Prevention is better than cure

10 February 2006

When staff are accused of accessing Internet pornography, an organisation must make sure that it deals with the incident by the book, says Morgan Cole's Robin Graham.

Imagine the scenario. 'Mr X' is the sales director of a major multinational company. He has worked there for decades and his disciplinary record is exemplary. He is in his late fifties and enjoys his job so much that he plans to work until he is 65, when he will qualify for a full pension.

But during a routine audit, the systems administrator discovers evidence that pornographic web sites have been accessed from Mr X's PC. He passes this information on to the personnel manager.

The company has an acceptable use policy (AUP) which clearly classifies the accessing of Internet pornography as gross misconduct. However, the AUP has only recently been drafted and has only been distributed to new employees. Mr X has never even seen it.

The personnel manager nevertheless decides to dismiss Mr X immediately on the grounds of gross misconduct, even though in a similar incident earlier in the year, the managing director was only given a formal written warning.

Unfair dismissal?

It is highly likely that a tribunal would find the dismissal to be unfair. Although the company's AUP does classify accessing pornography as gross misconduct, Mr X had not seen the policy because the company had made no effort to circulate it to all employees.

Furthermore, the company did not apply the AUP consistently. When the managing director was caught for the same offence, he was only given a written warning. The tribunal would further take into account Mr X's unblemished record when deciding whether the decision to dismiss him was reasonable.

Finally, of course, there is the question of proof. Can the organisation be sure that it was X who accessed the sites in question and not, for example, someone else using his PC when he was out of the office, or that the evidence was not the result of a spam email inadvertently opened by X?

Damage assessment

All businesses can be subject to unfair dismissal claims and companies often underestimate how much they can cost. The tribunal award alone could be as high as £7,800 for the basic award and GBP53,500 for the compensatory award. It could be even higher if the claim involves race, sex or disability discrimination.

In addition, and something that is often overlooked, are the losses in terms of staff time. A Morgan Cole survey found that an average unfair dismissal claim took around £2,000 worth of personnel department time; £2,000 worth of IT time; and a worrying £10,000 worth of management time.

Add to this related public relations consultancy fees of £10,000 and legal fees that could be as much as £20,000, and the total figure could eventually be as high as £100,000.

Limiting the risks

So how could the company have limited its exposure? Such a situation could have been avoided if the company had:

Implemented an up-to-date AUP that clearly stated what personal use of computer equipment was permissible and what materials were unacceptable for accessing, downloading and circulating. The clearer the policy, the more likely it is that an employee will read it, understand it and stick to it.

Circulated the AUP each time it was updated to all of its employees. There is no point in having a policy that is kept from the employees who are supposed to adhere to it. If you intend to rely on the policy for the purposes of taking disciplinary action or, if it comes to it, at the Employment Tribunal, it is essential that you can say that the employee was aware of the policy and any changes that have been made to it.

Consistently applied the AUP and taken disciplinary action as set out in the policy. If an employee is dismissed for behaviour that he or she knows another employee was not dismissed for, it is easy to argue that the behaviour was not against company policy as the company was aware of and had allowed such behaviour in the past and pursued a different course of action.

Implemented web filtering software so that employees were not able to access sites that contain inappropriate material.

Implemented content filtering software, which would have prevented the material from entering the organisation via incoming emails and also prevent the circulation of inappropriate materials within the organisation.

As is often the case, the cost of dealing with a claim far outweighs the cost of designing and implementing a constantly updated acceptable use policy along with the software. So in this case the old cliche is true - prevention is better than cure.

Information Age: News, analysis & insight for IT & business leaders