WO1999036874A1

WO1999036874A1 - Method and means of testing

Info

Publication number: WO1999036874A1
Application number: PCT/GB1998/000097
Authority: WO
Inventors: Nicholas Dominic Mann
Original assignee: Praesidium Services Limited
Priority date: 1998-01-13
Filing date: 1998-01-13
Publication date: 1999-07-22
Also published as: AU5568298A

Abstract

An overt method of testing individuals to measure potential security risk when performing a job, the method comprising the step of forming a measure of the risk associated with the job by giving a positive weighting to one or more factors selected from availability of material or sensitive information, jobs in which collaboration with no or few others would be necessary to perpetrate a security breach, jobs in which breach of security, if attempted, would not easily be detected, and jobs in which breach of security, if attempted, would not be quickly detected. Then the identity of the individual is confirmed and a measure of the potential motivation of the individual to pose a security risk as a positive weighting is given to desire for wealth, need for wealth, disenchantment, fear of exposure and other potential personal gain. Further, a measure of the subject's history as a positive weighting is given to one or more factors selected from involvement in a series of unexplained previous events in which the individual is a common denominator, reluctance to take holidays, tendency to be present at the work-place for unnecessarily long periods, tendency to secrecy, tendency to refusal to delegate, opulent lifestyle including any one or more of expensive vehicle, lavish social life, expensive holidays and child undergoing expensive education, colleagues reluctance to work with individuals, refusal of some clients to deal with employees other than individual or vice versa, and failure to apply approved operating procedures. Finally the identity of at least one referee is confirmed, the individual is confronted with relevant risk factors or discrepancies noted in previous steps and the identified risks are evaluated.

Description

METHOD AND MEANS OF TESTING

This invention relates to a method and means for testing individuals for example for assessing suitability for employment.

While it is impossible to be certain of the true amount it has been estimated that in Western Europe and North America staff are involved in about 75% of all company fraud. It would therefore be imagined that a great deal of care would be taken in screening employees and candidates. In fact very little, generally, occurs. In most countries including the UK and USA employee security vetting tends to be non-existent or unlawful or perfunctory and thus unreliable.

The invention seeks to provide reliable and lawful employee security vetting. Security risk as used herein means, typically, the security of an organisation which is damaged whether or not fatally by the loss of material or information.

According to an aspect of the invention there is provided an overt method of testing individuals to measure potential security risk when performing a job, the method comprising the steps of: i. forming measure of the risk associated with the job by giving a positive weighting to one or more factors selected from: a) availability of material or sensitive information; b) jobs in which collaboration with no or few others would be necessary to perpetrate a security breach; c) jobs in which breach of secuπty, if attempted, would not easily be detected; and d) jobs in which breach of secuπty, if attempted, would not be quickly detected, ii. confirming the identity of the individual, iii. forming a measure of the potential motivation of the individual to pose a security risk a positive weighting being giving to: a) desire for wealth; b) need for wealth; c) disenchantment; d) fear of exposure; and e) other potential personal gain, iv. forming a measure of the subject's history a positive weighting being given to one or more factors selected from: a) involvement in a series of unexplained previous events in which the individual is a common denominator; b) reluctance to take holidays; c) tendency to be present at the work-place for unnecessarily long periods; d) tendency to secrecy; e) tendency to refuse to delegate; f) opulent lifestyle including any one or more of expensive vehicle, lavish social life, expensive holidays and child undergoing expensive education; g) colleagues reluctance to work with individuals; h) refusal of some clients to deal with employees other than individual or vice versa; and i) failure to apply approved operating procedures, v. confirming the identity of at least one referee, vi. confronting the individual with relevant risk factors or discrepancies noted in steps ii, iii, iv or v, and vii. evaluating the identified risks.

According to the invention there is provided means for overtly testing individuals to measure potential security risk when performing a job, comprising: i. means for measuring the risk associated with the job by giving a positive weighting to one or more factors selected from: a) availability of material or sensitive information; b) jobs in which collaboration with no or few others would be necessary to perpetrate a security breach; c) jobs in which breach of security, if attempted, would not easily be detected; and d) jobs in which breach of security, if attempted, would not be quickly detected, ii. means for confirming the identity of the individual, iii. means for forming a measure of the potential motivation of the individual to pose a security risk a positive weighting being giving to: a) desire for wealth; b) need for wealth; c) disenchantment; d) fear of exposure; and e) other potential personal gain, iv. means for forming measure of the subject's history a positive weighting being given to one or more factors selected from: a) involvement in a series of unexplained previous events in which the individual is a common denominator; b) reluctance to take holidays; c) tendency to be present at the work-place for unnecessarily long periods; d) tendency to secrecy; e) tendency to refuse to delegate; f) opulent lifestyle including any one or more of expensive vehicle, lavish social life, expensive holidays and child undergoing expensive education; g) colleagues reluctance to work with individuals; h) refusal of some clients to deal with employees other than individual or vice versa; and i) failure to apply approved operating procedures, v. means for confirming the identity of at least one referee, vi. means for confronting the individual with relevant risk factors or discrepancies noted in steps ii, iii, iv or v, and vii. means for evaluating the identified risks.

