About_the_PresentationsThe_presentations_cover_the_objectives_found

About the Presentations

The presentations cover the objectives found in the opening of each chapter.

All chapter objectives are listed in the beginning of each presentation.

You may customize the presentations to fit your class needs.

Some figures from the chapters are included. A complete set of images from the book can be found on the Instructor Resources disc.

Principles of Incident Response and Disaster Recovery, 2nd Edition

Chapter 01

An Overview of Information

Security and Risk Management

Objectives

Define and explain information security

Identify and explain the basic concepts of risk management

List and discuss the components of contingency planning

Describe the role of information security policy in the development of contingency plans

Principles of Incident Response and Disaster Recovery, 2nd Edition

Introduction

Contingency planning

Being ready for incidents and disasters

Example: 1/10 of one percent of online users

Allows for two and a half million potential attackers

Example: World Trade Center (WTC) organizations

Had contingency plans due to February 1993 attack

Example: 2008 Gartner report

2/3 of organizations invoked plans in prior two years

Information security includes contingency planning

Ensures confidentiality, integrity, availability of data

Principles of Incident Response and Disaster Recovery, 2nd Edition

Information Security

Committee on National Security Systems (CNSS) information security definition

Protection of information and its critical elements

Includes systems and hardware storing, transmitting information

Part of the CNSS model (evolved from C.I.A. triangle)

Conceptual framework for understanding security

Information security (InfoSec)

Protection of confidentiality, integrity, and availability of information

In storage, during processing, and during transmission

Principles of Incident Response and Disaster Recovery, 2nd Edition

Key Information Security Concepts

Threat: object, person, other entity posing potential risk of loss to an asset

Asset: organizational resource being protected

Logical or physical

Attack: attempt to cause damage to or compromise information of supporting systems

Arises from a threat; intentional or unintentional

Threat-agent: threat instance

Specific and identifiable; exploits asset vulnerabilities

Principles of Incident Response and Disaster Recovery, 2nd Edition

Key Information Security Concepts (cont’d.)

Vulnerability

Flaw or weakness in system security procedures, design, implementation, internal controls

Results in security breach or security policy violation

Well-known or latent

Exercised accidently or intentionally

Exploit: caused by threat-agent

Can exploit system or information through illegal use

Can create an exploit to target a specific vulnerability

Control/safeguard/countermeasure: prevent attack

Principles of Incident Response and Disaster Recovery, 2nd Edition

Key Information Security Concepts (cont’d.)

Principles of Incident Response and Disaster Recovery, 2nd Edition

Key Information Security Concepts (cont’d.)

Trespass

Broad category of electronic and human activities

Can breach information confidentiality

Leads to unauthorized real or virtual actions

Results in unauthorized access to premises or system

Software attacks

Malicious code, malicious software, malware

Designed to damage, destroy, deny service to the target systems

Example: hackers

Principles of Incident Response and Disaster Recovery, 2nd Edition

Key Information Security Concepts (cont’d.)

Common malicious code instances

Viruses and worms, Trojan horses, logic bombs, bots, rootkits, back doors, denial-of-service (DoS) attack, distributed DoS (DDoS) attack

Malicious code threats: sources of confusion

Method of propagation, payload, vector of infection

Viruses

Segments of code that perform malicious actions

Macro virus: embedded automatically in macrocode

Boot virus: infects key operating systems files

Principles of Incident Response and Disaster Recovery, 2nd Edition

Key Information Security Concepts (cont’d.)

Worms

Replicate themselves constantly

No other program needed

Can replicate until available resources filled

Back doors and trap doors

Installed by virus or worm payload

Provides at will special privilege system access

Polymorphism

Threat changes apparent shape over time

Elude antivirus software detection

Principles of Incident Response and Disaster Recovery, 2nd Edition

Key Information Security Concepts (cont’d.)

Propagation vectors

Manner by which malicious code spreads can vary

May use social engineering: Trojan horse looks desirable, but is not

May leverage open network connection, file shares or software vulnerability

Malware hoaxes

Well-meaning people send random e-mails warning of fictitious dangerous malware

Wastes a lot of time and energy

Principles of Incident Response and Disaster Recovery, 2nd Edition

Key Information Security Concepts (cont’d.)

Human error or failure

Introduces acts performed by an authorized user

No malicious intent or purpose

Human error

Small mistakes produce extensive damage with catastrophic results

Human failure

Intentional refusal or unintentional inability to comply with policies, guidelines, and procedures, with a potential loss of information

Principles of Incident Response and Disaster Recovery, 2nd Edition

Key Information Security Concepts (cont’d.)

Theft

Illegal taking of another’s property

Property: physical, electronic, intellectual

Includes acts of espionage and breach of confidentiality

Methods

Competitive intelligence or industrial espionage

Theft or loss of mobile devices

Phones, tablets, and computers

Stored information more important than devices

Principles of Incident Response and Disaster Recovery, 2nd Edition

Key Information Security Concepts (cont’d.)

Compromises to intellectual property

FOLDOC intellectual property (IP) definition

The ownership of ideas and control over the tangible or virtual representation of those ideas. Use of another person’s intellectual property may or may not involve royalty payments or permission but should always include proper credit to the source

Includes

Trade secrets, copyrights, trademarks, patents

Exfiltration, or unauthorized removal of information

Software piracy

Principles of Incident Response and Disaster Recovery, 2nd Edition

Key Information Security Concepts (cont’d.)

Sabotage or vandalism

Destroys asset or damages an organization’s image

Assault on an organization’s Web site

Cyberterrorism (more sinister hacking)

Technical software failures or errors

Software with unknown hidden faults

Code sold before security-related bugs detected

Trap doors

Helpful Web sites

Bugtraq and National Vulnerability Database

Principles of Incident Response and Disaster Recovery, 2nd Edition

Key Information Security Concepts (cont’d.)

Technical hardware failures or errors

Equipment distributed with known or unknown flaw

System performs outside expected parameters

Errors can be terminal or intermittent

Forces of nature

Known as force majeure, or acts of God

Pose most dangerous threats imaginable

Occur with very little warning

Principles of Incident Response and Disaster Recovery, 2nd Edition

Key Information Security Concepts (cont’d.)

Deviations in quality of service by service providers

Product or service not delivered as expected

Support systems interrupted by storms, employee illnesses, unforeseen events

Technological obsolescence

Antiquated or outdated infrastructure

Leads to unreliable and untrustworthy systems

Risk loss of data integrity from attacks

Principles of Incident Response and Disaster Recovery, 2nd Edition

Key Information Security Concepts (cont’d.)

Information extortion

Attacker or trusted insider steals information from a computer system

Demands compensation for its return or for an agreement to not disclose the information

Common in credit card number theft

Other threats

See Table 1-2

Principles of Incident Response and Disaster Recovery, 2nd Edition

Overview of Risk Management

Risk management process

Identifying and controlling information asset risks

Security managers play the largest roles

Includes contingency planning

Risk identification process

Examining, documenting, and assessing the security posture of an organization’s IT and the risks it faces

Risk control process

Applying controls to reduce the risks

Principles of Incident Response and Disaster Recovery, 2nd Edition

Overview of Risk Management (cont’d.)

Principles of Incident Response and Disaster Recovery, 2nd Edition

Overview of Risk Management (cont’d.)

Risk management redefined

Process of identifying vulnerabilities and taking carefully reasoned steps to ensure the confidentiality, integrity, and availability of the information system

“If you know the enemy and know yourself, you need not fear the result of a hundred battles. If you know yourself but not the enemy, for every victory gained you will also suffer a defeat. If you know neither the enemy nor yourself, you will succumb in every battle.”

- Chinese General Sun Tzu

Source: Oxford University Press

Principles of Incident Response and Disaster Recovery, 2nd Edition

Overview of Risk Management (cont’d.)

Know yourself

Identify, examine, and understand the information and systems currently in place

Asset: information and systems that use, store, and transmit information

Question to ask when protecting assets

What are they?

How do they add value to the organization?

To which vulnerabilities are they susceptible?

Have periodic review, revision, and maintenance of control mechanisms

Principles of Incident Response and Disaster Recovery, 2nd Edition

Overview of Risk Management (cont’d.)

Know the enemy

Identify, examine, and understand threats

Determine threat aspects affecting the organization and the security of the assets

List threats prioritized by importance

Conduct periodic management reviews

Verify completeness and accuracy of asset inventory

Review and verify identified threats and vulnerabilities

Review current controls and mitigation strategies

Review cost effectiveness and deployment issues

Verify ongoing effectiveness of every control

Principles of Incident Response and Disaster Recovery, 2nd Edition

Risk Identification

Identify, classify, and prioritize information assets

Threat identification process begins afterwards

Asset examined to identify vulnerabilities

Controls identified

Controls assessed

Regarding capability to limit possible losses should attack occur

Principles of Incident Response and Disaster Recovery, 2nd Edition

Asset Identification and Value Assessment

Iterative process of identifying assets and assessing their value

Information asset classification

Classify with respect to security needs

Components must be specific for the creation of various priority levels

Components ranked according to criteria established by the categorization

Use comprehensive and mutually exclusive categories

Establish clear and comprehensive category sets

Principles of Incident Response and Disaster Recovery, 2nd Edition

Asset Identification and Value Assessment (cont’d.)

Information asset valuation

Is this asset the most critical to the organizations’ success?

Does it generate the most revenue?

Does it generate the most profit?

Would it be the most expensive to replace?

Will it be the most expensive to protect?

If revealed, would it cause the most embarrassment or greatest damage?

Does the law or other regulation require us to protect this asset?

Principles of Incident Response and Disaster Recovery, 2nd Edition

Asset Identification and Value Assessment (cont’d.)

Answers determine weighting criteria

Used for asset valuation and impact evaluation

Must decide criteria best suited to establish the information asset value

Perform weighted factor analysis

Calculates relative importance of each asset

Assign score from 0.1 to 1.0 for each critical factor

Assign each critical factor a weight from 1 to 100

Identify, document and add company-specific criteria

Principles of Incident Response and Disaster Recovery, 2nd Edition

Asset Identification and Value Assessment (cont’d.)

Principles of Incident Response and Disaster Recovery, 2nd Edition

Data Classification and Management (cont’d.)

Data classification schemes

Procedures requiring organizational data to be classified into mutually exclusive categories

Based on need to protect data category confidentiality

Military specialized classification ratings

“Public” to “For Official Use Only” to “Confidential“ to “Secret” to “Top Secret”

Principles of Incident Response and Disaster Recovery, 2nd Edition

Data Classification and Management (cont’d.)

Alternative information classification scheme

Public: for general public dissemination

For official use: Not particularly sensitive but not for public release

Sensitive: important to the business and could cause embarrassment or loss of market share if revealed

Classified: requires utmost security; disclosure could severely impact the organization

Personnel information security clearances

On a need-to-know basis

Principles of Incident Response and Disaster Recovery, 2nd Edition

Threat Identification

Conduct a threat assessment

Which threats present a danger to the organization’s assets in the given environment?

Which threats represent the most danger to the organization’s information?

Which threats would cost the most to recover from if there was an attack?

Which threats require the greatest expenditure to prevent?

Principles of Incident Response and Disaster Recovery, 2nd Edition

Vulnerability Identification

Review each asset and each threat it faces

Create list of vulnerabilities

Examine how each threat could be perpetrated

List organization’s assets and its vulnerabilities

Notes

Threat may yield multiple vulnerabilities

People with diverse backgrounds should participate

Principles of Incident Response and Disaster Recovery, 2nd Edition

Risk Assessment

Process of assigning a risk rating or score to each information asset

Goal

Determine relative risk of each vulnerability using various factors

Likelihood

Probability that a specific vulnerability will be successfully attacked

Many asset/vulnerability combinations have external references for likelihood values

Principles of Incident Response and Disaster Recovery, 2nd Edition

Valuation of Information Assets

Assign weighted scores for the value to the organization of each information asset

Re-ask questions described in the “Threat Identification” section

Which of these questions is most important to the protection of the organization’s information?

Examine how current controls can reduce risk faced by specific vulnerabilities

Impossible to know everything about each vulnerability

Principles of Incident Response and Disaster Recovery, 2nd Edition

Risk Determination

Risk = (likelihood of vulnerability x value) – percent of risk currently controlled + uncertainty of assumptions

Qualitative Risk Management

General categories and ranking used to evaluate risk

Factor Analysis of Information Risk (FAIR) strategy

Promoted by CXOWARE

Residual risk

Remaining risk after control applied

Principles of Incident Response and Disaster Recovery, 2nd Edition

Identify Possible Controls

Controls, safeguards, and countermeasures

Represent security mechanisms, policies, and procedures that reduce risk

Three types of security policies

Enterprise information security policy

Issue-specific policies

Systems-specific policies

Programs

Activities performed within the organization to improve security

Principles of Incident Response and Disaster Recovery, 2nd Edition

Risk Control Strategies

Defense approach (preferred approach)

Attempts to prevent vulnerability exploitation

Risk defense methods

Defense through application of policy

Defense through training and education programs

Defense through technology application

Usually requires technical solutions

Eliminate asset exposure

Attempt to reduce risk to an acceptable level

Principles of Incident Response and Disaster Recovery, 2nd Edition

Risk Control Strategies (cont’d.)

Implement security controls and safeguards

Deflect attacks to minimize the successful probability

Transference

Attempts to shift risk to other assets, processes, organizations

Rethink how services offered

Revise deployment models

Outsource to other organizations

Purchase insurance

Implement service contracts with providers

Principles of Incident Response and Disaster Recovery, 2nd Edition

Risk Control Strategies (cont’d.)

Mitigation

Attempts to reduce impact caused by the vulnerability exploitation

Through planning and preparation

Includes contingency planning

Business impact analysis

Incident response plan

Disaster recovery plan

Business continuity plan

Requires quick attack detection and response

Relies on existence and quality of the other plans

Principles of Incident Response and Disaster Recovery, 2nd Edition

Risk Control Strategies (cont’d.)

Acceptance

Do nothing to protect an information asset

Accept the outcome of its potential exploitation

Only valid when the organization has:

Determined the level of risk

Assessed the probability of attack

Estimated potential damage that could occur

Performed a thorough cost-benefit analysis

Evaluated controls

Decided asset did not justify the cost of protection

Principles of Incident Response and Disaster Recovery, 2nd Edition

Risk Control Strategies (cont’d.)

Termination

Difference from acceptance

Remove asset from the environment representing risk

Two main reasons

Cost of protecting an asset outweighs its value

Too difficult or expensive to protect asset compared to value or advantage asset offers

Termination must be a conscious business decision

Not simple asset abandonment

Principles of Incident Response and Disaster Recovery, 2nd Edition

Contingency Planning and Its Components

Contingency plan

Used to anticipate, react to, and recover from events threatening events

Restores organization to normal modes of business operations

Four subordinate functions

Business impact assessment (BIA)

Incident response planning (IRP)

Disaster recovery planning (DRP)

Business continuity planning (BCP)

Principles of Incident Response and Disaster Recovery, 2nd Edition

Business Impact Analysis

Business impact analysis (BIA)

Investigation and assessment of the impact of attacks

Adds detail to prioritized threat and vulnerability list created in the risk management process

Provides detailed scenarios of potential impact of each type of attack

Principles of Incident Response and Disaster Recovery, 2nd Edition

Incident Response Plan

Incident

Any clearly identified attack on assets

Incident response plan (IRP)

Deals with the identification, classification, response, and recovery from an incident

Assesses the likelihood of imminent damage

Informs key decision makers

Enables the organization to take coordinated action

Principles of Incident Response and Disaster Recovery, 2nd Edition

Disaster Recovery Plan

Preparation for and recovery from natural or man-made disaster

Includes:

Preparations for the recovery process

Strategies to limit losses during the disaster

Detailed steps to follow after immediate danger

Focus

Preparation before the incident

Actions taken after the incident

Principles of Incident Response and Disaster Recovery, 2nd Edition

BCP and BRP

Business continuity plan (BCP)

Expresses how to ensure critical business functions continue at an alternate location

After catastrophic incident or disaster

Used when DRP cannot restore primary site operations

Most strategic and long-term plan

Business resumption plan (BRP)

Emerging new concept in contingency planning

Merges the DRP and BCP into a single process

Principles of Incident Response and Disaster Recovery, 2nd Edition

Contingency Planning Timeline

Steps in contingency planning

IR plan focuses on immediate response

May move to DRP and BCP if disastrous

DR plan focuses on restoring systems at original site

BC runs concurrently with DRP

When major or long-term damage occurs

IRP, DRP, and BCP distinction

When each comes into play during the incident

Principles of Incident Response and Disaster Recovery, 2nd Edition

Contingency Planning Timeline (cont’d.)

Seven steps in NIST SP 800-34, Revision 1

Principles of Incident Response and Disaster Recovery, 2nd Edition

Role of Information Security Policy in Developing Contingency Plans

Policy needs to enforce information protection requirements

Before, during, and after incident

Quality security programs

Begin and end with policy

Information security

A management problem

Difficulties in shaping policy

Must never conflict with laws; must stand up in court if challenged; must be properly administered

Principles of Incident Response and Disaster Recovery, 2nd Edition

Key Policy Definitions

Policy

Plan or course of action

Conveys instructions from senior management to those who make decisions, take action, perform duties

Organizational law

Dictates acceptable and unacceptable behavior

Defines penalties for violations

Standard

Detailed statement of what must be done to comply

De facto standard (informal standard)

De jure standard (formal standard)

Principles of Incident Response and Disaster Recovery, 2nd Edition

Key Policy Definitions (cont’d.)

