Examiners just finished up and had comments on GLB and safeguarding customer information. Question: I can understand safeguarding all customer information in public areas and during working hours. However, what about info left on the desk that only the janitor has the opportunity to view? If the janitor is bonded do I still need to go around at night and check all workstations for customer information?

I believe the answer is yes, even though it sounds extreme. Will you actually go to that extreme, I can't say.

Shred bins should have locks and other documents should be secured, or at least covered so they are not in plain view.

Thanks for replying Andy. We have locked shred bins, but several people place items in a box (out of plain view - such as under the desk) instead of running to the bin several times a day. The box is emptied "periodically". Thoughts???

I don't know whether you would be required to do that, but I think it's simply good business practice to clear your work area at night and put files, papers, etc. in a safe place. My staff knows that I have a hairy fit if I find any files or papers with customer information left out at night, so they are extremely conscientious about this issue. Low-tech safeguarding of information is just as important as high-tech safeguarding (and it's a lot easier!).

Trash can shredders or empty the box daily.

Actually, I have asked the same question and someone at my bank told me that "we make them (janitors) sign an agreement" regarding the information they might see as they perform their duties. That's true, but once the deed is done, it's done. I think that the agreements, bonds, insurance, etc. are a secondary measure, not a primary one. I think that the primary defense is to have the information locked away at night, not out everywhere.

And if you want to do background checks on the janitor staff, what would that cost, what about their turnover, and how many would pass? Yes, the horse is out of the barn on this one if you rely on that. And the agreement has little meat or teeth to it, IMHO from a practical standpoint. I believe the real issues have to be dealt with by those you can control and influence.

I can't even get of janitors to plug the coffee pot back in.

The boxes should be emptied daily. We also have boxes so employees do not have to run back-and-forth to the shred boxes, but they are required and can be disciplined if this action is not taken. Remember you have the physical aspects of privacy within 501(b).

I started hearing stories about a year or so ago that examiners were citing banks for this. I thought it was a bit much, myself.

And yet I can tell you exam reports get left on desks, copiers, file cabinets, etc. in regulatory offices all the time. Pots calling the kettles black??

Pardon my message board ignorance- what does IMHO mean?

In my humble opinion!

Thank you, Thank you, Thank you. You asked the question that I have been wondering for a long time, and been too embarassed to ask.

Here are some other common internet acronyms (you know how we government types love acronyms.)

BTW - by the way
LMK - let me know
JK - just kidding
IMNSHO - in my NOT so humble opinion
OTOH - on the other hand
CASE - copy and steal everything (used mostly in crafting boards but would also be useful for people lifting other bank's policies etc.)
LOL - laugh(ing) out loud
ROFL - rolling on floor laughing

Ya know, I've seen it used several times here and lately assumed (yep) it was more common than I thought. I've generally stayed away from those chat room abbreviations but started since I saw them growing in popularity.

Even today I thought about asking whether all of us knew them. Sorry. Here are a few of the more common ones. But I might add, from my early days, the "f" in "RTFM" wasn't "fine".

WTF is also.....differently defined.... than I see it elsewhere (not that I see it often, surely a nice girl like me wouldn't go to boards where it is a common saying....)

Of course, we have left out the most important acronym which is a staple of the compliance profession:

CYA- Cover your a**

tdrago:

"I Might Hurt Ostriches"

(Just kidding, "in my humble opinion")

Our local compliance group relayed a story of a bank client. Seems the bank received a call from local law enforcement that had just arrested a credit card/ID Theft ring. The bank was called to come down to the station to identify if some of the evidence was copies of documents from the bank.

Stunned, one of the officers went to the bank and was presented with photocopies of applications, finanical statements and credit reports that had come from credit files.

It seems that a "friend" of the janitorial staff had come in and helped herself to anything found on desktops and unlocked drawers. She took the precaution of tilting the interior security cameras at the ceiling as she made her rounds and photocopied documents that interested her. Before she left, she pointed the cameras back to their normal position.

Needless to say, the bank instituted a "clean-desk" policy after that happened.

Think about what the average janitor makes. Now suppose a criminal ring offers that janitor $50 for every copy of a credit report or application he/she can get. This is not outside of the realm of possibility. The janitor makes minimum wage which translates to roughly $50 a day after taxes. He/she could easily double or triple that.

Bonded-shmonded - you do the math.

wlavoie:

This thread is bearing out the old adage that "opinions are like noses -- everybody's got one, just pick the one that works for you!" The information in the posts is valuable and the suggestions are well-founded. But there are some other things that you need to know before you establish a policy, including these facts (not opinions):
- JANITORS AND TEMPORARY EMPLOYEES HAVE PROVEN REPEATEDLY TO BE YOUR GREATEST INFORMATION SECURITY RISKS -- after your directors;
- Janitors -- particularly ones that work during non-business hours -- frequently bring along friends and relatives to "help" them;
- County probation, and state and federal parole agencies, often place "work release" and former inmates in jobs that require minimal intelligence and only menial skills (they call these "successful placements"), and the top three (3) positions include:
* Janitorial firms;
* Restaurants; and
* Hotels/motels;
- Temporary staffers are rarely screened appropriately by the companies that employ them and before they work for you;

I hope that all of you take a particularly close look at the folks that you let into your workplace. See people for who they really are. Don't simple rely upon a bond as an indicator that the person is suitable for your work environment -- the bond MAY only help you, afterwards. I've written about the dangers of ignoring the "invisible people" in the working environment before. These are the people that we often give unfettered access to everywhere and that we give little, if any, attention when we see them in the workplace. I've also written about the fact that every crime requires ACCESS -- and without access, the crime can't be committed. So -- who has access to all of the different forms of your data?

...Soooooo...the moral of this story seems to be that trash can be working for you without your knowledge! (At first glance, I thought this thread was going to extoll the capabilities of substandard humans to perform audits.)

LOL! Richard - you are one funny guy!!!!

In reply to:

---

Temporary staffers are rarely screened appropriately by the companies that employ them and before they work for you;

---

Correct me if I'm wrong, but I have heard that banks are not allowed to screen temporary employees. Is that true? If so, what law prohibits that?

tdrago:

You should contact your "source" for more information. To my knowledge, there's no law or regulation that prohibits an institution from conducting background investigations on temporary employees.

Thanks! I'll do that.

Okay, I need to log off if I was amused by the "TLA" as being three letter acronym!!!