The invention is preferably used prior to offer of the job. The invention is preferably administered by others than the actual or prospective employers for example security professionals.

The invention can be used in the telecommunications industry, banking, computing, IT or in any employment situation.

Embodiments of the invention will be described by way of non-limiting example.

In a first step the risk associated with the post to be filled is assessed. High risk is associated with: i availability of sensitive information, examples include financial corporate/commercial, research and development and network/IT sectors, ii where collaboration with others is not necessary to perpetrate a fraud, iii if fraud is attempted few indicators would be visible or would only be visible after long periods of time.

It should be appreciated that high risk is not dependent on salary, or seniority. Thus, for example a secretary may be relatively lowly paid but having access to confidential information. Similarly the mere fact that a position is, or is not, temporary or contract based does not automatically render it high or low risk. Once the degree of risk has been assessed a profile of a suitable candidate can be drawn up. A low risk post can be acceptably filled by a candidate who would not be acceptable in a high risk post. Thus, tritely, if the item of greatest value obtainable is a pencil the risks are much less than in position where high value information could be obtained almost undetectably. Many people who could not reliably fill the second position could give admirable service in the former.

A feature of the invention is that the testing is overt which is to say that the individual is told, especially as fully as possible, of the test to which he is to be subjected. This is unusual. Hitherto there has been a reluctance to admit to such testing on the ground for example that the subject will take offence and seek employment with another, less suspicious, employer. Benefits accrue from making the testing overt. First the subject tends, in fact, to feel flattered that his job is so important that a security screen is deemed necessary. Secondly overt testing with the subject's full consent and participation is entirely legal whereas a covert test may not be. Thirdly a subject who has been told that he is to be tested, and to which he agrees but subsequently gives false information may well have something to hide whereas covertly obtained information may be incomplete, misleading or erroneous.

The identity of the individual should be confirmed to see that he is who he asserts he is. Typically this will involve examination forensically if required of passport, birth certificate, identity card and/or driving licence together with examination of public records such as electoral rolls. The identity of at least some, and preferably all, referees are also verified in a similar manner. This helps or eliminates the problem of the referee not being who he alleges he is and hence providing a spurious reference. At least some referees should be interviewed, desirably in person. It may be possible to deduce discrepancies between what the subject has said and the referee says. A feature of the invention is that the subject is at a later stage confronted, typically in person, with any discrepancies or risk factors detected and asked for comment.

It may be that a satisfactory explanation can be given.

Typically the testing is performed by an autonomous group for example a firm of consultants. This reduces the possibility of the prospective employer wittingly or unwittingly attempting to influence the result of the text.

In a preferred embodiment of the invention the tester does not recommend whether or not the individual is employed but merely points out the risks identified and recommends how they be managed. For example it may be deduced following testing that the individual has an affordable and controlled habit of drinking when he is likely to disclose confidential information but is a low risk for stealing money. One might then recommend that the individual be kept from stock market price sensitive information which might inadvertently be disclosed. However the individual would be well suited to jobs involving the handling of the large amounts of money. Conveniently an investigator explains, in person, the nature of the investigation. This allows for an initial assessment of the subject. The individual may be given a questionnaire to complete as for example annexed hereto.

In a further step it is necessary to consider whether a subject has a motivation to be a threat to the company. Motivation can be divided into five heads. The first of these is greed. The second is need exemplified by the need to pay gambling debts, fund illicit sexual affairs to fund drug or alcohol dependence or to pay general debts. The third is disenchantment where for example the subject feels his true worth is not appreciated and wishes to cause damage. Fourthly is collusion which may be driven by threat for example exposure of a habit or sexual orientation of which the subject is ashamed or which will expose them to threat of coercion or blackmail. Finally there are other personal gains. An example of this is that an individual is approached by an illegal organisation and encouraged to take a job for which he is well suited and rewarded. In exchange for providing commercially sensitive information the illegal organisation arrange for members of the individual's family to be brought, illegally, into the country. The individual's personal gain is that he achieves something which he desires.

