As a director or manager in a company, what do you do when you're told by higher-ups, like the CFO or CEO, to grant elevated privileges or remove security protections without written documentation? I've always believed that it's essential to have these directives in writing for the sake of compliance, auditing, and risk management. However, I faced a challenging situation today where I was told that requesting written directions made it seem like I was trying to avoid responsibility if things went wrong. They insisted that I should just comply with their verbal requests. I understand the importance of creating records, especially to avoid potential legal ramifications later on if something goes awry, and now I'm questioning whether I'm justified in my concerns. I'm reaching out for insights, especially from those with legal know-how in similar situations.
4 Answers
Always document your actions, especially in risky situations! If they refuse to put their requests in writing, consider it suspicious. Sending an email to confirm what they asked not only covers you legally but signals that you’re aware of the potential issues.
If they can’t give you written directives for actions that seem shady, they probably know it’s against policy. If I were in your shoes, I'd follow their instructions but also send a quick note to their boss. Just a confirmation like, "As per the directive, I’ve elevated privileges for X as discussed." This keeps a record and might make them think twice.
Definitely cover yourself! Send them an email stating what they want you to do. Something like, "Hey, just to recap our chat, you want me to give X super admin rights, including changing security settings and so forth. Please confirm this is correct before I proceed." This way, you have a record.
It's crucial to get everything in writing, no matter who asks. If they can't provide a written directive, that’s a big red flag. I’d recommend emailing them to confirm their request, including their supervisor in the email. It shows you are documenting the exemption process, which is necessary for your protection.
Related Questions
Can't Load PhpMyadmin On After Server Update
Redirect www to non-www in Apache Conf
How To Check If Your SSL Cert Is SHA 1
Windows TrackPad Gestures