Mission

Written statement of an organization’s purpose

Vision

Written statement about organization’s goals

Strategic planning

Process of moving organization toward its vision

Information security policy

Provides rules for protecting information assets

Enterprise information security policy, issue-specific security policy, systems-specific security policy

Principles of Incident Response and Disaster Recovery, 2nd Edition

Enterprise Information Security Policy

Enterprise information security policy (EISP)

Based on and directly supports the mission, vision, and direction of the organization

Executive-level

Sets strategic direction, scope, and tone for all security efforts

Contains requirements to be met

Defines purpose, scope, constraints, and applicability

Assigns responsibilities

Addresses legal compliance

Principles of Incident Response and Disaster Recovery, 2nd Edition

Issue-Specific Security Policy

Issue-specific security policy (ISSP)

Addresses specific areas of technology

Three common approaches to creating ISSPs

Independent ISSP documents, each tailored to a specific issue

A single comprehensive ISSP document covering all issues

Modular ISSP document that unifies policy creation and administration while maintaining each specific issue’s requirements

Principles of Incident Response and Disaster Recovery, 2nd Edition

Issue-Specific Security Policy (cont’d.)

Statement of policy

Defines scope, responsibility for implementation, technologies and issues being addressed

Authorized access and usage of equipment

Addresses who can use technology and for what it can be used

Defines “fair and responsible use”

Addresses key legal issues

Prohibited usage of equipment

Outlines what technology cannot be used for

Principles of Incident Response and Disaster Recovery, 2nd Edition

Issue-Specific Security Policy (cont’d.)

Systems management

Focuses on users’ relationship to management

Violations of policy

Specifies penalties and how to report violations

Policy review and modification

Procedures and a timetable for periodic review so users do not circumvent it as it grows obsolete

Limitations of liability

States company will not protect user and is not liable for their actions

Principles of Incident Response and Disaster Recovery, 2nd Edition

Systems-Specific Policy

Systems-specific security policies (SysSPs)

Standards and procedures used when configuring or maintaining systems

Access control lists (ACLs)

Govern rights and privileges of particular users to particular systems

Configuration rules

Specific configuration codes entered into security systems

Principles of Incident Response and Disaster Recovery, 2nd Edition

Systems-Specific Policy (cont’d.)

ACL policies

Translated into configuration sets

Controls access to systems

Regulate the who, what, when, and where of access

ACL rules

Known as capability tables, user profiles, user policies

Specify what a user can and cannot do with resources

Rule policies

More specific than ACLs

May or may not deal with users directly

Principles of Incident Response and Disaster Recovery, 2nd Edition

Policy Management

Policies

Constantly changing and growing

Must be properly disseminated

Security policies must have the following

Individual responsible for creation, revision, distribution, and storage

Schedule of reviews

Mechanism for recommendations for revisions

Policy/revision date; possibly “sunset” expiration date

Policy management software (optional)

Principles of Incident Response and Disaster Recovery, 2nd Edition

Summary

Information security protects information and its critical elements

C.I.A. triangle: basis for CNSS model

Threat: entity posing potential for loss to an asset

Asset: has value to the organization

Vulnerability: weakness in protection mechanisms

Risk management process: identify vulnerabilities and taking steps to protect assets

Principles of Incident Response and Disaster Recovery, 2nd Edition

Summary (cont’d.)

Risk identification: process of identifying risks

Risk control: applying controls to reduce risk

Contingency planning: avoidance, transference, mitigation, acceptance strategies

Business impact analysis: assess attack type impact

Incident response plan: actions taken when an incident in progress

Disaster recovery plan: preparation for and recovery from a disaster

Principles of Incident Response and Disaster Recovery, 2nd Edition

Summary (cont’d.)

Business continuity plan: ensures critical business functions continue after a disaster

Policies: organizational laws dictating behavior

Enterprise information security policy: sets strategic scope, direction, tone

Issue-specific security policy: addresses specific areas of technology

Systems-specific security policy: used when configuring or maintaining systems

Principles of Incident Response and Disaster Recovery, 2nd Edition

SAGE PUBLISHING: OUR STORY We believe in creating fresh, cutting-edge content to help you prepare your students to thrive in today's business world and be tomorrow's industry leaders. Founded in 1965 by 24-year-old entrepreneur Sara Miller McCune, SAGE continues its legacy of making research accessible and fostering analytical thinking.

• Our authors draw upon their remarkable teaching, research, and real-world experience to provide you with the most current and applied content.

• As a student-friendly publisher, we offer affordable choices so students can choose the option that works best for them.

• Being permanently independent means we are fiercely committed to publishing the highest-quality resources.

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

Human Resource Information Systems

Fourth Edition

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

Human Resource Information Systems

Fourth Edition

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

To my wife, Barbara, and my sons Sean, Colin, and Timothy, and especially to my granddaughter, Isabella

—M. J. K.

To my wife, Kelley, and my daughters, Rachel and Katherine

—R. D. J.

Sara Miller McCune founded SAGE Publishing in 1965 to support the dissemination of usable knowledge and educate a global community. SAGE publishes more than 1000 journals and over 800 new books each year, spanning a wide range of subject areas. Our growing selection of library products includes archives, data, case studies and video. SAGE remains majority owned by our founder and after her lifetime will become owned by a charitable trust that secures the company’s continued independence.

Human Resource Information Systems

Fourth Edition

Editors

Michael J. Kavanagh University at Albany, State University of New York

Richard D. Johnson University at Albany, State University of New York

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

Human Resource Information Systems

Fourth Edition

Editors

Michael J. Kavanagh University at Albany, State University of New York

Richard D. Johnson University at Albany, State University of New York

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

All rights reserved. No part of this book may be reproduced or utilized in any form or by any means, electronic or mechanical, including photocopying, recording, or by any information storage and retrieval system, without permission in writing from the publisher.

Printed in the United States of America

Library of Congress Cataloging-in-Publication Data

Names: Kavanagh, Michael J., editor. | Johnson, Richard David, editor.

Title: Human resource information systems : basics, applications, and future directions / editors Michael J. Kavanagh, State University of New York, Albany, Richard D. Johnson, State University of New York, Albany.

Description: Fourth edition. | Los Angeles : SAGE, [2018] | Includes bibliographical references and index.

Identifiers: LCCN 2017008269 | ISBN 9781506351452 (pbk. : alk. paper)

Subjects: LCSH: Personnel management—Information technology. | Personnel management—Data processing.

Classification: LCC HF5549.5.D37 H86 2018 | DDC 658.300285—dc23 LC record available at https://lccn.loc.gov/2017008269

This book is printed on acid-free paper.

17 18 19 20 21 10 9 8 7 6 5 4 3 2 1

FOR INFORMATION:

SAGE Publications, Inc.

2455 Teller Road

Thousand Oaks, California 91320

E-mail: [email protected]

SAGE Publications Ltd.

1 Oliver’s Yard

55 City Road

London EC1Y 1SP

United Kingdom

SAGE Publications India Pvt. Ltd.

B 1/I 1 Mohan Cooperative Industrial Area

Mathura Road, New Delhi 110 044

India

SAGE Publications Asia-Pacific Pte. Ltd.

3 Church Street

#10-04 Samsung Hub

Singapore 049483

Acquisitions Editor: Maggie Stanley

Developmental Editor: Neda Dallal

eLearning Editor: Katie Ancheta

Editorial Assistant: Ashley Mixson

Production Editor: Bennie Clark Allen

Copy Editor: Lana Todorovic-Arndt

Typesetter: C&M Digitals (P) Ltd.

Proofreader: Sarah J. Duffy

Indexer: Jeanne R. Busemeyer

Cover Designer: Candice Harman

Marketing Manager: Ashlee Blunk

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

BRIEF CONTENTS

Preface xxii

Acknowledgments xxvii

PART I • HUMAN RESOURCE INFORMATION SYSTEMS (HRIS): THE BACKBONE OF MODERN HR 1

Chapter 1 • A Brief History and Overview of Technology in HR 2

Chapter 2 • Database Concepts and Applications in HRIS 24

Chapter 3 • Systems Considerations in the Design of an HRIS: Planning for Implementations 45

PART II • MANAGING HRIS IMPLEMENTATIONS 67

Chapter 4 • The Systems Development Life Cycle and HRIS Needs Analysis 68

Chapter 5 • System Design and Acquisition 91

Chapter 6 • Change Management and Implementation 118

Chapter 7 • Cost Justifying HRIS Investments 148

PART III • ELECTRONIC HUMAN RESOURCE MANAGEMENT (eHRM) 181

Chapter 8 • HR Administration and HRIS 182

Chapter 9 • Talent Management 224

Chapter 10 • Recruitment and Selection in an Internet Context 257

Chapter 11 • Training and Development: Issues and HRIS Applications 289

Chapter 12 • Performance Management, Compensation, Benefits, Payroll, and HRIS 325

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

PART IV • ADVANCED HRIS APPLICATION AND FUTURE TRENDS 357

Chapter 13 • HRIS and International HRM 358

Chapter 14 • HR Metrics and Workforce Analytics 387

Chapter 15 • HRIS Privacy and Security 422

Chapter 16 • HRIS and Social Media 444

Chapter 17 • The Future of HRIS: Emerging Trends in HRM and IT 463

Glossary 480

References 497

Author Index 528

Subject Index 538

About the Editors 557

About the Contributors 558

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

DETAILED CONTENTS

Preface xxii

Acknowledgments xxvii

PART I • HUMAN RESOURCE INFORMATION SYSTEMS (HRIS): THE BACKBONE OF MODERN HR 1

Chapter 1 • A Brief History and Overview of Technology in HR 2 By Richard D. Johnson and Michael J. Kavanagh

Editors’ Note 2

Chapter Objectives 3

HRIS in Action 3

Introduction 6

HR Activities 6

Technology and Human Resources 7 What Is an HRIS? 7 eHRM and HRIS 8 The Value and Risks of HRIS 9 Types of HRIS 11

Evolution of HRM and HRIS 12 Pre–World War II 12 Post–World War II (1945–1960) 13 Social Issues Era (1963–1980) 15 Cost-Effectiveness Era (1980–Early 1990s) 15 ERPs and Strategic HRM (1990–2010) 16 “The Cloud” and Mobile Technologies (2010–Present) 17

HRIS Within the Broader Organization and Environment 18

Themes of the Book 19

Summary 20

Key Terms 20

Discussion Questions 21

Case Study: Position Description and Specification for an HRIS Administrator 21

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

Chapter 2 • Database Concepts and Applications in HRIS 24 By Janet H. Marler and Barry D. Floyd

Editors’ Note 24

Chapter Objectives 25

Introduction 25

Data, Information, and Knowledge 26

Database Management Systems 27 Early DBMSs 29 Relational DBMSs 30 Data Sharing Between Different Functions 31 Data Sharing Between Different Levels 31 Data Sharing Across Locations 32

Key Relational Database Terminology 33 Entities and Attributes 33 Tables 33 Relationships, Primary Keys, and Foreign Keys 34 Queries 35 Forms 36 Reports 37

MS Access—An Illustrative Personal Database 37 Designing an MS Access Database 38 HR Database Application Using MS Access 39 Other HR Databases 39

Data Integration: Database Warehouses, Business Intelligence, and Data Mining 41

Big Data and NOSQL Databases 42

Summary 43

Key Terms 44

Discussion Questions 44

Case Study: Building an Application Database 44

Chapter 3 • Systems Considerations in the Design of an HRIS: Planning for Implementations 45

By Michael D. Bedell and Michael L. Canniff

Editors’ Note 45

Chapter Objectives 46

HRIS in Action 46

Introduction 47

HRIS Customers/Users: Data Importance 48 Employees 49 Nonemployees 51 Important Data 52

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

HRIS Architecture 52 HRIS Evolution 52 Client-Server (Two-Tier) Architecture 53 Three-Tier and N-Tier Architecture 53 Cloud Computing—Back to the Future?! 56 Mobile Access 57 Security Challenges 57

Best of Breed 58 Talent Management 59 Time and Attendance 59 Payroll 60 Benefits 60

Planning for System Implementation 61

Summary 62

Key Terms 63

Discussion Questions 63

Case Study: Vignette Revisited 63 � INDUSTRY BRIEF 65

PART II • MANAGING HRIS IMPLEMENTATIONS 67

Chapter 4 • The Systems Development Life Cycle and HRIS Needs Analysis 68

By Lisa M. Plantamura and Richard D. Johnson

Editors’ Note 68

Chapter Objectives 69

HRIS in Action 69

Introduction 70

The Systems Development Life Cycle 71

Analysis 73

Needs Analysis 74 1. Needs Analysis Planning 75 2. Observation 77 3. Exploration 80 4. Evaluation 84 5. Reporting 85

Summary 87

Key Terms 87

Discussion Questions 88

Case Study: “Planning the Needs of Other Organizations” 88 � INDUSTRY BRIEF 89

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

Chapter 5 • System Design and Acquisition 91 By Richard D. Johnson and James H. Dulebohn

Editors’ Note 91

Chapter Objectives 92

HRIS in Action 92

Introduction 93

Design Considerations During the Systems Development Life Cycle 94 Logical Design 95 Two Ways to View an HRIS: Data Versus Process 96 Logical Process Modeling With Data Flow Diagrams 97 Creating and Using the DFD 99 Physical Design 100

Working With Vendors 104 Vendor Selection 108

Assessing System Feasibility 109 Technical Feasibility 109 Operational Feasibility 110 Legal and Political Feasibility 112 Economic Feasibility 112

Summary 113

Key Terms 113

Discussion Questions 114

Case Study: Vignette Continued 114 � INDUSTRY BRIEF 116

Chapter 6 • Change Management and Implementation 118 By Richard D. Johnson and Michael J. Kavanagh

Editors’ Note 118

Chapter Objectives 119

HRIS in Action 119

Introduction 120 Change Management 121 The Change Management Process: Science and Art 122

Models of the Change Process 123 Overview of Organizational Change 123

Selected Change Models 124 Lewin’s Change Model 124 Change Equation Formula 127 Nadler’s Congruence Model 127 Kotter’s Process of Leading Change 129 Important Reminders Regarding Change Models 129

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

Why Do System Failures Occur? 131 Leadership 131 Planning 133 Communication 133 Training 135

HRIS Implementation 136 Data Migration 136 Software Testing 137 System Conversion 137 Documentation 138 Training 139 Resistance to Change 139 User Acceptance 141

Critical Success Factors in HRIS Implementation 142

Summary 144

Key Terms 144

Discussion Questions 144

Case Study: The Grant Corporation 145

Chapter 7 • Cost Justifying HRIS Investments 148 By Kevin D. Carlson and Michael J. Kavanagh

Editors’ Note 148

Chapter Objectives 149

HRIS in Action 149

Introduction 150 Justification Strategies for HRIS Investments 152 Evolution of HRIS Justification 152 Approaches to Investment Analyses Make a Difference: Some Guidelines 153

HRIS Cost-Benefit Analysis 156 Identifying Sources of Value for Benefits and Costs 157 Direct Benefits 157 Indirect Benefits 158

Implementation Costs 161

Estimating the Value of Indirect Benefits 163

Estimating Indirect Benefit Magnitude 163 Direct Estimation 164 Benchmarking 164 Internal Assessment 165

Mapping Indirect Benefits to Revenues and Costs 166

Methods for Estimating the Value of Indirect Benefits 167 Average Employee Contribution 168

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

Estimating the Timing of Benefits and Costs 171 The Role of Variance in Estimates 171

Avoiding Common Problems 172

Packaging the Analysis for Decision Makers 174

Summary 175

Key Terms 175

Discussion Questions 176

Case Study: Justifying an HRIS Investment at Investment Associates 176 � INDUSTRY BRIEF 178

PART III • ELECTRONIC HUMAN RESOURCE MANAGEMENT (eHRM) 181

Chapter 8 • HR Administration and HRIS 182 By Linda C. Isenhour

Editors’ Note 182

Chapter Objectives 183

HRIS in Action 183

Introduction 184

Technical Support for Job Analysis 184 Approaches and Techniques 185 HRIS Applications 186

The HRIS Environment and Other Aspects of HR Administration 187

HRM Administration and Organizing Approaches 187 Service-Oriented Architecture and eXtensible Markup Language 188 Advantages of XML-Enhanced SOA 189 Theory and HR Administration 191 Self-Service Portals and HRIS 193 Shared-Service Centers and HRIS 196 Outsourcing and HRIS 199 Offshoring and HRIS 203 Summary of HR Administration Approaches 205

Legal Compliance and HR Administration 205

HR Administration and Equal Employment Opportunity 207 U.S. Civil Rights Act of 1964, Title VII, and the EEO-1 Report 207 EEO-1 Report (Standard Form 100) 208 EEO-1 and HRIS 209 Occupational Safety and Health Act Record Keeping 211 OSHA Form 300 (Log of Work-Related Injuries and Illnesses) and HRIS 212 Technology, HR Administration, and Mandated Governmental Reporting 213 Summary of Government-Mandated Reports and Privacy Requirements 215

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

HR Strategic Goal Achievement and the Balanced Scorecard 215 HRM and the Balanced Scorecard 217 HR Scorecard and Balanced Scorecard Alignment 218

Summary 219

Key Terms 220

Discussion Questions 220

Case Study: Talent Management at CalleetaCO 221

Chapter 9 • Talent Management 224 By Kevin M. Johns and Michael J. Kavanagh

Editors’ Note 224

Chapter Objectives 225

HRIS in Action 225

Introduction 227 Defining Talent Management 227 Importance of Talent Management 228 The Talent Management Life Cycle 228 Attributes for Talent 230

Job Analysis and Human Resource Planning: Part of TM 232 Job Analysis 232 Human Resource Planning (HRP) 232 Phase 1: Setting HRP Objectives 233 Phase 2: Planning HR Programs 235 Phase 3: Evaluation and Control 236 Workforce Management/Human Resource Planning With an HRIS 236 Long- and Short-Term Strategic Importance of Talent Management 236

Talent Management and Corporate Strategy 237

Anticipating Change and Creating an Adaptable Workforce 239

Talent Management and Corporate Culture 240

Talent Management and Information Systems 242 The Link Between Talent Management and Human Resource Information Systems 242 Talent Management Software Packages 245

Trends in Talent Management Software 247 Recruiting Top Talent Using Social Networking Sites (SNSs) 248 Using Information Systems to Set Goals and Evaluate Performance 249 Using Analytics for Talent Management 249 Workforce Analytics and Talent Management 250 Measuring the Success of Talent Management 251

