The Disgruntled HR

Director George Schmelzle*

Professor School of Accountancy

Carl Keller Associate

Professor School of Accountancy

Paul Ashcroft Associate

Professor School of Accountancy

The Disgruntled HR Director Introduction Regan Carter, the human resource director for an online accounting firm, was angry. She had just been terminated from her position as Human Resource Director at a staffing firm for accountants. Carter was terminated for “failing to meet the minimum qualifications for her job.” The firm also noted that Carter had an argument with a colleague and downgraded the colleague’s computer access after the argument. Carter was also angry that the organization terminated her with a phone call. While sitting at her desk after finishing the phone call, Carter noticed that she still had access to her account. Employees could see Carter repeatedly hit the delete button on her computer. Security was notified and Carter was escorted from the building. Once Carter went home, she noted she still had access to her organizational account. Using this access, Carter logged into the system and deleted 17,000 job applications and resumes that had been sent to the organization; resumes/applications the company needed for their business. Essentially, these were all of the organization’s resumes. It took two days for Carter to omit the resumes. Carter also added expletives into the system, leaving no doubt as to who did the damage. The organization spent $100,000 trying to retrieve the files and rebuild the system which had been damaged by Carter. Some of the files/resumes were never retrieved. Carter was arrested and later convicted of one count of damaging computers and one count of recklessly damaging computers. In addition to the actions of Carter, who else is at fault? Why did the organization’s backup systems fail? How could this attack have been prevented? Background of the Online Accounting Firm The online accounting firm was started in 1999 by former employees of the accounting firm Price Waterhouse Coopers. They started offering online accounting and tax preparation services to small businesses. The firm’s employees include certified public accountants, enrolled IRS agents, bookkeepers, and support staff such as human resources and customer service representatives. Employees can be full-time or part-time, and work either remotely or on site. Services include tax advice including IRS audit defense, tax compliance, accounting, bookkeeping, and payroll. Services are mostly offered on a virtual basis, but some services are on site. The company’s mission is to make professional tax and accounting services available to small businesses by providing these services at a very competitive price. The organization needs a large number of professional accountants to provide services to many small companies. It is important for the organization to have a large number of resumes and applications on file so that the organization can effectively meet their client’s needs, and the deletion of the resumes affected the relationship of the organization with their clients. “Her actions wiped out information vitally important to the employer company and cost the company money and time to repair.” Forensic Information – HR Director Regan Carter had worked in human resources in various capacities. Prior to being hired as Human Resource Director she served as a human resource manager for seven years and a corporate recruiter for three years. Carter had legal and financial issues earlier in her life. In 2008 Carter was convicted of forgery while in 2002 she was arrested for writing a bad check. Her stint as Human Resource director for the online accounting firm lasted only six months and did not go smoothly. Carter got into an argument with an employee, and downgraded their computer status shortly thereafter, making it much more difficult for the employee to do their job. In court documents, the organization noted that Carter was not able to do the “minimum requirements” her position warranted.

Timeline of the fraud

January 2019 Carter hired by the online accounting firm as Human Resource Director

Jan 2019-June 2019 Carter’s employment term with the firm.

June 2019 Carter terminated for failing to “meet the minimum requirements of her position” and maliciously downgrading the computer rights of an employee.

June, 2019 Carter deletes 17,000 applications and resumes, damages to the system are $100,000.

August 16, 2021 Carter was found guilty of one count of intentionally damaging computers and one count of recklessly damaging computers.

Questions 1. Using the Enterprise Risk Management Model (internal environment) describe the company’s adherence to human resource standards. 2. List and discuss some controls that should have been in place over human resources at the online accounting firm. (LO 2 and 3) The Disgruntled HR Director

TEACHING NOTES Critical Incident Synopsis This case examines a human resource director who deleted 17,000 resumes and applications from the organization’s computer system. This case requires students to apply the standards required for human resources in the Enterprise Risk Management Model to assess the risk to the online accounting firm. The case also examines best practices for assigning computer rights and backing up data and determining effective internal controls over human resources.

Learning Objectives Upon completion of the critical incident, students should be able to: 1) Apply the human resource section of the internal environment of the Enterprise Risk Management Model to the online accounting firm. 2) Discuss internal controls over human resources. 3) Be familiar with best practices for assigning computer rights and backups.

Answer these questions:

1. Using the Enterprise Risk Management Model (internal environment) describe the company’s adherence to human resource standards 

2. List and discuss some controls that should have been in place over human resources at the online accounting firm.