The W-2 Email, the Missing MFA, and the Safety Plateau
Ridgeline Freight is a 2,200-employee logistics company with 14 warehouses using a 14-year-old on-premise HR system supported by 11 shadow spreadsheets; payroll error rate is 2.3% and duplicates are discovered monthly. In the past 18 months there have been three phishing incidents, one of which ended with a warehouse manager emailing a terminated employee's W-2 to a personal address. The HR system has no multi-factor authentication and no automated deprovisioning. OSHA recordable incident rate is 4.8 against an industry average of 3.2, and near-miss reports have fallen 40% since supervisors were put on a bonus tied to zero recordables. About 900 contingent workers from four staffing agencies work in the three largest warehouses and are not tracked in the HR system. A $1.2M technology budget has been approved for next year.
1. How should the $1.2M be sequenced across HR system replacement, security remediation, and safety? Defend the order.
Read the worked answer
Sequence by irreversibility and harm, not by project size.
Tier 1 - this quarter, funded outside the capital program if necessary. Missing MFA and no automated deprovisioning are not maturity gaps; they are open doors. Terminated employees retaining access is how the W-2 incident class recurs, and W-2 exposure carries notification costs, regulatory exposure, and class-action risk that dwarf a system upgrade. MFA plus an authoritative joiner-mover-leaver feed is low-cost and immediate. The W-2 incident also needs a documented post-incident review - the manager's behavior indicates a missing data-handling control and missing training, not just a technical gap.
Tier 2 - the HR system replacement, phased. A 14-year-old system with no deprovisioning is the cause of Tier 1. But a full replacement in one year will fail if scoped as a big-bang. Phase it: core HR and payroll first (the 2.3% error rate is a recurring cash and compliance leak), then time and attendance, then contingent worker tracking.
Tier 3 - safety analytics, though not because it is least important. Incident rates are currently measured on an unreliable base (see the next question); a data platform without trustworthy reporting produces confident wrong answers.
What to defer: self-service portals, engagement modules, and any analytics build on top of the shadow spreadsheets. The spreadsheets are the symptom of distrust in the system - they will not disappear until payroll accuracy improves.
2. Near-miss reports fell 40% after supervisors were placed on a zero-recordable bonus. What does this most likely mean, and what should be done?
Read the worked answer
The most likely explanation is reporting suppression, not safety improvement. The recordable rate of 4.8 versus an industry 3.2 argues against genuine improvement, and the timing is causal: the bonus rewarded the absence of records, and near-miss reports are the leading indicator that predicts records. Supervisors respond rationally to the incentive they were given - they stop filing, and they discourage workers from reporting.
This is a serious compliance exposure, not just a measurement problem. Underreporting under OSHA recordkeeping rules is itself a violation, and a documented incentive tied to recordable rates is exactly the pattern regulators look for. The bonus must be redesigned before anything else in safety.
The design fix: stop paying for zero recordables. Pay for leading indicators the supervisor actually controls - hazard reports filed and closed, near-miss investigations completed, corrective actions on time, toolbox participation. Reward the reporting behavior rather than the outcome, so the supervisor's rational move aligns with disclosure.
Diagnose before rebuilding the metrics. Compare near-miss reports, first-aid cases, and recordables by warehouse. If near-misses fell while first-aid and recordables held or rose, suppression is confirmed. Interview hourly workers, not supervisors - supervisors are the incentive's beneficiary and will report the incentive's preferred story.
Expect a reporting spike when the bonus changes. Warn leadership in advance so a rise in reported incidents is read as restored honesty rather than deteriorating safety.
3. Nine hundred contingent workers are untracked in the HR system. What is the risk, and how should Ridgeline govern this?
Read the worked answer
The risk is threefold.
Safety and compliance: without a single roster, Ridgeline cannot know who is in its warehouses, whether they have been trained, or whether they are exposed to the highest-hazard tasks. Temporary and contingent workers consistently show elevated injury rates in warehousing, and incidents involving them are frequently the ones that generate joint-employer and citation exposure. The 4.8 recordable rate cannot even be verified as complete while 900 workers are outside the counting frame.
Security and access: contingent workers need system and physical access, which means they need the same joiner-mover-leaver controls as employees. An untracked population is an un-deprovisioned population - a second route to the W-2 failure.
Co-employment and cost: inconsistent pay rates, hours, and assignment duration across four agencies creates wage-and-hour and co-employment exposure, plus no ability to manage agency markup or conversion decisions with data.
Governance model:
- Make the HR system the system of record for all workers, with a worker-type field distinguishing employee, agency, and contractor.
- Require badge and system access to be provisioned only from that record - no access without a roster entry.
- Put agency compliance in the contracts: mandatory reporting of incidents, training, and hours in Ridgeline's format, with audit rights.
- Assign a single owner for contingent workforce data, and review agency performance and conversion rates quarterly.
Do not wait for the new system. A controlled spreadsheet with a named owner and a monthly reconciliation beats eleven uncontrolled ones, and the governance design must precede the technology or the new system will simply automate the current ambiguity.