A still further step is to assess the subject's work history. A subject who is the only common denominator in a series of previous unexplained apparently unconnected instances of loss is likely to be a factor leading to a risk. Reluctance to take holidays or to work unnecessarily long hours may be indicators of risks. Other indicators of risk are an opulent lifestyle inconsistent with means exemplified by an expensive car and/or a lavish social life and/or expensive holidays and/or a child undergoing an expensive education, a tendency to secrecy and a refusal to delegate, colleagues reluctance to work with the subject, a failure to apply approved operating procedures and certain customers or contractors refusal to work with a person other than the subject or vice versa.

Having established that a factor leading to a potential risk exists an assessment of the severity of the factor is made. Thus it is necessary to determine whether a factor is a risk to the subject or to the company. It is then necessary to determine how often the factor occurs. The time or money cost of a factor is a measure of seventy of the factor. A risk factor which the subject can not afford is clearly a greater threat than one which he can. A factor which is a secret is a greater threat than a factor which is not hidden since the possibility of coercion or threat is not available in the latter case.

For example if a man spends £100 a week on betting on horse racing this is not a significant factor unless: a) the subject's income is not commensurate with that level of spending. For a married man with five children and a gross income of £15 000 per annum this would probably be a significant factor. For a single man with few other outgoings and earning £200 000 per annum the amount would not be a significant factor, b) the subject attempts to hide the habit and its discovery would be an embarrassment if known. Thus engaging in affordable but secret betting on horses would, potentially, be a risk factor if the subject were a member of a religious organisation opposed to gambling since he would then be open to coercion by threat to expose his hypocrisy to other members of the religious organisation, c) the subject lies about involvement or previous larger involvement with the habit.

Risk factors may be benign. For example a person may openly and affordably get intoxicated on a regular basis. A risk factor is that while intoxicated the person may breach the employer's confidentiality without malicious intent although while sober careful to protect the business of the employer.

A feature of preferred embodiments of the invention is that participation is voluntary. Declining to participate or to answer certain questions may, however, lead to negative assumptions being made. Preferably the invention is used prior to employment and by a third party. This overcomes legal difficulties in at least some countries. Preferably no information is recorded on computer databases. This overcomes legal difficulties in at least some countries.

THE OPEN PARTICIPATION UNBIASED SECURE SELECTION SCHEME

(OPUS³)

ACTION PLAN FOR CONDUCTING OPUS³

1. Initial meeting with subject

To explain the process and answer any queries. Questionnaire is handed to the subject at this time. (Explanatory Note, List of Actions and Questions are appended).

Once the completed Questionnaire and supporting documents are supplied the remaining actions can commence. The Explanatory Note is signed by the subject to signify his understanding of the process and his agreement to the terms.

2. Identity/Qualification Verification

Checks will be made to establish proofs are genuine. This may include forensic examination.

- 3. Detailed financial analysis

To seek anomalies, discrepancies and inconsistencies to lifestyle, salary and other material obtained from the questionnaire, e.g. unaccounted for debits or credits.

4. Referee Interviews and Verification

Two or three are chosen from the list of 5 supplied by the subject. They are spoken to in order to discover more detail on the subject. Written references arc not accepted as a substitute.

The identities and occupations of all referees are verified.

5. Lifestyle Evaluation

Random observations may be made to eliminate obvious opulent lifestyle indicators.

The subject will not be placed under surv illance of any land nor will his/her privacy be compromised.

This action normally forms part of Action 7. If this is not possible, a visit to the subject's locality will be necessary to establish style of residence, vehicle type, etc.

6. Public Record Checks

The full range of publicly available information will be utilised to add to and verify the information supplied by the subject. THE OPEN PARTICIPATION UNBIASED SECURE

SELECTION SCHEME (OPUS³)

7. Security Interview

The candidate will be interviewed by two experienced security professionals from Praesidium normally at the subject's home (unless the subject refuses).

This interview is a distillation of the process to this point and will encompass questions arising from the information obtained in actions 1-6.

There will be no set format or question lists. As with the Questionnaire, the subject has the right to refuse to answer any question.

Each apparent discrepancy or potential risk factor discovered during the process will be discussed at the final interview between Praesidium and the subject.

<S. Report and Recommendations

At the conclusion of the process Presidium makes a report to the client of its findings.

Explanatory Notes Security Clearance Questionnaire

The post for which you are applying is one that will entail your dealing with high- level company confidential information. As such it is essential for the success of that the integrity of such personnel is beyond question and that takes all possible steps to ensure that this is the case.