Summary 252

Key Terms 253

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

Discussion Questions 254

Case Study: Vignette Case Continued 254 � INDUSTRY BRIEF 255

Chapter 10 • Recruitment and Selection in an Internet Context 257 By Kimberly M. Lukaszewski, David N. Dickter, and Brian D. Lyons

Editors’ Note 257

Chapter Objectives 258

HRIS in Action 258

Introduction 260

Recruitment and Technology 260 The Impact of Online Recruitment on Recruitment Objectives 261 Attributes of the Recruiting Website 269 Recruitment Strategies and Social Networking 272 The Relationship of e-Recruiting and HRIS 272

Online Recruitment Guidelines 273

Selection and Technology 274 What Are Selection Tests and Assessments, and Why Are They Used? 274 Why Is Understanding Assessment Important for HRIS? 276 Technology Issues in Selection 276 Applying HRIS to Selection and Assessment 281 Demonstrating the HRM’s Value With HRIS Selection Applications 282

Summary 285

Key Terms 285

Discussion Questions 286

Case Study: Recruitment and Selection in a Global Organization 286

Chapter 11 • Training and Development: Issues and HRIS Applications 289

By Ralf Burbach and Steven Charlier

Editors’ Note 289

Chapter Objectives 290

HRIS in Action 290

Introduction 292

Training and Development: Strategic Implications and Learning Organizations 293 Systems Model of Training and Development 296

Training Metrics and Cost-Benefit Analysis 310

HRIS Applications in Training 312 HRIS/Learning Applications: Learning Management Systems 316 HRIS T&D Applications: Implementation Issues 319

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

Summary 321

Key Terms 321

Discussion Questions 322

Case Study: Training and Development at Meddevco 322 � INDUSTRY BRIEF 323

Chapter 12 • Performance Management, Compensation, Benefits, Payroll, and HRIS 325

By Charles H. Fay and Renato E. Nardoni

Editors’ Note 325

Chapter Objectives 326

HRIS in Action 326

Introduction 328 The Meaning of Work 328

Performance Management 330 Overview 330 Typical Data Inputs 334 Typical Reports 336 Data Outflows 336 Decision Support 336

Compensation 338 Overview 338 Typical Data Inputs 341 Typical Reports 342 Data Outflows 342 Decision Support 342

Benefits 344 Overview 344 Typical Data Inputs 346 Typical Reports 347 Data Outflows 347 Decision Support 348

Payroll 350 Overview 350 Typical Data Inputs 350 Typical Reports 352 Data Outflows 352 Decision Support 352

Summary 352

Key Terms 353

Discussion Questions 354

Case Study: Grandview Global Financial Services, Inc. 354

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

PART IV • ADVANCED HRIS APPLICATIONS AND FUTURE TRENDS 357

Chapter 13 • HRIS and International HRM 358 By Michael J. Kavanagh, Miguel R. Olivas-Luján, and John W. Michel

Editors’ Note 358

Chapter Objectives 359

HRIS in Action 359

Introduction 360 Types of International Business Operations 362 Going Global 364 Differences in HRM in MNEs 367 Key HR Management Issues in MNEs 368

HR Programs in Global Organizations 370 International Staffing 370 Selecting Global Managers: Managing Expatriates 370 Training and Development of Expatriates 374 Performance Appraisal in MNEs 377 Managing International Compensation 378

HRIS Applications in IHRM 381 Introduction 381 Organizational Structure for Effectiveness 381 IHRM–HRIS Administrative Issues 382 HRIS Applications in MNEs 383

Summary 384

Key Terms 384

Discussion Questions 385

Case Study: Global Issues in a Multinational Company 385

Chapter 14 • HR Metrics and Workforce Analytics 387 By Kevin D. Carlson and Michael J. Kavanagh

Editors’ Note 387

Chapter Objectives 388

HRIS in Action 388

Introduction 389

A Brief History of HR Metrics and Analytics 390

Limitations of Historical Metrics 396

Contemporary HR Metrics and Workforce Analytics 397 Understanding Workforce Analytics Practices 397 HR Metrics 397 Workforce Analytics 397

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

HR Metrics, Workforce Analytics, and Organizational Effectiveness 399 A Common and Troublesome View 400 Maximizing the Impact of Workforce Analytics Efforts 400 Triage in Evaluating Workforce Analysis Opportunities 401

So Where Are the Best Workforce Analytics Opportunities Likely to Be Found? 402 HR Process Efficiency 402 Operational Effectiveness 402 Strategic Realignment 403 Starting With the End in Mind 403

An Example Analysis: The Case of Staffing 405 Evaluating Recruitment Effectiveness (D3) 407 Evaluating the Effectiveness of Job Offer Decisions (D4) 408 Evaluating Job Acceptance Performance (D5) 410 Assessing the Financial Impact of Staffing Decisions: Utility Analysis 412

Building a Workforce Analytics Function 413 Getting Started 413 Understanding Why 413 Putting HR Metrics and Analytics Data in Context 414 Reporting What We Find 415 HR Dashboards 416

Useful Things to Remember About HR Metrics and Analytics 417 Don’t “Do Metrics” 417 Bigger Is Not Always Better 417 HR Metrics and Analytics Is a Journey—Not a Destination 417 Be Willing to Learn 418 Avoid the Temptation to Measure Everything Aggressively 418 Workforce Analytics and the Future 418

Summary 419

Key Terms 419

Discussion Questions 420

Case Study: Regional Hospital 420

Chapter 15 • HRIS Privacy and Security 422 By Humayun Zafar and Dianna L. Stone

Editors’ Note 422

Chapter Objectives 423

HRIS in Action 423

Introduction 423

Employee Privacy 425 Unauthorized Access to Information 426 Unauthorized Disclosure of Information 427

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

Data Accuracy Problems 427 Stigmatization Problems 428 Use of Data in Social Network Websites 429 Lack of Privacy Protection Policies 429

Components of Information Security 430 Brief Evolution of Security Models 430 Security Threats 432

Information Policy and Management 436 Fair Information Management Policies 436 Effective Information Security Policies 438 Contingency Planning 440

Summary 441

Key Terms 441

Discussion Questions 442

Case Study: Practical Applications of an Information Privacy Plan 442

Chapter 16 • HRIS and Social Media 444 By Stephanie Black

Editors’ Note 444

Chapter Objectives 445

Introduction 445

Global Usage of Social Media 446

Social Media and HR Practices 448 Organizational Recruitment and Selection 448 Training and Development 451 Internal Communication and Engagement 452

Concerns Over Social Media 453

Corporate Social Media Policies 453 Recruitment and Selection 454 Validity of SMWs in Selection 455 Privacy Concerns 456 Diversity Concerns 457 Federal and State Guidelines 458

Research-Based Tips for the Use of Social Media in HR 459

Summary 461

Key Terms 461

Discussion Questions 462

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

Chapter 17 • The Future of HRIS: Emerging Trends in HRM and IT 463 By Richard D. Johnson and Michael J. Kavanagh

Editors’ Note 463

Chapter Objectives 464

Introduction 464

Future Trends in HRM 465 Health and Wellness 465 Business Intelligence and People Analytics 466 Demographic Workforce Changes 467 Employee Engagement 468 Growing Complexity of Legal Compliance 468 Virtualization of Work 469

Future Trends in HRIS 470 Bring Your Own Device 470 Gamification 471 Web 2.0 and Social Networking 473 Internet of Things 474 Open-Source Software 476 An Evolving Industry 477 Evolving HRIS Technology Strategy 477 HRIS Moves to Small Businesses 478

Future Trends in Workforce Technologies 478

Summary 479

Key Terms 479

Glossary 480

References 497

Author Index 528

Subject Index 538

About the Editors 557

About the Contributors 558

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

xxii

PREFACE

In his book Good to Great, Jim Collins notes, “Great vision without great people is irrel-evant.” In a sense, this quote gets at the heart of human resources—attracting, hiring, motivating, training, and retaining the best people for your organization. However, to be truly successful in this mission, organizations have to invest in technology to support all aspects of their human resources. In this fourth edition of Human Resource Information Systems: Basics, Applications, and Future Directions, we have several goals. First, we want to update the text to reflect the current use of technology in organizations. The core human resource information system (HRIS), although still the center of any human resources (HR) technology investments, is no longer the only technology supporting HR. New technologies such as mobile devices and social media are driving changes in how organizations deploy technology in HR. Second, we wish to continue to improve the content and the usefulness of the content for faculty and students. Third, we continue with our goals of presenting a broad-based perspective on HRIS, one which includes a focus on developing and implementing these systems, an understanding of how these systems impact the practice of HR across a number of functions, and finally, a discus- sion of timely and important developments in these systems (e.g., metrics, social media, international human resource management [HRM]). Although there have been several books on HRIS published, most authors have focused only on one aspect or dimension of the HRIS field, for example, on e-HRM, Web-based HR, or the strategic deployment of HRIS in a global context.

In the preface to the first edition of this book, we note that Kavanagh et al. (1990) stated that “among the most significant changes in the field of human resources man- agement in the past decade has been the use of computers to develop what have become known as human resource information systems (HRIS)” (p. v). We also argued that the introduction of computers to the field of HRM during the 1980s and early 1990s was a revolutionary change. That is, HRM paper systems in file cabinets were replaced by HRM software on mainframes and PCs. To keep up with these technological changes in HRM, companies were forced to adapt, even though it was quite expensive, in order to remain competitive in their markets. Although we have previously suggested that the changes since the early 1990s were evolutionary, it is clear that in the past five years, we have entered another period of revolutionary change. No longer are compa- nies purchasing an HRIS, customizing it to fit their needs, and installing it locally. Instead, today organizations are moving to cloud computing where they “rent” space to maintain their data and rely on the vendors to manage and support the system. In addition, HR is taking advantage of systems outside of organizational control, such as Twitter, Facebook, Instagram, YouTube, and more to support employees throughout the employment life cycle. Thus, managers and organizations must develop policies to address this vastly different environment, where much of the data supporting HRIS

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

Preface xxiii

is accessed remotely and often is stored on systems not under the direct control of the organization.

Along with these changes in technology, a revolution has come to the practice of human resources. By adopting software to support HR functioning, HR now has more information on employees, and can use this understanding to better attract candidates, hire better employees, and more effectively manage them. In other words, these changes have meant that there have been significant advances in the use of people resources in managerial decisions. Thus, the role of HRM has evolved so that now it is increasingly viewed as a strategic partner in the organization. In addition, the role of an HR profes- sional is changing, and the most successful HR professionals will have both HR exper- tise, as well as strong knowledge and appreciation for a how a variety of technology tools can support “people practices” within HR and within the firm.

What do these changes mean for the new learner with a background in HRM or information technology (IT), who is trying to understand the HRIS field? Although it may be tempting to think that the optimal approach is to train students on the latest HRIS software and the latest trends in HRIS, in reality this would be like starting with Chapter 17 of this book and then proceeding backward through the book. Unfortunately, many people do, in fact, focus on learning the actual software tool itself (e.g., the HRIS) and the technological advances in HRIS without understanding the basics first. The approach we take in this book, and one we recommend, is to start with an understanding of the evolutional changes to technology and how these changes have transformed HR practices (e.g., how HRM moved from using paper records in file cabinets to the com- puterization of the HR function), and how this interplay between technology and human resources has changed, and will continue to change, the field of HRIS. Only after under- standing these changes will the learner be able to effectively understand how advances in technology can help their organization manage their HR function more effectively.

NEW ASPECTS OF THE FOURTH EDITION As we do in each edition of the text, we have made substantial revisions in response to feedback from adopters and advances in the field of HRIS. Consistent with the previous version of the text, we have four main parts to the book, but we have adjusted the chapters to more directly relate to the themes of

• HRIS: The Backbone of Modern HR

• Managing HRIS Implementations

• Electronic Human Resource Management (eHRM)

• Advanced HRIS Applications and Future Trends

In our first section, we discuss the modern HRIS, the role that databases play in HRIS, and the key IT architectures and people who interact with the HRIS.

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

xxiv Human Resource Information Systems

Chapter 1 has been rewritten to more clearly describe how technology is transform- ing human resources, define what an HRIS is, discuss how an HRIS contributes to HR functioning, and the advantages and risks of using HRIS. In our second section, “Managing HRIS Implementations,” we focus on the development and implemen- tation of an HRIS in an organizational setting. Chapters 6 and 9 from the previ- ous edition were combined with a greater focus on change management and systems implementation issues (Chapter 6). The major motivation for this change is that with the increased influence of cloud-based systems, fewer and fewer organizations are choosing to build or customize HR software. Thus, success is increasingly dependent upon strong change management processes.

Section 3 focuses on eHRM, or the management and delivery of HR functionality enabled by technology. In this section, each chapter focuses on a major functional area of human resources (e.g., recruitment, selection, training, etc.) and discusses how tech- nology is changing its practice. In addition, these chapters bring in some of the latest research-based recommendations for using HR technology. In Chapter 11, we welcome aboard Steven Charlier, who has brought in some of the latest research findings on e-learning to inform the recommendations made in the e-learning chapter.

The final section of our book focuses on advanced HRIS topics. The chapters in this section have undergone substantial changes. Miguel Olivas-Luján has joined the authors of the international HRIS chapter and has updated the chapter to more fully bring out the issues associated with implementing HRIS in a global organization. Chapter 14 (pre- viously Chapter 7) has been updated to bring out the importance of the decision-making processes to metrics, as well as provide fuller examples of the use of metrics in staffing. Stephanie Black is has joined us in this edition and has contributed a new chapter on the role of social media in HR (Chapter 16). This is an important and timely topic as many organizations are embracing social media despite the potential risks involved. Finally, Chapter 17 has been updated with a discussion of the latest trends in HR and HRIS that will shape the future of the field.

In addition, we have added a number of “industry briefs” to several chapters in the book. In each industry brief, leaders briefly discuss the importance of the chapter’s topic and how it plays out in their firm or industry. Continued positive feedback has con- tributed to our decision to retain our feature “HRIS in Action.” We did these things to improve the text as a learning and teaching tool—we wanted the text and each chapter within it to present a complete learning experience. Thus, we also continued the consis- tent structure across all chapters that was introduced in the previous edition. Chapters contain, in the following order, (1) an editors’ note, (2) chapter objectives, (3) chapter content, (4) chapter summary, (5) a list of key terms, (6) chapter discussion questions, (7) a case with student discussion questions, and (8) the industry brief (where included). This internal consistency for each chapter was established by emphasizing the same chap- ter learning points for the chapter objectives, chapter summary, key terms, and chapter discussion questions. We felt that this within-chapter consistency would aid the learn- ing process of the students and aid the faculty in identifying the important content of each chapter. Likewise, the websites and additional readings have been expanded because of recent changes in the field. In determining to make these changes in the book, the

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

Preface xxv

coeditors worked to make the fourth edition a textbook they would personally be com- fortable using to teach their HRIS courses.

FOURTH EDITION SUMMARY In summary, in this fourth edition, we have described the major advances in the field of HRIS and the relation of HRIS to managerial decision making while, at the same time, exploring the basic concepts of developing, implementing, and maintaining an HRIS. The book represents the intersection of the best thinking and concepts from the two fields of HRM and IT. It was the early intersection of these two fields that changed the role of HR in organizations from record keeper to strategic partner. After introducing the basic concepts of an HRIS combined with new approaches to the operation of HRM in the organization, we then proceed to the more advanced, and evolutionary, techni- cal changes. The basic philosophy of this book is that the integration or harmonization of technology with people management in an HRIS will create a distinct competitive advantage for organizations. We hope that you, the reader, gain this understanding and that you enjoy this book.

COMPANION WEBSITE A password-protected instructor resources site includes test banks, PowerPoint® presentations, case notes, detailed lecture outlines, sample answers to discussion questions in the text, suggested class activities, a selection of full-text SAGE journal articles, and web resources. These materials are available at study.sagepub.com/kavanagh4e.

Students can also log on to the companion site and access the SAGE journal articles, eFlashcards, and Web resources at study.sagepub.com/kavanagh4e.

ACKNOWLEDGMENTS Undertaking a book like this cannot be done without the contribution of many individu- als. Each of you have our thanks, for without you, this book would not be as successful as it has been. First, to both the new and returning authors of the chapters, thank you! For some of you, this is your fourth time, and we greatly appreciate all the time and effort you have placed into your chapters each and every time. We know how difficult it is to write a chapter for an edited book, particularly when the editors have defined the philosophy and approach used. In addition, special thanks go to those individuals who provided invaluable insights through their evaluations of the edition of this book and its chapters: Dr. Mesut Akdere, University of Wisconsin-Milwaukee; Dr. Yvonne Barry, John Tyler Community College; Gery Markova, W. Frank Barton School of Business, Wichita State University; Marc S. Miller, Adjunct at NYU-Poly—NYC and Long Island University; Frank J. Mueller, MSM, MS, Oakland City University; Jan Mason Rauk,

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

xxvi Human Resource Information Systems

MBA, University of Idaho; and M. Shane Tomblin, Marshall University, College of Business. We also thank the individuals who developed the digital resources for this edition: Sheila Boyson-Rotelli of Lewis University, Tarona Lee of Baruch College, and Todd McKeever of Virginia College.

Again, we again thank Dianna Stone of the University at Albany, SUNY, and Virginia Tech, who has helped us identify potential authors, provided feedback on the book, and co-authored a chapter on privacy and security. Our thanks go to the professionals in the International Association for Human Resource Information Management (IHRIM) and the Society for Human Resource Management (SHRM), who patiently listened and responded to our ideas regarding this book. We would also like to thank Abbie Rickard and Maggie Stanley for their guidance and help in keeping us focused and on track, as well as for their suggestions for resolving technical issues we encountered in writing the book. Finally, we would like to thank Lana Arndt, Ashley Mixson, and Bennie Clark Allen for correcting our grammar as needed, finding missing keywords, and finding those mistyped words and grammatical errors that were done by gremlins.

In particular, we would like to thank our families, who provided the warmth and sup- port we needed when frustration and writer’s block crept in!

