This summer when I was an intern there was a
clear triangle arrangement between the company I worked for and the client. I
worked for a consulting company, so each project employees had to answer to
their project manager as well as the client. It is important to make the
client happy because they ultimately hired the consulting firm, but in the long
run it is also important to please the project manager. The project manager is
someone who you work with from project to project and they ultimately decide your
compensation and any possibility of promotions.
I was only an intern for ten weeks, and I never
had any direct contact with the client; however, every week I sat in internal
calls as well as weekly calls with the client. Most of these calls were simply
status updates and nothing eventful happened. When I was first brought in, it
was clear the client was very concerned with the security of their data. The
client was a large insurance firm, so it is fitting that they are so risk
averse. Each full time employee on the project had two laptops, one from the
client and their typical work laptop. The client wanted to keep any project
data on their specific laptops; this meant that consultants shouldn’t have
anything related to the project on their company laptops. During one of the
meetings with the client and all the managers, it became clear that this rule
wasn’t followed by everyone. One of the project managers started off the phone
call by restating this policy and how it is important that everyone follows it.
There was no direct threat of any kind of punishment, but her tone was strict
and to the point. After briefly discussing this and answering a few questions,
she moved the meeting forward. This wasn’t spoken about again till the next day
during our weekly internal meeting. It is possible that the project manager
individually spoke to employees who mishandled data after the meeting, but the
next time I heard about it was the following day. Up until the internal
meeting, I was anxious to see what was going to happen. There were no direct
repercussions stated, but the project managers tone was strict and to the
point.
During our internal company meeting, the project
manager started off with a much softer tone. She reiterated the importance of
ensuring the client’s data stays on the client’s laptops, but she also said how
this policy can be annoying and seemed a bit too strict. There wasn’t any sense
that there would be some kind of punishment for those who broke the policy.
Even though at the root the message was the same, we should do our best to
follow the data management policy, after the internal meeting the takeaway
seemed to be more positive. It seemed like it would be just a small bump in the
road, and the consultants and the clients could move on with the project. I was
only an intern for a couple weeks after this situation, but it was never
mentioned again and ultimately was just a small hiccup.
From my short and singular experience, it seems
as though in the short run the client has more say, but in the long run the
consulting company has the ultimate say. A client may make work difficult
during the project, but if the project is completed in a satisfactory manner,
employees have nothing to worry about. This seems to make sense because the
consulting company hires workers for extended periods of time and the client
only has control over the consultants during their project.
On the practicalities of the story you told, it would have helped me to understand how the client would learn that there was a security breach. It would also help to understand if this client was unique in its request or if other clients had similar issues about data security. My sense of things is that yes, big companies should be very concerned about the data security of their customer information. A breach is a way to lose a lot of business. But, truthfully, I didn't understand how the consultants using different laptops would address this issue. In other words, how did the client's data get onto those laptops. It would have been helpful to understand that.
ReplyDeleteIf I'm understanding things, the consultant were more familiar with the regular laptops so could do the work faster using their regular computer. Doing what the client wanted amounted to creating some incovenience for the consultant. Normally, such inconvenience has some opportunity cost associated with it. To fully explain the triangle issue here, you should explain what that inconvenience is. For example, if consultants were evaluated by the volume of work they completed and if using the client's laptop made them work slower, then it would seem to make the consultant productivity go down. In this case, the project manager might want to have it both ways. That's an issue.
Data security is one of those things where there may not seem to be any problem at all and then, all of a sudden, there is a big problem. That "non-convexity" makes it harder to manage when the issue amounts to the discretion of the consultants. That's why it seemed such an odd solution to me.