Compliance Overrides

Context

Temporary and contract staffing businesses have a duty of care to their clients to ensure that the workers that they place are fully compliant. This includes such things as background checks, certificates and qualifications, and rights to work, and the requirements can vary between sectors dramatically. In itris, there are two modes for compliance — Informational or Preventative, and there became a need to introduce the ability for users to override preventative compliance requirements.

I collaborated with the product and development teams to reach an elegant solution.

Problem

There is no middle ground for compliance in itris, and that was intentional — it either stops a user from placing or extending a non-compliant candidate, or it is allowed, and the compliance status is highlighted to the user. However, some customers wanted to confirm placements far in advance, where compliance requirements wouldn't be satisfied initially, but would be in place before the start date.

This was particularly the case with the education sector, where teachers were placed at schools for the following school year far in advance of the start date. Customers still wanted compliance to be preventative, but needed to be able to create placement records to be able to invoice their clients and in its current state, this was causing customers to use inefficient workarounds.

Goals

Research

After collating feedback from customers, I noticed 3 categories of requests:

1. A manager typing a password in at their computer — This is prone to exploitation and doesn't scale effectively for hybrid or remote teams.
2. A hybrid between preventative and information compliance — Given the sensitive, business critical nature of compliance, we intentionally wanted the options to be strictly on or off, and we didn't want to blur the lines.
3. Draft placements — We had considered this as part of a wider initiative, but this would have significantly increased the scope of the project, which we didn't have the appetite for at the time.

These categories addressed specific customers' needs, but we needed to keep the broader customer-base in mind. However, the idea of a password entered to override compliance was a thread I wanted to pull on a little more.

Solution

The trouble with a password is that if a user sees that password as someone is typing it in, they can use it again and again with no ramifications. But it got me thinking about a common pattern seen in modern software, which is 2-Factor Authentication. What if we could use something along the lines of a one time passcode to safely allow compliance requirements to be overridden?

After meetings with the product team and developers, we decided on a direction and implemented a method for privileged users to generate unique, time-based codes to override compliance restrictions. This also included an audit trail of when compliance was overridden and who the code was issued by.

Crucially, overriding compliance did not mean that the candidate was marked as compliant; they were still non-compliant and would still be highlighted in compliance reports. However, users were unblocked and the placement could be created.

Outcome

Within a month of this improvement being released, one customer on an older version upgraded with a contractual value of over £150k. They were initially not prepared to upgrade without this feature. We were also confident that the outcome of this project would improve customer retention and cover the potential loss of revenue.