it puts the organisation at risk. I would not be comfortable doing what my managers asks even without this policy.

This has put me in an awkward situation, I want to ask my manager for written authorization to violate the policy to carry out this request.

My two concerns are

1. My manager does not have the authority to authorize such a violation as the policy is coming from executive leadership.
2. If I push back and create problems, I'm worried about retaliation going forward.

This is in the UK. How should I deal with this?

Answer 1

Your boss is not going to give you a written authorization, so you will have to make a paper trail yourself. Assuming you are using email for communication, send an email like this:

Dear Boss,
As per our discussion this morning, I understand that you would like me to do X. Here is how I plan to work on it: Step A, Step B, Step C.

Please confirm if my understanding is correct and if it is okay to proceed in this manner.

Now your boss will certainly not "confirm" this, so you can put this on hold indefinitely. You are not disobeying your boss, just waiting for his "confirmation".

Your boss' response to this can range from dropping the idea to figuring out other ways to get you fired. Depending on how strongly your boss feels about it, it may be prudent to start looking for a new job.

Answer 2

This is easy. Your security team should be able to provide you with a Security Policy Exception. The general form of a security policy exception is:

• The name of the policy being excepted
• The way in which the policy will be violated
• The business justification or business case
• The date that the policy will be complied with (i.e. expiration of the exception)

Example:

I would like to request a security policy exception for 30 days, disabling my anti-virus.

• Policy: Employee Computing Equipment Policy 2017
• Exception: I would like to disable my anti-virus software
• Justification: I am a technology journalist and I am researching the efficacy of AV and also the risk exposure of users who violate commonly accepted security practices. I would like to document what happens in my day to day job for 30 days, using a computing device for work without AV protection.
• Beginning: 2017-10-01
• Expiring: 2017-10-31

In the above case, I would expect the security team to either say "not approved"; or to work out with the requestor how to safely set up a sandbox or honeypot environment to obtain a similar result for the research project.

And finally, if your security team is not able to provide you with one of these... then you are not working for an organisation wth a functional security team.

Answer 3

To be honest, I would just tell my boss that this seems to be against company policy, and that given this fact, I would like to ask him to give me written authorization before I move forward.

He can't sensibly deny your request. So the only reason you wouldn't do this is if you can't even bring yourself to tell him this violates company policy. If you can't, then either that's just something you need to practice, or you need to look for a new job where you might be more comfortable telling your boss obvious facts.

Answer 4

The question doesn't say whether it's clear that the manager knows that this is a bad idea and that it violates policy. If I were the manager, I would want you to start by giving me this information.

Step 1. Send your boss an email saying something like this: "Dear Boss, I don't think we can do it this way. You might not be familiar with Company Policy 42, which we'd be violating. Instead, maybe we could..."

Even if he does already know this, but all previous communications have been oral, do this anyway. It establishes a record where you are acting reasonable and responsible, and it it also gives him an out, if he wants it.

Step 2. Reading between the lines, it seems like you have serious concerns about this manager's ethics and competence (e.g., you express serious concerns about retribution). Think about quitting, or if that's not feasible, maybe you could get a transfer.

If a resignation or transfer aren't options, or will come too late, don't just try to get a CYA email from your boss and then proceed. You've expressed clearly that that would be unethical, and in any case it doesn't necessarily protect you, because, as you say, your boss doesn't have the authority to override the policy.

Step 3. Send your boss an email like this: "Dear Boss, It sounds like you think that Policy 42 is a bad policy, or that an exception needs to be made in this situation. That kind of policy decision is way above my pay grade. Could you consult with higher-ups about this?" Simultaneously open a conversation with HR and supply them with copies of the two emails.

Answer 5

Your manager has asked. You don't need to push back, but you could tell him that you'd feel unconfortable doing what he asks, and that you'd like to be on the safe side about it by having a written confirmation from his side. You can tell him plain and simple that you fear being accused of misconduct and eventually fired, which you can't risk. Try to put him in your shoes, this should work.

Answer 6

People very regularly downplay the importance of security, usually under the influence of the Dunning–Kruger effect. This can have catastrophic consequences for customers but also for the company. If you are very good at explaining your case and they are capable of understanding and objectively evaluating it, they may change their mind. But it is likely that this will polarise them against your position. Instead, consider that your boss has already shown a disregard for the rules which were put in place and enforced by higher-ups, so for your purposes you can consider the rules to have been broken already.

If you have a paper trail of this you should therefore bring it up with the executives in person, in a neutral, "could you please advise on this situation", tone. If you do not have any proof then it is quite possible that your boss will refuse to give you anything in writing, to cover themselves. If so they will either laugh it off or go ballistic, telling you to do your job without questioning them at every corner. In this latter situation I'm afraid the only recourse you have is to stall or refuse, and then look for another job, because you don't want to have a security breach to your name.

Answer 7

So, a few things to consider.

1. Your employment contract is between you and the company, not you and the manager. If you violate company policy your manager can't save you - he'll most likely be in the soup line with you.
2. Whether you have a job tomorrow or not is entirely out of your control. All you can control is your actions. If you find yourself jobless do you want your reference to be "Tim is a coward that I'd never hire again." or "Tim is a standup guy full of integrity. I'd work with him anywhere.".
3. Sometimes companies conduct loyalty tests.

Answer 8

Cover yourself, either ask for written authorisation which may result in a personal visit instead. Or just do it and confirm via email that you actioned such and such as requested.

At the end of the day it will fall back on the manager, not you. I'd actually go the latter route because I have to assume my manager knows what he/she is doing and is allowed to, and I'm just not privy to all the info concerning it. If they're not, I don't care, I'll apply for their job when they get the boot.

Answer 9

one thing to consider, usually companies have a code of conduct that supersedes your line managers orders. Violating the code of conduct is often deemed to be grounds for dismissal whether or not you get an approval from your manager in writing. Keep in mind that even if you get a cya from your boss you won't be immune to repercussions should this action be discovered in an audit or review, especially if you already know you are violating company policy. If your company has an ethics officer (probably depends on the industry) I would strongly advise approaching them with this situation. Remember with security issues, company brand can be at risk and the stakes are high if something goes wrong.

Answer 10

I believe in communication directly with the person at hand. If one goes asking other people or departments that oversee these things, than that alone can come across as somewhat deceitful or simple put, going behind their back.

I, personally, would simply share my thoughts. Tell the person, you are my boss and I find it an honor when you entrust me with responsibilities. I do not disregard or undermine your orders as you have been placed with the given authority. My concern, in this case is X,Y, and Z and is not related to whom the request comes from. I honor you and your employment and would not want to jeopardize your reputation or my ability to keep your trust. I have not spoken to co-workers about this and look to you for guidance as with many other work related situations.

In short, I believe in giving people a chance first. Then if it goes sour, you know in your heart you did the right thing and you can take the next step from there, if need be.

Showing concern for people, usually comes back with favor.

Answer 11

Not mentioned previously, if you are in a casual work environment, consider asking your boss's boss in the hallway if these actions are ok. Some work environments are ok with this sort of "going over the head of your boss" type of thing. (Some are not).

Answer 12

Zugzwang: https://en.wikipedia.org/wiki/Zugzwang

Zugzwang (German for "compulsion to move", pronounced [ˈtsuːktsvaŋ]) is a situation found in chess and other games wherein one player is put at a disadvantage because they must make a move when they would prefer to pass and not move.

Probably, if you do as you're asked, you'll be fired for violating company policy. If you don't, you'll be fired for insubordination.

Just quit.