One measure which has been adopted to this end is the detailed vetting of all persons to whom intends to make an offer of employment.

This vetting is conducted entirely openly and with the voluntary co-operation of those who wish to work for or with

For this measure to be effective it is necessary for all persons to be entirely open with and it's vetting consultants; Praesidium Services Ltd

(Praesidium).

The only material supplied by Presidium to will be in the form of a written and verbal report at the conclusion of the process.

No material provided under this process will be made available to any other agency for any purpose whatsoever unless demanded by order of a court.

Each apparent discrepancy or potential risk factor discovered during the process will be discussed at the final interview between Presidium and yourself.

Attached is a summary of the actions that constitute the security clearance process. Some information requested in the questionnaire relates to other persons in your family. You may wish to consult with them before providing this information. Similarly, certain details from the questionnaire may be required in the interviews with your referees, please indicate any information you do not wish to be released to referees.

During the interview process with yourself you will be asked some intrusive and possibly personal questions you can of course refuse to answer any questions

Presidiu will retain the original questionnaire in a secure fashion. No copies will be made.

No copies shall be taken of any data or documents that you supply. Bank statements, certificates etc supplied shall be returned to you at the conclusion of the security process.

Presidium never holds any of the information obtained on any computer system. You have the right to make a request via the Data Protection Registrar or the appropriate THE OPEN PARTICIPATION UNBIASED SECURE SELECTION SCHEME

(OPUS³)

Presidium never holds any of the information obtained on any computer system You have the right to make a request via the Data Protection Registrar or the appropriate Data Privacy body to examine such computer system records, which will be at Presidium's cost.

Discrepancies or potential risk factors identified by Presidium are not necessarily a bar to employment and Presidium itself will not decide whether employment is offered or not

It is Presidium policy that our staff is trained in equal opportunities.

You may rest assured that prejudices based on sex; race, disability or political opⁱnions do not form any part of our screening process or advice to our clients.

I have read and had the above notes explained to me and I fully understand and agree to the terms as laid out therein.

Signed Witnessed.

Date Date.

THE OPEN PARTICIPATION UNBIASED SECURE SELECTION SCHEME

(OPUS³)

Original documents should be provided with this form where requested. These should either be given by hand or sent by registered post. They will be returned in person or by registered post. Any costs incurred by yourself will be reimbursed byPrcesidium You are asked to initial the bottom of each page to indicate that you have fully understood the questions. Should the space provided for your response be insufficient then please use a separate sheet ensuring the identification of the question. The additional sheets should then likewise be numbered and initialled. (A) Identity

Please provide 3 proofs of identity. These must include original passport if held and birth certificate.

03) Education

Qualifications, High School examination onwards and including all technical qualifications.

(C) Personal and family background

THE OPEN PARTICIPATION UNBIASED SECURE SELECTION SCHEME (OPUS³)

3 Permanent address.

4 Previous addresses (last 10 years).

5 Give full details of all employments over the last 10 years. Include reasons and circumstances of leaving.

6 National Identity N°/National Insurance N°.

7 If applicable, maiden name or any other names by which you have been known.

8 Father's name, date and place of birth and occupation (last if retired or deceased).

9 Mother's name, maiden name, date and place of birth and occupation (last if retired or deceased). THE OPEN PARTICIPATION UNBIASED SECURE SELECTION SCHEME

(OPUS³)

10 Please indicate here if you are single, divorced, married or in any permanent relationship.

11 If you arc married or in a permanent relationship, give your partner's name and, where applicable, maiden name or other names by which he she has been known.

12 List addresses for partner over last 10 years where different from your own.

13 Please list all employments of partner/spouse over the last 10 years.

14 Children or other dependants. Please give number, names, ages and, if relevant, school or university they attend. Please also give details of any employers in the last 2 years whether permanent or THE OPEN PARTICIPATION UNBIASED SECURE SELECTION SCHEME OPUS³)

THE OPEN PARTICIPATION UNBIASED SECURE SELECTION SCHEME

THE OPEN PARTICIPATION UNBIASED SECURE SELECTION SCHEME (OPUS³)

(Please provide statements for all for the last 2 years)

25 Apart from normal household expenses do you have any significant other financial commitments? If so, please provide details.

26 Are you prepared to ask the police to provide you with details of any entry relating to you in criminal records and to open the response in the presence of a Presidium representative?

27 Are you willing for Presidium, based on the information contained in this questionnaire, to make an enquiry with a Credit Reference Bureau?