—Michael J. Kavanagh and Richard D. Johnson

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

xxvii

ACKNOWLEDGMENTS

SAGE Publishing gratefully acknowledges the following reviewers for their kind assistance:

Syed Adeel Ahmed, Xavier University of Louisiana

Mesut Akdere, University of Wisconsin-Milwaukee

Yvonne Barry, John Tyler Community College

Dan Farrell, Western Michigan University

Ray Gibney, Penn State Harrisburg

Jonathan Halbesleben, University of Alabama

Heidi Helgren, Delta College

Tarona Lee, Baruch College

Gery Markova, Wichita State University

Marc S. Miller, New York University

Frank J. Mueller, Oakland City University

Jan Mason Rauk, University of Idaho

M. Shane Tomblin, Marshall University

Lee Whiteman, La Roche College

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

P A

R T

HUMAN RESOURCE INFORMATION SYSTEMS (HRIS): THE BACKBONE OF MODERN HR

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

16 A BRIEF HISTORY

AND OVERVIEW OF TECHNOLOGY IN HR

RICHARD D. JOHNSON AND MICHAEL J. KAVANAGH

EDITORS’ NOTE

The purpose of this chapter is to provide an introduction to the field of human resource information systems (HRIS), which lies at the intersection of human resource management (HRM) and information technology (IT). A central focus of this chapter is the use of data from the HRIS in support of managerial decision making. The chapter starts with a brief discussion of HRIS and electronic human resource management (eHRM). The history of the field of HRM and the impact of information technology on HRM is covered, as well as the advent of using a human resource information system and the subsequent effects on both HR and IT professionals. The different types of HR activities will be discussed as well as the different types of information systems used in HRIS. The chapter will also discuss the role of an HRIS within this broader organization environment, particularly its alignment with HR and organizational goals. This first chapter lays the groundwork for the remainder of this book, and, consequently, it is important to understand thoroughly the concepts and ideas presented. This chapter contains definitions for a number of terms in common use in the HRM, IT, and HRIS fields. (Note that a glossary defining these terms is also provided at the back of this book.) The cen- tral themes of this book in terms of the development, implementation, and use of an HRIS will also be discussed. A brief overview of the major sections of the book will be presented here as well, one discussing how each chapter is an integral part of the entire field of HRIS. Finally, you should note that the key terms used in this chapter are in bold and contained in a section after the chapter summary. The pat- tern of sections for this chapter will be consistent for all chapters of this book.

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

Chapter 1  A Brief History and Overview of Technology in HR 3

HRIS IN ACTION

Situation Description

To illustrate the importance and use of human resource information systems in con-

temporary human resources departments, this vignette examines the typical memo-

randa that may appear in the inbox of HR professionals and managers. Assume you

are the HR director of a medium-size organization that primarily maintains and uses

manual HR records and systems. This morning, your inbox contains the following

memos that require action today.

Memo 1: A note from the legal department indicates that some female staff mem-

bers have filed an employment discrimination complaint with the local govern-

ment agency responsible for the enforcement of equal opportunity employment.

The female staff members allege that, for the past 10 years, they have been

passed over for promotion because they are women. In order to respond to this

allegation, the legal department requires historical data on the promotions of

both males and females for the past 10 years for all jobs in the company broken

CHAPTER OBJECTIVES

After completing this chapter, you should be able to

• Describe the three types of HR activities • Explain the purpose and nature of an HRIS • Describe the differences between eHRM and HRIS • Explain the value and risks associated with the use of an HRIS • Describe the different types of HRIS • Describe the historical evolution of HRM, including the changing role of

the HR professional • Discuss the evolution of the technology of HRIS • Discuss how the information from an HRIS can assist organizational

decision making • Understand how HRM and HRIS fit within a comprehensive model of

organizational functioning in global business environments

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

4 Part I  Human Resource Information Systems (HRIS): The Backbone of Modern HR

down by department. It also needs the training records for all managers involved

in personnel actions, such as promotions, to ascertain whether or not they have

received training in equal employment provisions, especially in terms of unfair

gender discrimination.

Memo 2: The second item is a complaint from employees working in a remote

location of the company, about 150 miles away. The employees are complaining

that their pay slips are not reaching them on time and that they are finding it diffi-

cult to get timely and accurate information on the most recent leave and benefits

policies of the company.

Memo 3: A letter from the marketing manager states that he has not received

any updated information on the status of his request, made three months ago, to

recruit a new salesperson. The failure to recruit and hire a new salesperson has

had a negative effect on the overall sales of the company’s products over the past

quarter.

Memo 4: A letter from the HR professional in charge of the southwest regional

office says that she is swamped with HR administrative work, particularly per-

sonnel transactions on employees. As a result, she has not been able to meet

employees in her region to describe and begin to implement the recent Employee

Engagement Initiative as required by corporate headquarters.

Memo 5: A note from one of the production managers indicates that he has

received a resignation letter from a highly regarded production engineer. She is

resigning because she has not received the training on new technology that she

was promised when hired. She notes that most of the other production engineers

have attended this training program and have had very positive reactions to it.

Memo 6: A strongly worded note from the director of finance asks the HR depart-

ment to justify the increasing costs associated with its operation. The note

indicates that the HR director needs to develop a business plan for the overall

operation of the HR department to include business plans for all of the HR pro-

grams, such as recruiting and training. Further, the finance director indicates

that unless the business cases can demonstrate a positive cost-benefit ratio, the

budget for the HR department will be reduced, which will lead to reductions in

the HR department professional staff.

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

Chapter 1  A Brief History and Overview of Technology in HR 5

As the HR director, your first thought may be to resign since searching for the informa-

tion required by these memos in the manual records on employees will require several

days if not weeks to complete. However, you have just returned from a professional

conference sponsored by the Society for Human Resource Management (SHRM) and

remember how an HRIS may be what you need! As this chapter and the ones that fol-

low will illustrate, an HRIS enables an HR department to streamline its activities and

the demands placed on it by automating the HR data and processes necessary for the

management of the human capital of the organization. This automation helps develop

the capabilities to produce information and reports on the requests contained in the

memos in the vignette, and these reports will facilitate efficient and effective manage-

rial decision making. While an HRIS cannot make the judgment calls in terms of whom

to recruit or promote, it can certainly facilitate better inputting, integration, and use of

employee data, which will reduce the administrative burden of keeping detailed records

and should aid and enhance decisions about strategic directions.

Need for an HRIS in Decision Situations

If you read the above memos again, you will recognize that each one has a request for

human resource management information that will be used in a decision situation. The

information requested in Memo 1 will help the legal department determine the com-

pany’s potential liability in a workplace gender discrimination situation. This information

may help to determine whether the company should decide to rectify the situation in

terms of an informal settlement with the female staff members or to defend the com-

pany’s promotion procedures as valid—in court if necessary. The information required

in Memo 2 may help the HR department decide to change its payroll procedures as well

as its distribution of benefits information to remote company locations. The information

needed to respond to Memo 3 will impact decisions by the HR department to change

recruitment and selection programs. The response to Memo 4 clearly suggests the need

for the acquisition of an HRIS. The information required to answer Memo 5 may help

in decisions regarding the revision of recruiting and training procedures, especially for

new engineers. The information that would be provided in response to Memo 6 will help

decide the future of the HR department. As you go through this book, look at information

on the capabilities of various human resource information systems, trying to find an HRIS

that would allow you (as the HR director) to respond to each of the six memos in one day.

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

6 Part I  Human Resource Information Systems (HRIS): The Backbone of Modern HR

INTRODUCTION

It’s kind of fun to do the impossible.

—Walt Disney

W hat do you think is keeping CEOs up at night? Although you might think that it may be issues such as increasing stock price and market share, navigating and surviving in a globally competitive environment, or government regulation, according to a recent Harvard Business Review article (Groysberg & Connolly, 2015) the most often mentioned concerns facing their organization are talent related. CEOs are worried about hiring the right individuals; how to properly develop, promote, and retain top talent; and how the employees represent the firm.

To maintain a competitive advantage in the marketplace, firms need to balance their physical, organizational, and human resources to achieve, profit, and survive. Leading management thinkers (i.e., Drucker, Dyson, Handy, Saffo, & Senge, 1997; Porter, 1990) argue that human resource management (HRM) will be the most critical and most challenging for organizations in the 21st century. The most effective and well-respected companies today have innovative and valuable people practices. These organizations know that human resources (HR) cannot afford to simply focus on completing day-to- day activities, but instead, they should focus on outcomes and capabilities that align with the broader organizational goals (Ulrich, Younger, & Brockbank, 2008).

But to do this, they need timely and accurate information on current employees and potential employees in the labor market. The ability of organizations to do this has been greatly enhanced through the use of human resource information systems (HRIS). A basic assumption behind this book is that the effective management of employee infor- mation for decision makers will be the critical process that helps a firm maximize the use of its human resources and maintain competitiveness in its market.

HR ACTIVITIES The goals of HR are to attract, motivate, develop, and retain employees. Typical HR responsibilities involve things such as record keeping, recruiting, selection, training, per- formance management, employee relations, and compensation. Within each functional area, activities can be classified as transactional, traditional, or transformational (Wright, McMahan, Snell, & Gerhart, 1998). Transactional HR activities involve day-to-day transactions such as record keeping—for example, entering payroll information, tracking employee status changes, and the administration of employee benefits. These activities are the costliest and most time-consuming activities that HR undertakes. Wright et al. (1998) estimate that most HR departments spend approximately 65% to 75% of their time on them. Traditional HR activities involve HR programs such as planning, recruiting,

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

Chapter 1  A Brief History and Overview of Technology in HR 7

selection, training, compensation, and performance management. HR departments spend about 15% to 30% of their time on these activities. Traditional activities can have strategic value for the organization if their results or outcomes are consistent with the strategic goals of the organization. Transformational HR activities are those activities that add value to the organization—for example, cultural or organizational change, structural realignment, strategic redirection, and increasing innovation. Because of the time and effort to com- plete transactional and traditional activities, HR departments typically spend only 5% to 15% of their time on transformational activities.

One of the major purposes of the design, development, and implementation of an HRIS is to reduce the amount of time HR employees have to spend on transactional activities, allowing the staff to spend more time on traditional and transformational activities. This notion of using technology to improve transactional activities and accom- plish them more efficiently is the central theme of this book and provides one of the primary justifications for a computer-based system. In later chapters that discuss various HR programs such as selection and training, we will see how a computer-based system can aid in both traditional and transformational activities to make them consistent with the strategic goals of the organization.

TECHNOLOGY AND HUMAN RESOURCES What Is an HRIS? Since the 1940s, technology has been used to support HR processing. In fact, the ear- liest organizational systems were built to support payroll processing due to increasing

FIGURE 1.1 ■ SuccessFactors Employee Home Screen

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

8 Part I  Human Resource Information Systems (HRIS): The Backbone of Modern HR

tax regulations. But, despite its early start, the complexity and data intensiveness of the HRM function has led to it being one of the last management functions to be automated (Bussler & Davis, 2001/2002). This fact does not mean that an HRIS is not important; it just indicates the difficulty of developing and implementing systems in HR compared with other business functions—for example, accounting and supply chain systems. Only recently has HR embraced the use of technology, with estimates suggesting that now nearly all large organizations have implemented systems to support HR processes and functions (CedarCrestone, 2014). These systems can support activities such as online applications, Internet-based selection testing, management of employee information, support of training, succession planning, and more. As a whole, these systems are broadly referred to as human resource information systems. A sample employee home screen for an HRIS is shown in Figure 1.1.

An HRIS is defined as an information system that is focused on supporting HR func- tions and activities, as well as broader organizational “people” processes. A more formalized definition of an HRIS is a system used to acquire, store, manipulate, analyze, retrieve, and distribute information regarding an organization’s human resources to support HRM and managerial decisions. An HRIS is not simply computer hardware and associated HR-related software. It requires cooperation among departments for its best use. That is, in addition to hardware and software, it also includes people, forms, policies and procedures, and data. The major difference between a traditional information system and an HRIS is that the HRIS contains data about people in the organization and can become both the face of HR and the initial system with which new employees interact with the firm.

Note, an information system does not have to include computers. Many small busi- nesses utilize paper-based systems (e.g., stored in files or folders), because historically, the expense of implementing an HRIS were beyond their financial capabilities. Thus, if you work for a small organization, you may find that much of the information in HR is paper based. However, the expense and time associated with paper means that most organiza- tions will invest in technology to support HR. As organizations choose to implement an HRIS, the paper-based systems become the basis upon which the new HRIS is evaluated. For the purpose of this book, however, we will use the term HRIS to refer to a computer- ized system designed to manage the company’s HR.

There are three main ways that an HRIS can add value to HR and the organization. First, by automating processes or transactions, it provides information to help HR con- duct their transactional activities more efficiently. Second, by providing accurate and timely information to the HR personnel and managers, it can help them make better decisions. Finally, by providing more information, by helping HR reshape practices, and by freeing up HR employees’ time, HRIS can help HR more fully support the strategic mission of the firm. For example, HR can provide better information used to support planning for needed employees in a merger, to identify potential discrimination problems in hiring, or to evaluate the effectiveness of programs, policies, or practices (Dulebohn & Johnson, 2013).

eHRM and HRIS The implementation of an HRIS has brought with it an opportunity for HR to update and change their processes to be technology enabled. This technology-enabled collection

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

Chapter 1  A Brief History and Overview of Technology in HR 9

of HR processes has been called electronic human resource management (eHRM) and reflects a new way of “doing” HR. eHRM uses information technology, particularly the Web, as the central component of delivering efficient and effective HR services. This can be best seen through the words of Gueutal and Stone (2005): “Things will look a bit different here. No longer will you deal with an HR professional. . . . The HR portal will take care of you” (p. xv). Essentially, technology becomes the nerve center for dissemi- nating, connecting, and conducting human resources (Strohmeier, 2007). Organizations embracing an eHRM approach don’t simply utilize technology in the support of human resources but instead see technology as enabling the HR function to be done differently by modifying “information flows, social interaction patterns, and communication processes” (Stone & Lukaszewski, 2009, p. 136). It has also been defined as the “implementation and delivery of HR functionality enabled by a[n] HRIS that connects employees, applicants, mangers, and the decisions they make” (Johnson, Lukaszewski, & Stone, 2016, p. 536).

Whereas eHRM is a way of conducting HR, the HRIS is the technology through which eHRM is enabled. An HRIS can include technologies such as databases, small functional systems focused on a single HR application (e.g., performance manage- ment), or a large-scale, integrated enterprise resource planning (ERP) software package and Web-based applications. In today’s environment, it can even be devices such as smartphones and social networking tools that enable employees to access HR data remotely or to connect with others in the organization. Another way of looking at the differences between eHRM and HRIS is that eHRM tends to be more focused on how HR functionality is delivered, and an HRIS is more focused on the systems and technology underlying the design and acquisition of systems supporting the move to eHRM.

The Value and Risks of HRIS An HRIS can add value to HR in many different ways. Research has shown that HR technology can lead to dramatic cost and time savings for organizations. Advantages of HRIS include

• providing a comprehensive information picture as a single, integrated database; this enables organizations to provide structural connectivity across units and activities and to increase the speed of information transactions (Lengnick-Hall & Lengnick-Hall, 2006);

• increasing competitiveness by improving HR operations and management processes;

• improved timeliness and quality of decision making;

• streamlining and enhancing the efficiency and effectiveness of HR administrative functions;

• shifting the focus of HR from the processing of transactions to strategic HRM; and

• improving employee satisfaction by delivering HR services more quickly and accurately.

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

10 Part I  Human Resource Information Systems (HRIS): The Backbone of Modern HR

Specific examples of cost savings include

• reduction of salary planning cycle by over 50% (Gherson & Jackson, 2001),

• reduction of 25% in HR staffing headcount when implementing self-service (Gueutal & Falbe, 2005),

• reduction of 25% in recruiting cycle time (Cober, Brown, Blumenthal, Doverspike, & Levy, 2000),

• reduction of recruitment costs by up to 95% (Cober et al., 2000), and

• training cost reductions of 40%–60% with e-learning (Gill, 2000).

The ability of firms to harness the potential of HRIS depends on a variety of factors, such as

• the size of the organization, with large firms generally reaping greater benefits;

• the amount of top management support and commitment;

• the availability of resources (time, money, and personnel);

• the HR philosophy of the company as well as its vision, organizational culture, structure, and systems;

• managerial competence in cross-functional decision making, employee involve- ment, and coaching; and

• the ability and motivation of employees in adopting change, such as increased automation across and between functions (Ngai & Wat, 2004).

The implementation of an HRIS doesn’t come without risks, though. As with any infor- mation system, there are potential dysfunctional impacts that may occur when an HRIS is implemented (Stone, Stone-Romero, & Lukaszewski, 2003). These include the following:

• Management by computer and substitution of technology for human judgment: Managers may begin to base performance evaluations exclusively from the data captured by the HRIS. Thus, soft skill behaviors such as teamwork and customer service may not be fully considered.

• Privacy concerns: Employees and applicants may feel that their data are being accessed and used by those internal and external to the organization.

• System rigidity and lack of flexibility: Standardization of HR processes can bene- fit the organization, but some systems may not allow for the inevitable exceptions that arise and as the HR legal environment changes.

• Employee stress and resistance to the use of electronic performance monitoring.

• Performance reduction in complex tasks when performance monitoring systems are used.

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

Chapter 1  A Brief History and Overview of Technology in HR 11

Types of HRIS Although there are multiple typologies for the classification of computer-based systems, we are going to define the most basic types of systems that are most readily applied to the HR context. One of the most common ways of categorizing information systems is to focus on what level of organizational processing the system supports: daily operations, managerial functioning, executive-level processes and strategies, and those that span organizational levels. Table 1.1 catalogs the major types of systems, their major focus and goals, and examples of how they can be used to support HR. As you go through this book, these systems and their HR examples will be discussed, and you should refer back to this table as needed.

