Iris reviewed the scant stack of applications for the newly created security manager position and frowned. There should have been many more than just three applicants for the position.
After the human resources incident earlier in the month, she had been extremely careful in crafting the job description and was elated when Mike Edwards approved the creation of the position and the plan to hire. The new security manager was to assist in the drafting of security policies and plans, a need that had been highlighted by the recent HR problem.

Iris called Gloria in human resources. “I’m worried about the number of applicants we’ve had,” she said. “I really thought there would be more than three, given the way the local economy is right now.”
“Oh, there were dozens,” Gloria said, “but I prescreened them for you.”
“What do you mean?” Iris asked. “Prescreened how?”
“Well, we pass on only the most qualified applicants,” Gloria replied. “According to our criteria, applicants for information security positions must have a CISA certification or some level of GIAD.”
“Since I’m not aware of such a certification as a ‘GIAD,’ you must mean ‘GIAC’?” Iris asked, her uneasiness building.
“No, the file says GIAD,” Gloria replied confidently.
“Well, for this position we need a CISSP or CISM, not a GIAC or CISA,” Iris said. “Those certifications don’t match the job description I wrote, and I don’t remember specifying any required certifications.”
“You don’t have to,” Gloria said. “We’ve determined that the best people for the jobs are the ones who have the most certifications. We rewrote your position’s screening criteria. We don’t really look at anyone who isn’t properly certified. Is there a problem?”

Questions:
1. If you were Iris, how would reply to Gloria’s question?
2. What, if anything, is wrong with the human resources focus depicted here? Examine the relationship between certifications and experience. Do certifications alone identify the job candidates with the most appropriate expertise and work experience?