28 Have you ever been referred to, or attended, a clinic or group for rehabilitation from drug, alcohol or gambling abuse addiction?

29 List all clubs/societies of which you or your spouse/partner are a member. (You may exclude Trade Union Membership if you wish)

Please supply a list of 5 names, occupations and contact details of persons who woxild be willing to be contacted about your character, lifestyle and background. Indicate wⁱth a large 'R' any of your responses which you do not wish to be released to referees.

^{1 •} certify that all information provided by me in this ques^tionnaire is true. I understand that if I have deliberately provided any mformaπon THE OPEN PARTICIPATION UNBIASED SECURE SELECTION SCHEME

(OPUS³) that is false or misleading any offer I have with will be cancelled.

^Date Signed.

Claims

1. An overt method of testing individuals to measure potential security risk when performing a job, the method comprising the steps of : i. forming measure of the risk associated with the job by giving a positive weighting to one or more factors selected from: a) availability of material or sensitive information; b) jobs in which collaboration with no or few others would be necessary to perpetrate a security breach; c) jobs in which breach of security, if attempted, would not easily be detected; and d) jobs in which breach of security, if attempted, would not be quickly detected, ii. confirming the identity of the individual, iii. forming a measure of the potential motivation of the individual to pose a security risk a positive weighting being giving to: a) desire for wealth; b) need for wealth; c) disenchantment; d) fear of exposure; and e) other potential personal gain, iv. forming a measure of the subject's history a positive weighting being given to one or more factors selected from: a) involvement in a series of unexplained previous events in which the individual is a common denominator; b) reluctance to take holidays; c) tendency to be present at the work-place for unnecessarily long periods; d) tendency to secrecy; e) tendency to refusal to delegate; f) opulent lifestyle including any one or more of expensive vehicle, lavish social life, expensive holidays and child undergoing expensive education; g) colleagues reluctance to work with individuals; h) refusal of some clients to deal with employees other than individual or vice versa; and i) failure to apply approved operating procedures, v. confirming the identity of at least one referee, vi. confronting the individual with relevant risk factors or discrepancies noted in steps ii, iii, iv or v, and vii. evaluating the identified risks.

2. A method as claimed in claim 1 performed prior to offer of the job.

3. A method as claimed in claim 1 or claim 2 wherein the method is not performed by the employer or prospective employer.

4. A method as claimed in claim 3 performed by security professionals.

5. A method as claimed in any one of the preceding claims wherein the job is in the telecommunications, banking, financial, computing and IT industries

6. Means for overtly testing individuals to measure potential security risk when performing a job, comprising: i. means for measuring the risk associated with the job by giving a positive weighting to one or more factors selected from: a) availability of material or sensitive information; b) jobs in which collaboration with no or few others would be necessary to perpetrate a security breach; c) jobs in which breach of security, if attempted, would not easily be detected; and d) jobs in which breach of security, if attempted, would not be quickly detected, ii. means for confirming the identity of the individual, iii. means for forming a measure of the potential motivation of the individual to pose a security risk a positive weighting being giving to: a) desire for wealth; b) need for wealth; c) disenchantment; d) fear of exposure; and e) other potential personal gain, iv. means for forming measure of the subject's history a positive weighting being given to one or more factors selected from: a) involvement in a series of unexplained previous events in which the individual is a common denominator; b) reluctance to take holidays; c) tendency to be present at the work-place for unnecessarily long periods; d) tendency to secrecy; e) tendency to refuse to delegate; f) opulent lifestyle including any one or more of expensive vehicle, lavish social life, expensive holidays and child undergoing expensive education; g) colleagues reluctance to work with individuals; h) refusal of some clients to deal with employees other than individual or vice versa; and i) failure to apply approved operating procedures, v. means for confirming the identity of at least one referee, vi. means for confronting the individual with relevant risk factors or discrepancies noted in steps ii, iii, iv or v, and vii. means for evaluating the identified risks.

7. A method of testing individuals to assess suitability for employment having the following features: a) all checks being both overt and voluntary in that the individual participates in or gives permission for each check, b) only successful candidates for employment are subjected to testing, c) assessment is performed prior to offer of employment d) testing is conducted by security professionals, e) assessment is of both benign and malicious threats, f) discrepancies or potential risk factors are not necessarily a bar to employment, g) the decision on whether or not the individual should be employed is taken solely by the prospective employer, h) no information is stored on a computer database, j) no material supplied is disclosed other than to the prospective employer without the individual's express permission or unless demanded by court order, k) no copies are made or any material supplied and originals are returned.