TABLE 1.1 ■ Information Systems Providing Support for HRM

Organizational Level Type of System Major Goals and Focus HRM Examples

Operational Transaction Processing System

Improves transaction speed and accuracy

Improves efficiency in the processing of daily business transactions

Automates routine transactions

Reduces transaction costs

Payroll processing

Time and attendance entry

Online creation and dissemination of application forms

Managerial Management Information System

Provides key data to managers

Supports regular and ongoing decisions

Provides defined and ad hoc reporting

Producing EE03 reports

Calculating yield ratios for recruiting

Calculating per capita merit increases

Executive Executive Information System

Provides aggregate, high-level data

Helps managers with long-range planning

Supports strategic direction and decisions

Succession planning

Aggregate data on balanced scorecard

Boundary Spanning

Decision Support System

Supports interactive and iterative managerial decision making

Supports forecasting and “what-if” analysis

Supports business simulations

Staffing needs assessment

Labor market analysis

Employee skills assessment

Expert System Embeds human knowledge into information systems

Automates decisions with technology

Resume keyword searches

(Continued)

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

12 Part I  Human Resource Information Systems (HRIS): The Backbone of Modern HR

Organizational Level Type of System Major Goals and Focus HRM Examples

Office Automation Systems

Enables designing documents

Enables scheduling shared resources

Facilitates communication

E-mail training-room scheduling

Collaboration Technologies

Supports electronic communication and collaboration between employees

Supports virtual teams

Communication support for e-learning

Online meetings and shared documents

HR departmental wikis

Enterprise Resources Planning System

Integrates and centralizes corporate data

Shares data across functional boundaries

Provides single data source and common technology architecture

OrangeHRM

Oracle/PeopleSoft

Lawson HRM

SAP

TABLE 1.1 ■ (Continued)

EVOLUTION OF HRM AND HRIS To fully understand the current state of technology in HR and its role in organizations, it is important to understand both the evolution of HR and the technologies support- ing HR. The historical analysis that follows will demonstrate the growing importance of employees from being just one of the replaceable parts in organizations in the 20th cen- tury industrial economy to being a key source of sustainable competitive advantage in the 21st century knowledge economy. This means examining the evolution of HRM inter- twined with developments in IT and describing how IT has played an increasing role in HRM. This historical analysis will show how the role of HRM in the firm has changed over time from primarily being concerned with routine transactional activities and the utiliza- tion of simple, inflexible systems to the support of more strategic activities through the use of flexible, mobile, and Web-deployed systems. This evolution is illustrated in Figure 1.2 and will become evident as we trace the historical evolution of HRM in terms of five broad phases of the historical development of industry in the United States. For more information on this historical development, we encourage readers to consult Johnson et al. (2016).

Pre–World War II In the early 20th century and prior to World War II, the personnel function (the precur- sor of human resources management) was primarily involved in clerical record keeping of employee information; in other words, it fulfilled a “caretaker” function. During this

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

Chapter 1  A Brief History and Overview of Technology in HR 13

period, the prevailing management philosophy was called scientific management. The central thrust of scientific management was to maximize employee productivity. It was thought that there was one best way to do any work, and this best way was determined through time and motion studies that investigated the most efficient use of human capa- bilities in the production process. Then, the work could be divided into pieces, and the number of tasks to be completed by a worker during an average workday could be com- puted. These findings formed the basis of piece-rate pay systems, which were seen as the most efficient way to motivate employees at that time.

At this point in history, there were very few government influences in employment relations; consequently, employment terms, practices, and conditions were left to the own- ers of the firm. As a result, abuses such as child labor and unsafe working conditions were common. Some employers set up labor welfare and administration departments to look after the interests of workers by maintaining records on health and safety as well as record- ing hours worked and payroll. It is interesting to note that record keeping is one of the major functions built into the design of an HRIS today; however, there simply was no com- puter technology to automate the records at this time in history. Of course, paper records were kept, and we can still see paper record HR systems in many smaller firms today.

Post–World War II (1945–1960) The mobilization and utilization of labor during the war had a great impact on the devel- opment of the personnel function. Managers realized that employee productivity and

FIGURE 1.2 ■ Historical Evolution of HRM and HRIS

Early Systems Mid-20th Century

Emerging Systems 21st Century

HR Role

Employee Advocate

Maintain Accurate Employee Records

Legal Compliance

React to Organizational Change

Internal Focus: Serve Employees

HR Role

Strategic Management Partner

Evidence-Based HR

HR Data Supports Strategic Decision Making

External Focus: Serve “Customers”

Legal Compliance

System Characteristics

Inflexible

“Islands of Technology”

Batch Processing

Focused on Employee Record Keeping

System Characteristics

Flexible

Mobile

Web-Deployed

Integrated With Organizational System

Real-Time Processing

Focused on Information Sharing

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

14 Part I  Human Resource Information Systems (HRIS): The Backbone of Modern HR

motivation had a significant impact on the profitability of the firm. The human rela- tions movement after the war emphasized that employees were motivated not just by money, but also by social and psychological factors, such as receiving recognition for work accomplished or for the achievement of work goals.

Due to the need for the classification of large numbers of individuals in military service during the war, systematic efforts began to classify workers around occupational categories to improve recruitment and selection procedures. The central aspect of these classification systems was the job description, which listed the tasks, duties, and respon- sibilities of any individual who held the job in question. These job description classifica- tion systems could also be used to design appropriate compensation programs, evaluate individual employee performance, and provide a basis for termination.

Because of the abusive worker practices prior to the war, employees started form- ing trade unions, which played an important role in bargaining for better employment terms and conditions. There were significant numbers of employment laws enacted in the United States that allowed the establishment of labor unions and defined their scope in relationship with management. Thus, personnel departments had to assume considerably more record keeping and reporting to governmental agencies. Because of these trends, the personnel department had to establish specialist divisions, such as recruitment, labor relations, training and benefits, and government relations.

With its changing and expanding role, the typical personnel department started keep- ing increasing numbers and types of employee records, and computer technology began to emerge as a possible way to store and retrieve employee information. In some cases in the defense industry, job analysis and classification data were inputted into computers to better understand, plan, and use employee skills against needs. For example, the U.S. Air Force conducted a thorough and systematic job analysis and classification through its Air Force Human Resources Laboratory (AFHRL), which resulted in a comprehensive occu- pational structure. The AFHRL collected data from thousands in jobs within the Air Force, and, through the use of a computer software program called the Comprehensive Occupational Data Analysis Program (CODAP), it was able to establish more accurately a job description classification system for Air Force jobs.

During this time, large firms began investing in technology to keep track of payroll, but due to the complexity and expense of computers, only the largest organizations, such as GE, could afford to develop these systems in house. In addition, companies such as ADP were founded as payroll outsourcers and used mainframe computers to support payroll processing.

With increasing legislation on employment relations and employee unionization, industrial relations became one of the main foci of the personnel department. Union- management bargaining over employment contracts dominated the activity of the depart- ment, and these negotiations were not computer based. Record keeping was still done manually despite the growing use of computerized data processing in other departments, such as accounts and materials management. What resulted was an initial reluctance among personnel departments to acquire and use computer technology for their programs. This had a long-term effect in many firms when it came to adopting advancements in computer technology, even though this technology got cheaper and easier to use.

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

Chapter 1  A Brief History and Overview of Technology in HR 15

Social Issues Era (1963–1980) This period witnessed an unprecedented increase in the amount of labor legislation in the United States, legislation that governed various parts of the employment relation- ship, such as the prohibition of discriminatory practices, the promotion of occupational health and safety, the provision of retirement benefits, and tax regulation. As a result, the personnel department was burdened with the additional responsibility of legislative compliance that required collection, analysis, and reporting of voluminous data to statu- tory authorities. For example, to demonstrate that there was no unfair discrimination in employment practices, a personnel department had to diligently collect, analyze, and store data pertaining to all employment functions, such as recruitment, training, com- pensation, and benefits. To avoid the threat of punitive damages for noncompliance, it had to ensure that the data were comprehensive, accurate, and up to date, which made it essential to automate the data collection, analysis, and report generation process. As you go through the chapters of this book, these varying laws and government guidelines will be covered within the specific HR topics.

It was about this time that personnel departments were beginning to be called human resources departments, and the field of human resource management was born. The increasing need to be in compliance with numerous employee protection laws or suffer significant monetary penalties made senior managers aware of the importance of HRM. In other words, HRM practices were starting to affect the “bottom line” of the firms, so there was a significant growth of HR departments.

Additionally, computer technology had advanced to the point where it could deliver better productivity at lower costs and was beginning to be used more widely. The decreas- ing costs of computer technology versus the increasing costs of employee compensation and benefits made the acquisition of computer-based HR systems (HRIS) a necessary business decision. As a result, there was an increasing demand for HR departments to adopt computer technology to process employee information more effectively and efficiently. These technology developments and increased vendor activity led to the development of a comprehensive management information system (MIS) for HRM. In addition, early forms of integrated systems were being developed by SAP, the precursor to the modern ERP. But interestingly, HR was still slow in adopting computer technology. Thus, the major issue at this time in the historical development of HRIS was not the need for increased capabilities of technology, but how to best implement it.

Cost-Effectiveness Era (1980–Early 1990s) With increasing competition from emerging European and Asian economies, U.S. and other multinational firms increased their focus on cost reduction through automation and other productivity improvement measures. In HR, administrative burdens intensi- fied with the need to fulfill a growing number of legislative requirements, while the overall functional focus shifted from employee administration to employee development and involvement. To improve effectiveness and efficiency in service delivery through cost reduction and value-added services, the HR departments came under pressure to harness technology that was becoming cheaper and more powerful.

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

16 Part I  Human Resource Information Systems (HRIS): The Backbone of Modern HR

In addition, there was a growing realization within management that people costs were a very significant part of a company’s budget. Some companies estimated that per- sonnel costs were as high as 80% of their operating costs. As a result, there was a growing demand on the HRM function to cost justify their employee programs and services. In one of the first books to address this growing need to cost justify the HRM function, Cascio (1984) indicates that the language of business is dollars and cents, and HR man- agers need to realize this fact. But the challenge facing HR was that most leaders were not thinking like business managers (Fitz-enz, 1980).

Technology was becoming more cost-effective, and an increasing number of organiza- tions were increasingly able to afford using them. In addition, organizations began net- working computers together, and the development of microcomputers (e.g., PCs) allowed organizations to leverage the power of both the mainframe and local computer to sup- port HR operations. This allowed managers and employees to have HR information directly available on their workstations. This approach to computing was called client- server computing. Specifically, client-server computing supported the processing and use of HR data on both the mainframe computer as well as on the local personal computer of an employee. Organizations could now distribute employee information to multiple locations throughout the organization, providing more current information to managers in support of their personnel decisions. An early leader in this space was PeopleSoft, who developed one of the first, and most popular, HRIS during this time.

As noted earlier, the prevailing management thinking regarding the use of comput- ers in HR was not that their use would result in a reduction in the number of employees needed in HR departments, but that employee activities and time could be shifted from transactional record keeping to more transformational activities that would add value to the organization. This change in the function of HRM could then be clearly measured in terms of cost-benefit ratios (CBR) to the bottom line of the company.

ERPs and Strategic HRM (1990–2010) The economic landscape underwent radical changes throughout the 1990s with increas- ing globalization, technological breakthroughs (particularly Internet-enabled Web services), and hyper competition. Business process reengineering exercises became more common and frequent, resulting in several initiatives, such as the rightsizing of employee numbers, reducing the layers of management, reducing the bureaucracy of organizational structures, creating autonomous work teams, and outsourcing. Firms today realize that innovative and creative employees who hold the key to organizational knowledge provide a sustainable competitive advantage because, unlike other resources, intellectual capital is difficult for competitors to imitate. Accordingly, the people management function became strategic and was geared to attract, retain, and engage talent. These develop- ments led to the creation of the HR balanced scorecard (Becker, Huselid, & Ulrich, 2001; Huselid, Becker, & Beatty, 2005), as well as to added emphasis on the return on investment (ROI) of the HR function and its programs (Cascio, 2000; Fitz-enz, 2000, 2002).

With the growing importance and recognition of people and people management in contemporary organizations, strategic human resource management (strategic HRM) became critically important in management thinking and practice. Human resources

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

Chapter 1  A Brief History and Overview of Technology in HR 17

and the intellectual capital of employees were increasingly viewed as a strategic asset and a competitive advantage in improving organizational performance (Becker & Huselid, 2006). Organizations became more aware that there was not one best way to strategically deploy HR resources. Thus, researchers increasingly emphasized the “best-fit” approach to strategic HRM as opposed to the “best-practice” approach to strategic HRM. They argued that it was “the fit between the HR architecture and the strategic capabili- ties and business processes that implement strategy that is the basis of HR’s contribution to competitive advantage” (Becker & Huselid, 2006, p. 899).

A good example of the importance of HR and the information provided by an HRIS can be found in the human resource planning (HRP) function. HRP is pri- marily concerned with forecasting the need for additional employees in the future and the availability of those employees either inside or external to the company. Imagine, for example, that a company is considering a strategic decision to expand by establish- ing a production facility in a new location. Using the data from an HRIS, HRP can provide estimates of whether or not there are enough internal employees or individuals in the external labor market of the new location available with the necessary skills to staff the new facility.

Another critical characteristic of strategic HRM is the adoption and use of HR metrics (Cascio, 2000; Lawler & Mohrman, 2003). Most functional departments of an organization have utilized metrics for decades due to the nature of their business transactions. For example, the marketing department has set sales goals and the effective- ness metric that is used is the percentage of sales relative to the goal. But, for HR, the focus on the measurement of the cost-effectiveness of programs is relatively recent. Despite the recent utilization of metrics, their use continues to grow and has deepened as organiza- tions seek to compete globally.

During this timeframe, the technology supporting HR also underwent a dramatic transformation. In the late 1990s, software vendors began developing integrated enterprise resource planning systems, which integrated data from multiple functional areas of busi- ness, such as finance, accounting, marketing, HR, production, and sales. Industry leaders in this area were PeopleSoft, SAP, and Oracle. Other vendors focused on one specific HR function (such as time and attendance, online recruiting, or payroll). This approach where the organization would purchase the best system for each functional area became known as best of breed. Some industry leaders who chose this approach were Kronos for time and attendance, ADP for payroll, and Taleo for online recruiting.

“The Cloud” and Mobile Technologies (2010–Present) Within the last few years, we have seen an additional shift in HR, and much of this has been technology and regulation dependent. In 2010, the Patient Protection and Affordable Care Act was passed, and with it a host of new healthcare regulations were placed on organizations. In addition, a number of new data requirements were needed by organizations to ensure compliance with this act. Thus, the data needs for organizations continue to grow.

In addition, the technology supporting HR continues to evolve. Rather than the tra- ditional ERP, organizations are increasingly moving to cloud-based HR systems, which

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

18 Part I  Human Resource Information Systems (HRIS): The Backbone of Modern HR

are accessible over mobile devices and which leverage the capabilities of social network- ing and Web 2.0 tools. This creates a new hurdle for HR professionals as they learn to navigate the distribution of data on many more types of devices and on systems that are internally controlled by HR and by those systems outside of organizational control (e.g., Twitter, Facebook, Instagram, etc.).

Ultimately as we will see in the ensuing chapters, although technology is a key enabler of strategic HR M, it is not simply the best technology and best strategy that leads to competitive advantage, but rather the fit between the environmental reali- ties, technology, and strategic practices that lead to competitive advantage. A critical aspect of an HRIS in supporting the implementation of organizational strategy is how we can use data to make more effective decisions about employees, programs, and initiatives.

HRIS WITHIN THE BROADER ORGANIZATION AND ENVIRONMENT Beyond supporting and providing data for human resources, an effectively designed HRIS must also interface with individuals and systems within the broader organiza- tion and organizational environment. The data centrality of the HRIS is pictured in Figure 1.3. There are several aspects of this model that are critical. First, this model is a framework to use in reading, organizing, and understanding the information given in this book. At the core is the HRIS. The next layer focuses on the human resources envi- ronment and the major components of that environment (e.g., HR programs). Outside of this figure represents the organizational environment and its components. Outside the organizational environment is the global business environment, which directly influ- ences the organizational environment and indirectly affects the HR environment. Each of these layers mutually influences each other and together can impact the development and implementation of the HRIS. For example, differing labor laws across countries mean that different HR policies may be implemented and may affect the type of data collected by the HRIS and reported to regulatory agencies in different companies. The figure also indicates the interrelatedness between the strategic management system; the strategic HRM system; and the performance, business, and HR goals that are generated during the strategic planning process.

Second, this is a systems model; that is, it is organic and can change over time, as the environment changes (e.g., the increasing focus on unfair discrimination in society and in the workforce will affect the HR environment and will, in turn, affect the orga- nizational and global business environments). Third, the HRIS and the HR program evaluation results, in terms of HR metrics and cost-benefit results (value added and return on investment), are in continual interaction. This emphasis is consistent with current thinking in the HRM field (Cascio, 2000; Fitz-enz, 2000, 2002) and has gen- erated the HR workforce scorecard (Becker et al., 2001; Huselid et al., 2005). Finally, as will be emphasized throughout this book, the alignment between the global business

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

Chapter 1  A Brief History and Overview of Technology in HR 19

FIGURE 1.3 ■ Overview of an HRIS Embedded in Organizational and Global Business Environments

Global Business Environment

Government Regulations

Societal Concerns

Technology Competitors

Labor Markets

Organizational Envirnonment

Human Resources Environment

Human Resource

Information System

HR Programs Recruitment,

Selection, Training, Employee

Safety, etc.

HR Goals Retention, Climate/

Morale, Productivity, etc.

HR Evaluation HR Scorecard, HR Metrics, ROI, etc.

Research-Based Best HR Practices

IT Knowledge

Strategic Management

System

Strategic human resource

management

Strategic Human Resource

Management

HR Knowledge

Organizational Information

System

Strategic Management

System

Organizational Information

System

environment, the strategic management system, the strategic HR management system, the business goals, the HR goals, and the HR programs is critical to the organization’s maintenance of its competitiveness in the market (Evans & Davis, 2005; Huselid, Jackson, & Schuler, 1997).

