The Extension Board and the Pen Drive
A 30-seat data-entry centre runs from a converted first-floor shop. Power comes through two 16 A wall sockets, and six extension boards are daisy-chained under the desks to feed 30 PCs, four fans, two air-conditioners and a printer. A cable runs loose across the walkway to the printer, and a swollen UPS battery sits on a wooden shelf. One exit stairway is partly blocked by cartons of blank paper; the fire extinguisher's gauge shows low pressure and no one has been trained to use it. Agents work nine-hour shifts with a 30-minute break; monitors sit below eye level, chairs have no lumbar support, and several agents complain of neck and wrist pain. Yesterday an agent copied a client's customer database to a personal pen drive so he could finish his target at home.
1. Rank the hazards in this centre by risk and give the immediate action for each. Show how you arrive at the ranking.
Read the worked answer
Use risk = severity × likelihood, and put life safety above comfort:
- Overloaded, daisy-chained wiring (highest). Six strips on two 16 A sockets feeding 30 PCs, two air-conditioners, fans and a printer is a serious overload; loose contacts overheat, and the severity is fire or electrocution with a whole floor of people above ground level. Today: unplug the chained strips, and have a licensed electrician split the load onto separate circuits with MCB, RCCB and proper earthing; no strips under desks.
- Blocked exit, dead extinguisher, untrained staff. Severity is fatal and likelihood is high precisely because hazard 1 exists. Today: clear the stairway, service or replace the extinguisher, mark and light the exit, and run an evacuation drill this week.
- Swollen UPS battery on a wooden shelf. Fire and chemical hazard, and the battery has already failed. Action: isolate it, replace it, dispose of it as e-waste, and never store batteries on wood.
- Ergonomics - nine-hour shifts, low monitors, no lumbar support. Lower severity per event but almost certain to occur, so it ranks high as a chronic health cost. Action: raise monitors to eye level, provide lumbar support and footrests, and enforce micro-breaks away from the screen.
Record each hazard with a photograph, an owner and a closure date - that record is the evidence an inspector or client auditor will ask for.
2. The agent who copied the customer database to a pen drive says he only wanted to meet his target at home. As centre head, what do you do, and why is the intention irrelevant?
Read the worked answer
What I do: ask for the drive calmly and secure it together with the machine, deleting nothing; check whether the copy has already been shared or uploaded; log the incident with time, file name, record count and witnesses; inform the client as the contract requires; and involve HR under the signed confidentiality and acceptable-use policy. His access is suspended pending the enquiry. Disciplinary action follows the written policy, not my mood, and the outcome is recorded.
Why intention is irrelevant: the customer database is the client's confidential data, and the contract and IT Act treat unauthorised copying and removal from the premises as a breach whatever the motive. The harm is identical whether the data is sold or lost on a bus. 'Meeting the target' is also a management failure as much as an individual one - if the target cannot be met within the shift, that is my problem to fix, not his to solve by exporting data.
Controls: least privilege (he should never have been able to export the full table), USB ports blocked or DLP-monitored, a secure VPN route for any approved home work, clean-desk rules, access logs that are actually reviewed, and an acceptable-use policy reinforced at induction rather than signed once and forgotten.
3. Draft a 30-day corrective plan with owners, and say what evidence you would keep for an audit.
Read the worked answer
Days 1–3 (owner: centre head): de-load and unplug the extension chains, clear the exit, isolate the swollen battery, brief all staff. Evidence: dated before-and-after photographs, signed staff brief with attendance. Days 4–10 (owner: licensed electrician, with admin): separate circuits, MCB/RCCB, earthing certificate, removal of under-desk strips; service or replace extinguishers; send the UPS battery to e-waste. Days 11–20 (owner: safety warden): evacuation drill with roll call, extinguisher training, first-aid box check, and a simple hazard register with risk ratings. Evidence: drill record with evacuation time, training sign-offs. Days 11–20 (owner: HR and IT): ergonomic adjustments - monitor stands, lumbar cushions, footrests - a break schedule that is actually taken, an awareness session on posture and eye strain, and an anonymous symptom survey before and after. Days 21–30 (owner: IT and HR): acceptable-use and confidentiality policy re-signed by every agent, USB/DLP controls, a least-privilege review of who can export data, an incident register opened, and a fixed monthly review date.
Evidence to keep: hazard register with photographs and closure dates, the electrician's certificate, drill and training records, ergonomic survey results, signed policies, the incident log and minutes of the review meeting. Auditors and clients accept dated, owned, signed records - not promises.