Fraud is a difficult problem to deal with -- the more open you are about what you're doing to prevent it, the more you speed up the "evolution" of better (aka. worse) fraud.
Whether that effect is large enough to justify the lack of transparency in this case, I don't know; but I'm sure there are some cases where it is appropriate.
(Marginally related: This is why I have some sympathy for Paypal when they say "this payment is suspect" and refuse to provide any more information -- they can't tell me why a particular payment set off alarms without also telling the bad guys how to evade their alarms.)
No, it's really not when you constrain who the possible perpetrators are and consider that they must be long-term, more senior employees. Fraud by higher ranking employees – particularly managers involved in the creation of job descriptions and doing hiring is just not going to be that common.
It certainly isn't going to be common enough that it's worth destroying internal trust and credibility when open (within company) reviews and sufficient internal control mechanisms that didn't include hidden manipulation of candidate hiring could do an equivalent job without reducing the organization's ability to hire stellar candidates (not that I'm biased, given my case, of course =)
I mean, it may well happen, but all sorts of unlikely events may happen and yet would similarly be problematic to keep constant protection for. It's all about the risk/reward analysis and, in this case, I believe you've calculated that incorrectly.
Comments
Fraud is a difficult problem to deal with -- the more open you are about what you're doing to prevent it, the more you speed up the "evolution" of better (aka. worse) fraud.
Whether that effect is large enough to justify the lack of transparency in this case, I don't know; but I'm sure there are some cases where it is appropriate.
(Marginally related: This is why I have some sympathy for Paypal when they say "this payment is suspect" and refuse to provide any more information -- they can't tell me why a particular payment set off alarms without also telling the bad guys how to evade their alarms.)
No, it's really not when you constrain who the possible perpetrators are and consider that they must be long-term, more senior employees. Fraud by higher ranking employees – particularly managers involved in the creation of job descriptions and doing hiring is just not going to be that common.
It certainly isn't going to be common enough that it's worth destroying internal trust and credibility when open (within company) reviews and sufficient internal control mechanisms that didn't include hidden manipulation of candidate hiring could do an equivalent job without reducing the organization's ability to hire stellar candidates (not that I'm biased, given my case, of course =)
I mean, it may well happen, but all sorts of unlikely events may happen and yet would similarly be problematic to keep constant protection for. It's all about the risk/reward analysis and, in this case, I believe you've calculated that incorrectly.