THEMES OF THE BOOK The overall theme of this book is that the HR and IT operate jointly with HR processes and people to provide accurate and timely information in support of HR and operational and strategic managerial decision making. The book itself is broken into four major themes, each with a different focus:

• Part I: System Aspects of HRIS. In this section, you will learn about databases and the different technical and design considerations underlying HRIS.

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

20 Part I  Human Resource Information Systems (HRIS): The Backbone of Modern HR

Summary

The primary purpose of this chapter was to introduce the field of human resource information systems to readers. The field of HRIS has evolved greatly from simply auto- mating simple HR transactions such as cutting a payroll check to one of assisting HR in becoming a strategic part- ner with the organization. The result of this is that HRIS have evolved from simple mainframe systems with limited capabilities to large-scale integrated, mobile systems that support social networking capabilities. In addition, the use of HRIS has allowed HR to rethink how HR functionality

is deployed, leading to an eHRM approach. The distinc- tion between HRIS and eHRM was explained to help the reader avoid confusing these terms when they appear in the remainder of the book. Additionally, the role of HRIS within the broader organization and environment and its mutually influencing role were discussed. Finally, the chapter briefly discussed four major themes covered within the book. This chapter therefore serves as an introduction to the field of HRIS and serves as a foundation for the sections and chapters that follow.

Key Terms

“best-fit” approach to strategic HRM 17 “best-practice” approach to

strategic HRM 17 “caretaker” functions 12 cost-benefit ratios (CBR) 16 electronic human resource

management (eHRM) 9 enterprise resource planning

(ERP) software 9 HR balanced scorecard 16

HR metrics 17 human resource information

systems (HRIS) 6 human resource management (HRM) 6 human resource planning (HRP) 17 job analysis 14 job description 14 management information

system (MIS) 15 outsourcing 16

Patient Protection and Affordable Care Act 17

return on investment (ROI) 16 scientific management 13 strategic human resource management

(strategic HRM) 16 traditional HR activities 7 transactional HR activities 6 transformational HR activities 6

• Part II: Implementation of the HRIS. In this section, you will learn about the sys- tems development process, change management, assessing the feasibility of an HRIS, and how to implement them.

• Part III: eHRM. In this section, you will learn about how technology has trans- formed the administration of HR as well as how it has transformed the various functions of HR.

• Part IV: Advanced HRIS Topics. In this section, you will learn about advanced top- ics such as including international considerations in HRIS, workforce analytics, privacy and security, and social media. In concludes with a look forward to the future of HRIS and technologies that are on the cutting edge.

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

Chapter 1  A Brief History and Overview of Technology in HR 21

Discussion Questions

1. What are the factors that changed the primary role of HRM from a caretaker of records to a strategic partner?

2. Describe the historical evolution of HR M and HR IS in terms of the changing role of HR M and the inf lu- ence of computer technology on HR M.

3. What is required for the effective management of human resources in a firm to gain a competitive advan- tage in the marketplace?

4. Describe the emergence of strategic HRM and the inf luence of computer technology. What are some of

the approaches used in HRM to facilitate the use of strategic HRM in a firm’s business strategy?

5. How does technology help deliver transactional, tradi- tional, and transformational HR activities more effi- ciently and effectively?

6. Justify the need for an HRIS.

7. Describe and differentiate the major types of information systems.

Case Study: Position Description and Specification for an HRIS Administrator

One way to assess the nature and importance of a particular func- tion or position in an organization is to examine the job descrip- tion and job specifications for this position, as they tell us what activities, duties, and tasks are involved in the job as well as what knowledge, skills, and abilities (KSA) are required to perform the job. The following is an actual advertisement for an HRIS admin- istrator. A large corporation placed this ad in the “Job Central” section of the website for the International Association for Human Resources Information Management1 (www.ihrim.org).

HRIS Administrator

Job Level: Senior (5+ Years), Full time Reports to: Senior Director of Human Resources Operations

Position Summary

MOMIRI, LLC is an Alabama Native Owned Corporation, providing shared services to the MOMIRI family of com- panies and planning and incubating the next generation

of companies serving federal and commercial customers. MOMIRI companies offer core expertise in telecommunica- tions, information technology, product development, major program management, open source software, construction management, facility operations, and operations support. MOMIRI companies realize that quality personnel are the key to our success. An excellent benefits package, profes- sional working environment, and outstanding leaders are all keys to retaining top professionals.

Primary Function

The incumbent will serve as a key member of the HR Support Services department and provide professional human resources support in specific functions or disciplines to management and staff for the MOMIRI family of companies. This position is viewed as going to a midlevel professional who assists man- agement and staff with HR programs at the tactical level and performs all essential duties and responsibilities at the direction of the Manager of HR Operations.

(Continued)

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

22 Part I  Human Resource Information Systems (HRIS): The Backbone of Modern HR

Essential Duties and Responsibilities

• Provides technical assistance to senior-level HR staff and management on several HR programs to include employee relations, compensation, EEO compliance, company policies and procedures, disability programs (STD, LTD, FMLA, ADA), federal and state employ- ment laws, and personnel actions as needed.

• Supports and maintains the Human Resources Information System (HRIS) in addition to other systems supported by the management of enterprise applications.

• Serves as technical point-of-contact for assigned func- tional areas and assists subject matter experts with ensuring data integrity, testing of system changes, report writing and analyzing data f lows for process improvement opportunities.

• Supports HRIS and other enterprise systems’ upgrades, patches, testing, and other technical projects as assigned.

• Recommends process/customer service improvements, innovative solutions, policy changes, and/or major vari- ations from established policy.

• Serves as key systems liaison with other departments and process stakeholders (e.g., Payroll).

• Writes, maintains, and supports a variety of reports or queries utilizing appropriate reporting tools. Assists in development of standard reports for ongoing customer needs.

• Maintains data integrity in ATS, HRIS, and other enterprise systems by running queries and analyzing and fully auditing data across all HR departments.

• Conducts new hire in-processing to include systems training for new employees and entering new employee information in Costpoint.

• Conducts termination out-processing to include enter- ing employee separation information in Costpoint and reporting attrition data.

• Develops user procedures, guidelines, and documenta- tion for HR-related systems. Trains system users on new processes/functionality.

• Provides HR tools and resources for management and staff to accomplish their goals and objectives.

• Processes personnel actions (hires, terminations, pay and title changes, promotions, employment status, etc.) to include entering data into HRIS.

• Assists with special HR-related projects and provides training to other staff members as required.

• Performs other duties as assigned.

Requirements

Specialized Knowledge and Skills

• Experience working with a multiple-site workforce.

• Working knowledge of federal and state employment laws and related acts.

• Advanced to expert level computer skills.

• Excellent verbal and written communication and presentation skills.

• Great interpersonal skills.

• Strong time-management and prioritization skills.

Qualifications

• Bachelor’s degree in HR and/or equivalent professional experience.

• 3–5 years of technical HRIS experience in professional HR environment.

• Self-directed, highly responsive, and detail oriented.

• Ability to maintain absolute confidentiality in all business matters.

• Government contracting experience is a plus.

(Continued)

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

Chapter 1  A Brief History and Overview of Technology in HR 23

Case Study Questions

1. How does this position help the HR function become a strategic partner of the organization?

2. From the position description, identify the traditional, transactional, and transformational HR activities that this position is involved with.

3. Using the key responsibilities identified for this posi- tion, explain why and how the HRIS function plays a pivotal role in the organizational model as described in this chapter.

Student Study Site

Visit the Student Study Site at study.sagepub.com/kavanagh4e for additional learning tools such as access to SAGE journal articles and related Web resources.

1 The name of the company in the advertisement has been changed.

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

study.sagepub.com/kavanagh4e

DATABASE CONCEPTS AND APPLICATIONS IN HRIS

JANET H. MARLER AND BARRY D. FLOYD

162

EDITORS’ NOTE

As mentioned in the book overview in Chapter 1, this chapter is focused on under- standing databases and the applications of IT to the development and use of an HRIS. Databases are the backbone of all HRIS and a basic understanding of their creation, structure, and use will help students better understand the data capa- bilities and limitations of an HRIS. The chapter briefly reviews the history of data and databases. The chapter next reviews the relational database management system and discusses the key terms, concepts, and design issues associated with it. The chapter closes with a discussion of business intelligence and data mining applications in HR. This section helps acquaint the reader with an overview of this critical area of growing importance to organizations. Although this chapter may be a review for some students, the material in it is critical to understanding the remaining chapters of the book. As such, students may want to refer to this chap- ter as they are studying subsequent chapters. This introductory chapter is also an excellent example of the contribution of IT to the field of HRM in building an HRIS.

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

Chapter 2  Database Concepts and Applications in HRIS 25

CHAPTER OBJECTIVES

After completing this chapter, you should be able to

• Discuss the difference between data, information, and knowledge • Identify problems with early database structures • Understand what a relational database is and why it is better than older

database structures • Discuss three types of data sharing and why they are important • Know where data in a database are stored • Know the different ways in which data can be delivered to the end user • Know what a query is and discuss three different types of queries • Discuss how queries are used to support decision making • Discuss the key steps involved in designing a simple database in Microsoft

(MS) Access • Identify key data fields in an HR database • Understand the difference between operational databases and a data warehouse • Discuss how business intelligence software, data analytics, and Big Data

can support HR decision making

INTRODUCTION

In God we trust, all others must bring data.

—W. Edwards Deming

W hether an organization purchases, leases, or develops its human resource informa-tion system (HRIS), the data and the information it produces are stored in and retrieved from a database. Today’s HRIS have as their foundation electronic databases that work in conjunction with business applications to transform data into information that is essential for business operations and for decision making. Many believe that man- aging electronic databases and turning data into accessible and actionable information is a competency necessary to succeed in today’s marketplace. Indeed, data are produced, stored, updated, and shared by human resources (HR) employees and managers on a daily basis. This process is so pervasive that it often goes unnoticed. Yet the effective col- lection, storage, integration, and use of data are essential for any business, and the most successful organizations are masters of this process!

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

26 Part I  Human Resource Information Systems (HRIS): The Backbone of Modern HR

In this chapter, we provide an insight into how commercially delivered HRIS data- bases work. We define key relational database terminology, describe how a database is structured, and show how to develop a basic database using MS Access, a basic database management system (DBMS), as an example. We discuss how DBMSs provide the capability to integrate HR data and to link this data with other data essential to the operations of a business. We close by providing examples of HRIS built on MS Access to provide a basic understanding of larger more complex commercially developed HRIS databases.

DATA, INFORMATION, AND KNOWLEDGE Data are the lifeblood of an organization. The production and maintenance of data are critical to the smooth operation of every part of the organization. Data represent the “facts” of transactions that occur on a daily basis. A transaction can be thought of as an event of consequence, such as hiring a new employee for a particular position for a speci- fied salary. The organization attempts to capture the data (facts) associated with each of these transactions, such as the date hired, the name of the person hired, the title of the position, the location where the new hire will work, and so on, and then store these data for future use.

Information on the other hand is the interpretation of these data. An interpretation of data always has some goal and context such as making a hiring decision for a particular department or understanding the performance of an employee to make a promotion deci- sion. Note that sometimes the data themselves can be informative without any additional transformation (e.g., the salary range of the job). But other times, we must do additional work (e.g., calculating totals or presenting the data in some order) to turn the data into information to answer important questions such as “What is our full-time employee headcount in Corporate Sales?” or “Which employee should be promoted?”

Knowledge is information that has been given meaning (Whitehill, 1997). Knowledge is different from data and information. More than what and why, knowl- edge is about how. Knowledge, therefore, consists of the procedures one follows to use data and information to make decisions and conduct business. In many instances, such procedural knowledge is mostly hidden, residing in the minds of individuals and groups in the organization. For example, in HRIS, facts about age, gender, and education are the data. Information created from these data includes average age, gender ratio, and number and types of graduates at the business unit level. Such data and information help HR managers plan recruitment, schedule training programs to bridge skill gaps, and identify whether there may be employee discrimination. Knowledge represents how HR managers can execute the recruitment plan, decide which training programs are best to bridge skill gaps or determine what to do if employee discrimination exists. In the HR function, data about employees and jobs are the foundation of most of the information that is critical to analyzing and making HR decisions. Knowledge, on the other hand, constitutes knowing what information is needed from a database and how to use it to achieve HR objectives.

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

Chapter 2  Database Concepts and Applications in HRIS 27

DATABASE MANAGEMENT SYSTEMS A DBMS is a set of software applications (i.e., computer programs) combined with a data- base. DBMS electronically allows organizations to effectively manage data. Managing data means

• identifying the data needed to create information that is necessary to make HR decisions;

• defining the characteristics of those data (e.g., number data vs. character data);

• organizing those data in a manner that promotes integration, data quality, and accessibility; and finally

• restricting access to the data to the right personnel.

By performing these functions effectively, a DBMS turns data into an organizational resource.

A database is a set of organized data. Importantly, it is a permanent, self-descriptive store of interrelated data items that can be processed by one or more business applica- tions. Self-descriptive means that the database knows about the characteristics of the data (e.g., the length of an employee’s last name can be no greater than 30 characters) or that a paycheck can only be associated with one employee. Interrelated means that there are links between different sets of data in the database. For example, there can be a link between the data about employees and the jobs that they have. There can also be links between HR data and other data in the organization such as linking a managerial posi- tion to specific company facility resources such as office space or a production facility. As a central repository of data, many different business applications and users can access the data, making an organization’s database a very valuable organizational asset and, therefore, it needs to be managed appropriately.

The main functions of a DBMS are to create the database; insert, read, update, and delete database data; maintain data integrity (i.e., making sure that the data are correct) and security (i.e., making sure that only the right people have access to the data); and prevent data from being lost by providing backup and recovery capabilities. Database management systems are also designed to have high performance, allowing data to be retrieved quickly by the many users in the organization.

DBMSs and databases work in conjunction with business applications, such as transaction processing systems (TPS), to make organizations run smoothly. As shown in Figure 2.1, these business applications consist of a set of one or more computer programs that serve as an intermediary between the user and the DBMS, while providing the functions or tasks that the user wants performed (e.g., store data about a new hire; Kroenke & Auer, 2014). The business application must talk both to the user sitting at a computer terminal in an easy-to-use manner and to the database in a way that is very efficient. For example, a payroll business applica- tion involves collecting data from an employee’s time card, storing these data in a

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

28 Part I  Human Resource Information Systems (HRIS): The Backbone of Modern HR

database, and then retrieving and manipulating these data to produce a paycheck. Data from this transaction processing system can also be used to generate reports on monthly personnel expenses. These reports are the basis of management reporting systems (MRS). We’ll talk more about these later in the chapter.

There are thousands of commercially available business applications that work in conjunction with a DBMS to process business transactions. In a 2000 census of comprehensive HR software for the HR function, Richard Frantzreb catalogued more than 150 HR applications (Meade, 2003). In another census of specialized HR products under headings such as employment management, equal employment opportunity (EEO), training management, career development, HR planning, per- formance management, personnel policy, survey processing, employee scheduling, attendance/timekeeping, payroll, and so on, Frantzreb counted 2,500 HR software products from about 1,700 vendors (Meade, 2003). Recent innovations in HRIS technologies including improvements in user experience, increased integration, and increased functionalities such as social and mobile computing are leading many companies today to acquire new software to meet their needs (Bersin by Deloitte, 2013).

FIGURE 2.1 ■ Database, Database Management System, and Business Applications

Payroll data

Recruitment data

Workplace profiles data

Performance data

Database management

system

Payroll program

Recruitment program

Workplace program

Performance program

Database Interface Application programs Users

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

Chapter 2  Database Concepts and Applications in HRIS 29

Early DBMSs1

Early DBMSs were simply data-processing systems that performed record-keeping functions that mimicked existing manual procedures. Thus, electronic data were stored in computers in much the same way that they were stored in paper filing systems. Paper filing systems typically consisted of a filing cabinet and a drawer for each type of business document (e.g., an employee personnel form). These documents were also called “records.” Inside would be paper documents with each document being a record of a transaction (e.g., promoting Susan to senior manager). Computer systems mim- icked this, creating individual computer files, typically one for each type of document. For example, there would be an Employee File with employee records, a Time Card File with time card records, multiple Employee Benefit Files with their associated docu- ments, and so on. The main objective of these file-processing systems was to process transactions such as update payroll records and produce payroll checks as efficiently as possible. The goal was not on data sharing among different business applications and users.

These traditional file-oriented data structures had a number of shortcomings. These shortcomings included (a) data redundancy—an employee’s name and address could be stored in many different files; (b) poor data control—if you had access to the file you had access to all the data in the file, which may not be desirable because you may want to restrict the data viewed by a particular user; (c) inadequate data manipu- lation capabilities—it was very difficult to combine the data across files and to easily update and to add new data; and (d) excessive programming effort—any change in the structure of the data (e.g., adding a new field such as a mobile phone number or a screen name to an employee record) required extensive changes in the programming that accessed the data.

In general, early file systems were good at specialized transaction processing. They were not designed to easily and quickly provide information to answer questions such as “What was the average hourly wage for female programmers last year compared with this year?” because the data to answer the more complicated questions came from different files; for example, employee gender and salary would be in the master file on employees, and hours worked would be in the time-card transaction file. Difficulties also arose when managers in the organization wanted to share data across applications: Fundamentally, there was no easy way to link information. For example, managers could not connect information about employee salaries and sales projections.

To overcome the shortcomings of file-oriented structures, hierarchical and network database systems evolved in the mid-1960s and early 1970s. The key to these systems was that relationships between different records were explicitly maintained. Although rela- tionships among the data were created between sets of data, as illustrated in Figure 2.2, the relationships were created based on where the data were stored (e.g., the job records for Employee X are located in Sector 3 of Disk 4). Thus, only the very knowledgeable

1 For a more detailed discussion, see Hansen and Hansen (1996, pp. 52–56).

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

30 Part I  Human Resource Information Systems (HRIS): The Backbone of Modern HR

technical staff was able to effectively interact with the database. These database systems also required an excessive programming effort and suffered from inadequate data mani- pulation capabilities if the program was poorly designed.

