The Shared Mailbox and the Confidential Attachment
You are an administrative assistant in a five-person office. The general enquiries mailbox is shared: all five staff can see everything in it. A supplier sends an email to that shared address containing an attached spreadsheet of its other customers' order volumes, clearly marked "Confidential - for the attention of the purchasing manager only." The purchasing manager is on leave for three days. A colleague who is covering purchasing opens the attachment, forwards it to her personal webmail "so I can work on it at home," and asks you to reply to the supplier confirming receipt. Separately, the same colleague asks you to sign a delivery note for twelve boxes that have arrived but that nobody has yet counted. She says: "It's always twelve; just sign it and I'll check later."
1. What are the problems with how the confidential email has been handled, and what should you do now?
Read the worked answer
Problems:
- Wrong recipient channel. The supplier restricted the material to one named person; the shared mailbox exposes it to all five staff. That is the supplier's error as much as ours, but once known, we must limit further exposure.
- Forwarding to personal webmail takes confidential third-party data outside the organisation's control - a clear breach of confidence and likely of the supplier's terms.
- Confirming receipt would imply the intended recipient has the material, which is not true.
What to do now:
- Do not reply confirming receipt on the manager's behalf. Reply only to say the message has been received into the shared mailbox and will be passed to the purchasing manager, and ask the supplier to resend to the manager's own address.
- Ask the colleague to delete the personal-webmail copy and confirm in writing that she has; note the request and her response.
- Move the message to a restricted folder only the manager can access, or ask IT to do so.
- Tell the manager on return, factually and without commentary on the colleague's motives.
- Do not open or circulate the spreadsheet yourself; you have no need to see it.
Signing a delivery note you have not verified is a separate integrity issue and should be refused.
2. How should you respond to the request to sign for twelve uncounted boxes?
Read the worked answer
Refuse politely and offer the alternative.
Signing a delivery note is a certification that the stated quantity and condition were received. If the count is wrong, the signature removes the business's ability to claim against the carrier or supplier. "It's always twelve" is exactly the assumption that fails on the day it matters.
Say: "I'm not comfortable signing for a quantity I haven't checked - if it's short we can't claim. Give me ten minutes and we'll count them together, then I'll sign with pleasure."
If she insists or is unavailable:
- Sign only with a written qualification: "Received subject to count" or "12 boxes received, contents not verified," dated and initialled, if the carrier accepts it.
- Record the qualification in the goods-in log and tell the purchasing manager.
- If the carrier will not accept a qualified signature, ask the supervisor which risk the business prefers - a delayed signature or an unverified one - rather than deciding alone.
The principle: never certify a fact you have not established, and never let a routine shortcut override a control that exists to catch the rare failure.