The advent of relational database management systems addressed the many problems associated with these older DBMSs and database structures.

Relational DBMSs In 1970, E. F. Codd introduced the notion that rather than programming relationships between data based on physical location, the information needed to integrate data should reside within the data (Hansen & Hansen, 1996). Included in Codd’s proposal was that data be stored in tables where each table represented one entity in the real world and the information associated with that entity be stored only in that table. For example, a company could have an employee table (i.e., employee is an entity), and so information about the employee, such as name, address, date of hire, would only be stored in that table and nowhere else. Such an idea removed problems with redundancies such as storing the employee’s address in many locations and then not knowing which one is the correct one, if the employee’s address is changed in one location and not in the other location. These tables were called relations, and from this model came the name relational database.

In relational database systems, retrieval of data from different tables was based on logical relationships built into the table structures, which made feasible the creation of a query capability that was much more accessible to end users who generally had limited programming experience. This technique also allowed for relationships to be easily built among all the entities in the organization. We’ll talk more about this a bit later in the chapter.

Perhaps the most significant difference between a file-based system and a relational database system is that data are easily shared. There are three types of data sharing:

Hierarchical structure Network structure

Dept 1 Dept 2

Project 1 Project 2 Project 3

Employee 1 Employee 2

FIGURE 2.2 ■ Hierarchical and Network Database Structures

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

Chapter 2  Database Concepts and Applications in HRIS 31

(1) data sharing between functional units, (2) data sharing between management levels, and (3) data sharing across geographically dispersed locations. Data sharing requires a major change in end-user thinking, particularly in those employees who are accustomed to owning their own data on their PCs. Fundamentally, sharing data means sharing power because both data and information are power. Sharing data also means being a good citizen and making certain that the data you enter is correct.

Data Sharing Between Different Functions Relational DBMSs facilitate data integration across different functions such that each function might have access not only to its own data but also to other data as well. Thus, the HR department is able to maintain its employee database, but also access cost infor- mation from the accounting department’s database. As a result, relational database tech- nology increased the feasibility and popularity of integrated business applications. These integrated applications used in large organizations are referred to as enterprise resource planning (ERP) business applications.

ERP software applications are a set of integrated database applications, or modules, that carry out the most common business functions, including HR, general ledger, accounts payable, accounts receivable, order management, inventory control, and customer relationship management. ERP modules are integrated, primarily through a common set of definitions and a common database (Brown, DeHayes, Slater, Martin, & Perkins, 2011).

Data Sharing Between Different Levels Operational employees, managers, and executives also share data but have different objectives and, thus, different information needs. Operational employees focus on data- processing transactions to ensure smooth operation of critical business transactions. A common business transaction is processing the information from an employee’s timecard. At this level, transaction-processing information systems help conduct business on a day- to-day basis to provide timely and accurate information to managers and executives. For example, transaction-processing systems update employee work history, attendance, and work hours. Operational employees are concerned with the accuracy and efficiency with which these data are processed.

Managers, on the other hand, are more interested in summary data, such as reports generated from daily operational data that can be summarized into daily, weekly or monthly reports on hours worked by employee or absences by employee.

Executives rely on information produced at an even more aggregated level to evaluate trends and develop business strategies. For example, executives might ask for reports that compare turnover statistics across business groups and over time.

These three different levels of use correspond to three different types of software systems that have evolved over the past three decades: transaction processing systems (TPS), management reporting systems (MRS), and decision support systems (DSS) (Hansen & Hansen, 1996). TPS were first applied to lower operational levels of the organization to automate manual processes such as payroll. Their basic characteristics include (a) a focus on data storage, processing, and f lows at the daily operational level;

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

32 Part I  Human Resource Information Systems (HRIS): The Backbone of Modern HR

(b) efficient transaction processing; and (c) summary reports for management (Sprague & Watson, 1989). Early ERP applications were used primarily for their transaction processing functionality.

Note the similarity between the categorization of information systems into electronic data processing (EDP), management information systems (MIS), and DSS discussed in Chapter 1 (Sprague & Carlson, 1982). These terms correspond to TPS, MRS, and DSS in this chapter. As you may recall from Chapter 1, an additional information sys- tem was identified—the human resources management decision system (HRMDS). The HRMDS was described as consisting of the reports managers and HR professionals receive on a regular basis but that are actually used in their daily work, particularly in their decision-making capacity. The HRMDS could be classified as a special instance of an MRS or MIS system but focused specifically on information used in decision making—a central theme of this book.

In addition to TPS capabilities, relational databases can also provide MRS capa- bility. Characteristics of an MRS include (1) information aimed at middle managers; (2) integration of TPS data by business functions such as manufacturing, marketing, and HR; and (3) inquiry and report generation from the database (Sprague & Watson, 1989). Management reporting systems can be designed to provide daily, monthly, quarterly, or annual summary of key transactions such as employee headcounts by department or distribution of employee absence reports to meet budgets.

Decision support systems assist senior managers and business professionals in mak- ing business decisions. Data mining, data analytics, and business intelligence (BI) are examples of information derived from a DSS, which relies on data warehouses. Data warehouses represent aggregated data (e.g., the total salary information by department by month) collected from various databases available to a business.

Data Sharing Across Locations In today’s global environment, access to data from any physical location in the world is increasingly important. Teams of employees may be stationed in Thailand, India, and the United States. Two issues arise when data are shared across wide geographic locations. These are (1) managing the day/time of a transaction and (2) determining where to store the various components of the business application, DBMS, and database.

To deal with day/time, developers of DBMSs such as Oracle, MS SQL Server, and IBM DB2 are building the capability to deal with recording dates and times according to the time zone in which the data originated. So, for example, if a database is stored in London and an employee records a transaction while sitting at a terminal in Los Angeles, in addition to the time (say 1 p.m. in Los Angeles), the time zone (−08:00 from Greenwich Mean Time) is also stored with the transaction.

As part of a global information system design, organizations have chosen to break their business application and DBMS into components, often called “tiers.” More detail on tiers will be covered in Chapter 3. Traditional client-server architectures broke an application into two tiers, typically with the user interface and some business logic on the user’s computer, such as a PC (the client) and the database and mainstream parts of the application stored on a server. In today’s global environment with high-speed

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

Chapter 2  Database Concepts and Applications in HRIS 33

data networks, N-tier architectures exist with databases and applications being dis- tributed among many different computers around the world. So if, for example, you are in an Internet café in Bangkok trying to get information about your benefit election, the hosting computer may be in London and the data may be located on a computer in Chicago. In sum, computer networks that provide instant access to these opera- tional data are created, allowing real-time managerial decision capability regardless of physical location.

A centralized database allows a company to confine its data to a single location and, therefore, more easily control data integrity, updating, backup, query, and control access to the database. A company with many locations and telecommuters, however, must develop a communications infrastructure to facilitate data sharing over a wide geographi- cal area. The advent of the Internet and a standardized communication protocol made the centralized database structures and geographically dispersed data sharing feasible.

KEY RELATIONAL DATABASE TERMINOLOGY As discussed earlier, relational DBMSs are used to store data important to the organiza- tion. Key terms in relational database management include entities, attributes, tables, primary keys, foreign keys, relationships, queries, forms, and reports. Below we define each term and describe its function in a database.

Entities and Attributes Entities are things such as employees, jobs, promotion transactions, positions in com- pany, and so on. They include both physical things such as desks and conceptual things such as bank accounts. A company must analyze its business operations and identify all the entities that it believes are important.

Each of these entities is made up of attributes. An attribute is a characteristic of the entity. For example, an employee has a name, address, phone number, education, and so on. Attributes also have characteristics such as the type of data (e.g., date, number, or character) and size (e.g., number of characters or the largest number that can be stored).

In addition to identifying the entities and attributes, the relationships among the enti- ties must be defined. For example, a company may have an employee entity and a depart- ment entity. Then the company must define the relationship between the employee entity and the department entity (e.g., Does an employee have to be assigned to a department? Can an employee be assigned to more than one department?).

Tables How does this information fit into a relational DBMS? Tables are used to store informa- tion about entities. As illustrated in Figure 2.3, one table is created for each entity—in this example, driver table, car table, moving violation table, and parking violation table.

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

34 Part I  Human Resource Information Systems (HRIS): The Backbone of Modern HR

Attributes are stored as the columns (also called fields) in the table. As noted earlier, attributes represent a single data element or characteristic of the data table. For example, a table of driver data would have the following columns or characteristics: first name, last name, street address, city, state, driver license number, expiration, and so on. Each of these characteristics represents an attribute or field of the table.

Each table in a database contains rows. Rows are also referred to as records and repre- sent an “instance” of the entity. For example, in the driver table, each row contains data about a particular driver, and each column contains data that represent an attribute of that driver, such as name, phone number, and license number.

Relationships, Primary Keys, and Foreign Keys To represent the relationships among the tables, we have to do a bit more work. In a relational DBMS, relationships are created by having the same attribute in each table with the value of the attribute being the same in each table. Most often, this is done by taking the primary key of one table and including it in the related table. What is a primary key?

Typically, each entity has an attribute that has unique values for each instance of the entity. For example, each employee has a unique Social Security number. Other entities, such as jobs, locations, and positions can be assigned a unique number if one doesn’t exist. These unique attributes can be used as a table’s primary key. Given that we have

Driver’s license file/table

Citation number

Moving violation type

Date cited Driver’s license number of driver cited

Fines paid/ not paid

Citation number

Parking violation type

Date cited Car license number

Fines paid/ not paid

Key fields linked

Car license number

Car make and year

Owner’s name

Street address

City State Zip

Driver’s name

Driver’s license number

Street address

City State Zip Expiration date

Car owner file/table

Moving violation citation file/table

Parking violation citation file/table

FIGURE 2.3 ■ Relational Database Structure

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

Chapter 2  Database Concepts and Applications in HRIS 35

a unique attribute, to create a relationship, we simply store that attribute in the related table. So, if an employee is associated with a position, we have two tables, an employee table and a position table. We then take the primary key of the employee table and store it in the position table. In the example in Figure 2.3, the driver’s license number is the primary key in the driver table, and it is also stored in the moving violation table. When a primary key from one table is stored as an attribute of another table, that attribute is called a foreign key. Thus, in Figure 2.3, driver’s license is the primary key in the driver table and is the foreign key in the moving violations table.

Storing data in related tables allows users to utilize the database application to create queries, forms, and reports that permit users to retrieve, update, or analyze data from multiple tables together. The relationships between tables allow users to accurately com- bine information that “go together” from two (or more) tables. For example, if a manager wished to provide bonuses to his or her top salespeople, he or she would likely use data from an employee file, a sales file, and some type of compensation table.

Queries2

A query is a question that you ask about the data stored in a database. For example, you may want to know which employees live within a specific city. You could generate these results by scrolling through the relevant table or by sorting the table by city and then looking at the result, but this is time-consuming and you would have to do this task each time you wished to find the answer to your question. A better approach is to create a query. A query is a structured way of posing your question to the DBMS in a language it understands. This definition (e.g., show all employees with city Albany) can be saved in the database and used again and again. Importantly, each time the query is executed, it searches through the current table records and lists the results. The results of a query on a table(s) are always displayed in something that looks just like another table. However, this result table is only temporary and is not stored in the database. It is important to note that queries do not store data! All data are stored in tables. Queries only report on data currently in the table.

There are three different kinds of queries: select queries, action queries, and cross-tab queries. A select query allows you to ask a question based on one or more tables in a data- base. This is the most commonly used query. These queries can be quite general or quite specific. For example, a general query might extract all employees from the database who have reached retirement age. A more specific query might retrieve employees who have reached retirement age and who live in New York and are engineers.

An action query performs an action on the table on which it is based. Actions include updating data in the table (e.g., increasing the base salary of all employees who were rated above average in the latest performance rating), deleting records from the table (e.g., removing employees from the employees table if they no longer work at the company), or inserting records (e.g., the query may add a new set of benefits to the benefits table). You can also use this type of query to create new tables.

A cross-tab query performs calculations on the values in a field and displays the results in a datasheet. The reason it is called “cross-tab” is that it tabulates the data for

2 For a more detailed discussion, see Cable (2013, Chapters 1, 2, and 3).

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

36 Part I  Human Resource Information Systems (HRIS): The Backbone of Modern HR

a set of descriptor attributes, contrasting them or crossing them in a table format. For example, we might want to see the total personnel count by gender by region. So we would see the gender on the left-hand side and the different regions listed across the top of a table. A cross-tab query could display different aspects of the data, including sums or averages or minimum or maximum values. As another example, a cross-tab query could determine headcount by department or determine pay range maximums and minimums in pay grades by department.

Select queries and cross-tab queries provide the information that managers and executives expect from IT. These queries can serve as the foundation for MRS and DSS information and decision making. Action queries, on the other hand, improve the operational efficiency of managing and maintaining a database and are most closely associated with TPS. These tasks are important to the operational staff but of less interest to HR managers and executives.

Queries are also used as the basis for forms and reports. In addition to retrieving data, they can add, update, and delete records in tables. You can define fields in a query that perform calculations, such as sums and averages. The following list illustrates typical capabilities of queries (Cable, 2013):

• Display selected fields and records from a table

• Sort records on one or multiple fields

• Perform calculations

• Generate data for forms, reports, and other queries

• Update data in the tables of a database

• Find and display data from two or more tables

• Create new tables

• Delete records in a table based on one or more criteria

Forms3

A form is an object in a database that you can use to maintain, view, and print records in a database in a more structured manner. Although you can perform these same functions with tables and queries, forms can present data in many customized and useful ways. For example, you can design a form to look like the time sheet sub- mitted by an employee. Well-designed forms can improve data input efficiency and accuracy. Consequently, forms represent the main mechanism for creating end-user interfaces.

A form can be based on a table, multiple tables, or queries. A form can display one record at a time or many records. Often, we select only one record and then create a nice- looking, easy-to-use layout to work with the data in that one record. To view and main- tain or add data using a form, you must know how to move from field to field and from

3 For a more detailed treatment, see Tutorials 4 and 5 in Adamski and Finnegan (2013).

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

Chapter 2  Database Concepts and Applications in HRIS 37

record to record. Forms provide navigation buttons that facilitate moving from field to field and from record to record. Data that are entered or changed in a form automatically change the values in the underlying table once you save the changes.

Reports A report is a formatted presentation of data from a table, multiple tables, or queries that is created as a printout or to be viewed on screen. Data displayed in a report are dynamic, reflecting the latest data from the tables on which the report is based. Unlike forms, however, you cannot change the data or add a new record in a report. You can only view the data in a report.

Although you can print data appearing in tables, queries, and forms, reports provide you with the greatest flexibility for formatting printed output. As with forms, you can design your own reports or use a wizard to create reports automatically.4

MS ACCESS—AN ILLUSTRATIVE PERSONAL DATABASE MS Access is a relational DBMS in which data are organized as a collection of tables. Like any relational database, the data in tables can be queried. MS Access also makes it easy to create forms and reports through the use of form or report wizards. A form or report wizard is a computer program or tool that guides you through the creation of a form by asking you a series of questions. For example, which table is the form to be created from, and which attributes do you want to be displayed on the form? The form or report is cre- ated based on your answers.

MS Access is designed for relatively small databases and assumes limited knowledge of database programming. MS Access provides the following functions (Adamski & Finnegan, 2013):

• It allows you to create databases containing tables and table relationships.

• It lets you easily add new records, change table values in existing records, and delete records.

• It contains a built-in query language, which lets you obtain immediate answers to questions you ask about your data.

• It contains a built-in report generator and report wizard, which lets you produce professional-looking, formatted reports from your data.

• It provides protection of databases through security, control, and recovery facilities.

Data in an MS Access table or query can be exported to other database applications or to spreadsheet programs such as MS Excel. Once these records are in a spreadsheet program,

4 For a more detailed treatment, see Tutorials 4 and 6 in Adamski and Finnegan (2013).

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

38 Part I  Human Resource Information Systems (HRIS): The Backbone of Modern HR

then further analyses may be conducted and graphs and charts constructed to enhance analytical HR metric reports. Data can be exported by simply opening the database that has the object—for example, table or query—that you want to export. Then select File, Export from the database menu. Select the type of file—for example, .xlsx—you want the object to be saved to and specify a name. Click Save. Now you can open the file in Excel. You may also link the data in the database to the spreadsheet. When the spreadsheet is opened, the most recent data from the database are retrieved and presented in the spreadsheet.

Unlike spreadsheet software programs, MS Access handles substantially more data and contains the ability to model relationships. Each MS Access database, for example, can be up to 2 GB in size and can contain up to 32,768 objects, including tables, queries, forms, reports, and so on.

Designing an MS Access Database The design process begins with an analysis of the data and information that the users of the database will need to have stored and retrieved in order to accomplish their work. Typically, we think of work as consisting of tasks within a business process, and so we can think of the data that will be required to be stored in a database and of the informa- tion that will need to be extracted. We find out the data to be stored by interviewing the intended end users of the database. We ask about entities that they need to keep informa- tion on, the attributes of those entities, and also how the entities are related. In addition, we may watch users at work and look at the forms, reports, and other business documents that they use to be successful. Gathering copies of all existing forms and reports currently used may also act as guidelines for creating forms and reports, though sometimes our intention is to change how they are doing business, and so some of these documents may be significantly changed or even discarded.

In general, the database design process can be broken down into several steps that are some- what sequential but oftentimes have to be repeated until the database meets the users’ needs:

• Determine what the users want from the database: What questions need to be answered? What information needs to be tracked? What reports are produced? What data are needed to provide the basis for those results?

• Identify the data fields needed to produce the required information; in doing so, we also identify rules that define the integrity of the data, including data type (number, character) and data limits (e.g., if we are storing days, we might only allow the numbers 1 to 31).

• Group related fields into tables (entities).

• Determine each table’s primary key.

• Normalize the data: Make sure the data for an entity are really associated with only that entity.

• Determine how the tables are related to one another and include common keys.

• Create the relationships among the different entities and ensure referential integrity.

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

Chapter 2  Database Concepts and Applications in HRIS 39

• Create queries to define data needs that are not handled by only looking at indi- vidual tables.

• Create reports to provide a structured view of the data.

• Create forms, and in doing so, identify a common design for the forms: Typically, we create a form for each table along with a “main menu” form that allows the user to navigate to each form associated with a table and to view queries and reports.

• Enter test data to verify the quality/accuracy of the system design.

• Test the system: Do all the queries work correctly? Are the forms easy to use? Are the end users happy?

• Enter or populate the database.

HR Database Application Using MS Access For small companies, generally with fewer than 1,000 employees, there are commercially available HR database applications based on MS Access. One such system, popular in the United States, is HRSource from Auxillium West (www.auxillium.com). This software product offers a wide breadth of functionality and flexibility to import and export data from and to Excel and to integrate with other database applications, particularly payroll. It provides a centralized relational database with basic transaction processing and manage- ment reporting systems.

HRSource utilizes the familiar MS Access forms as user interfaces. It allows users to create custom queries and reports. However, it also offers 70 preconfigured reports and queries. Customers also claim that with a little expertise in MS Access, they are able to mine their HR information in a way that they never could before they utilized a central database (Meade, 2003).

Other HR Databases A few decades ago, database application programs were often written by companies for their particular use; in today’s business environment, customized application programs termed legacy systems are being replaced by commercially developed HR systems supported by enterprise database application programs (e.g., Oracle Enterprise HCM, MySAP ERP HCM, UltiPro HR, Workday). The most well-known HR database applications can operate on various DBMS platforms (e.g., Oracle, MS SQL Server, IBM DB2). These commercial database application programs can either be licensed and installed onto com- puter hardware a company buys themselves or now, given the ability to share database information regardless of geographic location, some vendors of HR database applications are leasing HR DBMS and business applications to business customers. This new way of acquiring an HRIS is called software as a service, or SaaS. The SaaS approach to HRIS is discussed further in Chapter 3. Regardless of how complex your HRIS DBMS is, you must ensure that you know what information can be derived from any database. To know this, one must have an idea of what tables and attributes (fields) are in the data- base. Software vendors should be able to provide this information to end users; however,

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

40 Part I  Human Resource Information Systems (HRIS): The Backbone of Modern HR

Employee ID

First Name

Last Name

Address

City

State

Zip Code

Home Phone Number

Gender

Ethnic Code

Birth Date

Veteran Status

Visa Expiration Date

Education

Past Employment

Skill Code

Training/Certification

Performance Rating

Next Review Date

Hire Date

Termination Date

Termination Reason

Rehire Date as Applicable

Job Code/Title

Pay Rate Type

Rate Effective Date

Salary

Bonuses

Status

Category (full-time/part-time)

Contract Employee Status

Department

Office Information

Manager

Division/Location

Company Property

Emergency Contact

Time-Off Accruals

Benefits

Work-Related Injuries

Disability

TABLE 2.1 ■ Examples of Common Fields in an HR Database

for the large complex HR applications, this may run into thousands of tables and fields! Auxillium West offers a document to prospective customers that lists the data items com- monly tracked (Table 2.1; Meade, 2003).

Although the list in Table 2.1 appears to be comprehensive, in fact, it is quite sparse when compared with more complex database applications. More complex database applications will also have fields that relate to business processes other than HR, such as accounting and finance. Integrated databases allow sophisticated queries and analytical reports, such as hours spent on recruiting, recruiters’ hourly pay, job board posting costs, number of positions filled, number of declined offers, number of open positions, number of voluntary terminations, and number of involuntary terminations.

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

Chapter 2  Database Concepts and Applications in HRIS 41

DATA INTEGRATION: DATABASE WAREHOUSES, BUSINESS INTELLIGENCE, AND DATA MINING An organization’s ability to generate meaningful information to make good decisions is only as good as its underlying database. As Dr. John Sullivan notes, “I have found that the largest single difference between a great HR department and an average one is the use of metrics” (Gur, 2006). Metrics are measures of organizational performance outcomes that are derived from important individual and organizational outcomes (e.g., individual job performance and absence rate). As was discussed in Chapter 1, the current emphasis in HRM is functioning as a strategic business partner. A prerequisite to this goal is the use of metrics to assess and monitor quantitative data from HRM programs like recruit- ing and training. The primary objective of measuring HR metrics is to improve indi- vidual and organizational effectiveness.

Much of the data used to create HR metrics come from an organization’s data warehouse. A data warehouse is a special type of database that is optimized for report- ing and analysis and is the raw material for management’s decision support system. Business intelligence is a broad category of business applications and technologies for creating data warehouses to analyse and provide easy access to these data in order to help organizational users make better business decisions. BI applications include the activities of decision support systems, query and reporting, statistical analysis, forecast- ing, and data mining.

BI systems allow organizations to improve business performance by leveraging information about customers, suppliers, and internal business operations from data- bases across functions and organizational boundaries. Essentially, BI systems retrieve specified data from multiple databases, including old legacy file database systems, and store these data into a new database, which becomes that data warehouse. The data in the data warehouse can then be accessed via queries and used to uncover patterns and diagnose problems.

Patterns in large data sets are identified through data mining, which involves sta- tistically analyzing large datasets to identify recurring relationships. For example, data mining an employee database might reveal that most employees reside within a group of particular ZIP codes. This may help if the organization wants to supply transportation or encourage carpooling. Data mining is relatively new to business analytics and has not yet been widely used for HRM decisions.

BI systems also provide reporting tools and interfaces (e.g., forms) that distrib- ute the information to Excel spreadsheets, Internet-based portals, PDF files, or hard copies. These results can also be distributed to key executives in specialized formats known as executive dashboards, which are becoming a popular executive decision support tool.

A major reason for a DBMS is to provide information from various parts of the orga- nization in an ad hoc manner. Ad hoc means that a user can ask a question of the data that no one has thought about yet. The user can sign into the data and pose his or her

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

42 Part I  Human Resource Information Systems (HRIS): The Backbone of Modern HR

question in the form of a query. This is a very powerful concept that enables all levels of the organization. Data warehouses and BI software enable managers to create informa- tion from an even greater store of data.

BIG DATA AND NOSQL DATABASES Successful organizations realize that data-driven decision making is key to organiza- tional success, but to achieve this success, and as a result, they are capturing increasing amounts of transactional data. However, they also realize that capturing the data is not enough: They must better manage this data. Big Data is a term that illustrates the challenges faced by organizations. Big Data is described by four dimensions: volume, variety, velocity, and veracity. Volume refers to the amount of data, often measured in terabytes that organizations collect today. Most large organizations in the United States have at least 100 terabytes of data. The HR function produces and consumes increas- ing amounts of data on activities such as payroll, talent management, social media, email, I-9 forms, and so on. Variety refers to the different forms of data. Although relational DBMSs provide a very structured view of a critical segment of HR data, HR managers also need to store and access unstructured documents such as resumes, per- formance reviews, disciplinary actions, images, video email, and many others. In fact, Gartner estimates that 80% of the information generated today consists of unstructured data (Bridgwater, 2010)! Velocity refers to the speed at which data is coming into the organization. Sensors that track employees movement, audit logs of information access, and many other sources of information stream with increasing speed and must be cap- tured and stored. Lapses resulting in missing data may be problematic for organiza- tions striving to meet regulatory obligations. Veracity refers to the quality of the data collected by the organizations. HR is plagued by inconsistencies and inaccuracies, and these problems must be fixed in order for planning and prediction to be meaningful (Vorhauser-Smith, 2014). When these problems are fixed for structured data, HR will then be able to embrace the wealth of value found in the relatively unstructured data present in market and social data.

To manage unstructured data, organizations are turning to different data- base approaches to support these different data forms. For example, MondgoDB (http://mongodb.com) is an open source, document-oriented database that stores data using JSON (JavaScript Object Notation). Figure 2.4 shows the creation of an object named Alexx, which can have any number of properties such as age, hometown, gender, and so on. MongoDB is designed to allow users to create these objects in a flexible fash- ion (e.g., one could create another object named Steve that has the same properties plus other ones such as height and eye color). MongoDB is an example of a NOSQL (not only SQL) database. NOSQL are databases where data are stored and retrieved using different methods than SQL. Importantly systems like MondgoDB provide a very flex- ible means of describing, storing, and retrieving documents whose structure does not fit well into a relational table scheme.

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

Chapter 2  Database Concepts and Applications in HRIS 43

FIGURE 2.4 ■ Sample Object-Oriented Database

var Alexx = {

“age” : “38”,

“hometown” : “Boston, MA”,

“gender” : “female”

};

Summary

In this chapter, we have described the key aspects of cur- rent DBMS technologies and how they work to create, store, and manage critical data about an organization. Data are transformed into information by relational DBMSs and business applications that work together. The underlying data in a database are collected from business transactions and stored in tables that are related to each other through shared fields called primary and foreign keys. Queries rep- resent questions asked of the data and are used to access specific data stored in tables. The results of queries can be viewed in forms or reports that are customized so that the end user can better interpret the data that are retrieved from the database. More sophisticated data analyses and reports such as executive dashboards are produced from specialized

databases called data warehouses and business application software called BI software.

Most HRIS rely on an underlying database. Understanding how database systems work, therefore, is relevant to HR decision makers because knowledge about how to create, store, and access data can be a key differentiator in a com- petitive environment. Small HR databases can be created using MS Access, or more sophisticated ones can be pur- chased from software vendors. There are literally hundreds of HR database business applications that create, process, and analyze HR data. The challenge is to find one that can most cost-effectively collect and share data from which meaningful information can be extracted to support mak- ing good decisions.

For HR to be successful in meeting the challenges of Big Data, though, HR employees must develop new skill sets, ones with a “data scientist” perspective and capable of mastering HR analytics. This effort will not be accomplished overnight. “It takes organizations between five and eight years to put necessary people, processes and infrastructure in place in order to become a data-driven culture” (Vorhauser- Smith, 2014).

Thus, the sooner that HR invests in this expertise, the sooner they will be able to real- ize greater returns on the Big Data investments. More information on the use of metrics and Big Data in HR are discussed in Chapter 14.

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

44 Part I  Human Resource Information Systems (HRIS): The Backbone of Modern HR

Student Study Site

Visit the Student Study Site at study.sagepub.com/kavanagh4e for additional learning tools such as access to SAGE journal articles and related Web resources.

Discussion Questions

1. Explain the differences between data, information, and knowledge.

2. What are the main functions of a database management system, and how is it different from a database?

3. What were the shortcomings of early file-oriented data- base structures?

4. What are the three types of data sharing?

5. Define the key terms in a relational database.

6. What is the difference between a primary key and a foreign key?

7. What are the three types of queries?

8. How are forms and reports similar, and how are they different?

9. Take the list of HR database common fields and group them into tables.

10. What are the differences between data warehouses, BI, and data mining?

11. Can knowledge be turned into a database?

12. How can Big Data support HR decisions?

Case Study: Building an Applicant Database

You have been asked to create an applicant database for a small recruiting firm that specializes in recruiting HR pro- fessionals for small to medium firms. Describe the process

that you would use to design this database. Use MS Access to develop a prototype of the database that you could show your manager.

Key Terms

action query 35 Big Data 42 business applications 25 business intelligence (BI) 32 cross-tab query 35 data warehouse 41 database management system

(DBMS) 26 decision support systems (DSS) 31

electronic data processing (EDP) 32 file-oriented data structures 29 foreign key 35 management reporting systems

(MRS) 28 N-tier architectures 33 primary key 34 relational database 26 relationships 29

reports 28 select query 35 software as a service (SaaS) 39 transaction processing systems (TPS) 27 user interface 32 variety 42 velocity 42 veracity 42 volume 42

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

study.sagepub.com/kavanagh4e

SYSTEMS CONSIDERATIONS IN THE DESIGN OF AN HRIS

163

Planning for Implementations

MICHAEL D. BEDELL AND MICHAEL L. CANNIFF

EDITORS’ NOTE

This chapter focuses on the HRIS as one large information system. It starts with a brief discussion of the various stakeholders who must be considered during the design and implementation of a new HRIS. Next, it turns to a discussion of the various hardware and software architectures that organizations may consider when implementing an HRIS. This discussion traces the histor y of HRIS from early mainframe systems to today’s integrated, mobile, and cloud-based systems. An important consideration for all organizations is whether to select the best soft- ware package from different vendors for each functional area of HR (e.g., best of breed) or to select a system that integrates all the functions within one large soft- ware package. The chapter touches on how organizations would integrate these best-of-breed solutions so that they integrate as seamlessly as possible. Whereas Chapter 2 focused on the key data considerations within an HRIS, this chapter focuses more on the technology and processes underlying HRIS implementation.

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

46 Part I  Human Resource Information Systems (HRIS): The Backbone of Modern HR

CHAPTER OBJECTIVES

After completing this chapter, you should be able to

• Understand the different types of users or customers of the implemented HRIS and their different data needs

• Discuss the differences between the five general hardware architectures that are presented, from “dinosaur” to “cloud computing” to “bring your own device”

• Discuss, very generally, the main concepts of hardware and database security • Discuss the “best-of-breed” approach to HRIS acquisition and the various

options available for each functional area of HR • Develop an understanding of the general steps and factors that affect

system implementation • Understand the pros and cons of implementing a changeover from one

software system to another

HRIS IN ACTION

A billion-dollar retailer with 4,000+ stores finds that it cannot move fast enough

to beat out the competition. The organization’s senior management arrives at the

conclusion that it would be easier to achieve the strategic goals enumerated by the

board of directors if the various organizational functions would share information.

Shared information would enable them to develop and deploy new actions and tac-

tics more quickly. The CEO and president have therefore ordered the major functions

to update their information systems immediately so that data sharing is possible.

The senior vice presidents (SVPs) of accounting and human resources immediately

conclude that the only solution is to decide jointly on an enterprise resource plan-

ning (ERP) software. An ERP software application is a set of integrated database

applications or modules that carry out the most common business functions, includ-

ing human resources, general ledger, accounts payable, accounts receivable, order

management, inventory control, and customer relationship management (see www

.erpsupersite.com). To speed the installation along, the SVPs decide on a rapid-

implementation methodology that a company down the street used. The goal is to

have the new systems operational in nine months.

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

Chapter 3  Systems Considerations in the Design of an HRIS 47

Shortly after this decision has been made, the SVP of human resources (HR) calls

you into his office and tells you that you will be management sponsor for this project.

You have to decide on everything. You sit back in your nice office and think:

What’s the problem with this scenario? It shouldn’t be difficult to select a

vendor and then borrow the methodology from down the street. It worked for

them; it should work for us! We’ll call a few vendors in the morning and find

out about cost, time frame, and implementation methods. In the meantime,

I should find out a little more about how to do this and who will be using the

ERP. I remember from my information systems class in college that this is a

reasonable first step when it comes to buying software.

What do you think your response would be to this inquiry? As you go through this

chapter’s material, keep this vignette in mind, and see if your answer changes.

INTRODUCTION

There are two ways of implementing a software design; one way is to make it so simple that there are obviously no deficiencies, and the other way is to make it so

complicated that there are no obvious deficiencies. The first method is far more difficult.

—C.A.R. Hoare, James Martin Professor of Computing, Wolfson College

Successful implementation is the central goal of every human resource information system (HRIS) project, and it begins with a comprehensive design for the system. As the steps in the system development process are covered in this chapter, the foundation knowledge that is critical to the implementation process will be emphasized. Only by understanding the users/customers of the HRIS, the technical possibilities, the software solution parameters, and the systems implementation process can we increase the prob- ability that the completed software installation will adequately meet the needs of the human resource management (HRM) function and the organization. The chapter will begin by identifying the potential users and the kind of information that the HRIS will be managing and storing to facilitate decision making. The chapter will next discuss the technical infrastructure, how the technical infrastructure has evolved, and the many choices that the organization must make. After the technology is discussed, the systems implementation process will be presented.

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

48 Part I  Human Resource Information Systems (HRIS): The Backbone of Modern HR

Those who have participated in a system implementation will tell you that success is the result of careful planning, a dedicated team, top-management support, and an awareness of potential pitfalls. These same people will also tell you that the imple- mentation process provides a host of opportunities to reengineer and systematically improve nonsoftware processes to ref lect best practices in HRM. These opportunities should not be ignored, as they can benefit the organization as much as implementing the software will. Finally, the implementation team members will tell you that get- ting the system up and running was the most intense six months, year, or two years of their work life but that they learned a lot and every moment of the experience was worth the time.

There are four things that should be remembered throughout the chapter:

1. It is important to keep in mind the customer of the data, the process, and the decisions that will be made.

2. Everything about HRM is a system of processes designed to support the achieve- ment of strategic organizational goals. The HRIS, in turn, supports and helps manage these HR processes.

3. An HRIS implementation done poorly will result in an HRIS that fails to meet the needs of the HR function.

4. Successful implementation requires careful attention to every step in the system design process. However, done well, the implementation process is full of oppor- tunities to improve the organization and processes. More consistent processes will contribute to enhanced organizational performance.

HRIS CUSTOMERS/USERS: DATA IMPORTANCE Individuals who will be using the HRIS can be split into two general groups: employees and nonemployees. The employee category includes

• managers who rely on the HRIS and the data analyzed by the analyst or power user to make decisions;

• analysts or power users who use the HRIS to evaluate potential decision choices and opportunities;

• technical staff who are responsible for providing a system that is usable and up to date for each user, or clerical employees who largely engage in data entry; and

• employees who use the HRIS on a self-service basis to obtain personal informa- tion, for example, to look up paycheck information, to make choices about bene- fits during open enrollment, or to see how much vacation time they have available.

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

Chapter 3  Systems Considerations in the Design of an HRIS 49

The nonemployee group includes potential employees, suppliers, and partners. Potential employees are those who might log in via a Web portal to search for and apply for a position. Suppliers and partners are organizations that interface with the HR func- tion for a variety of purposes, from recruiting to benefits administration and payroll.

Employees

Managers The managers referred to within this section may have a variety of titles: manager, direc- tor, vice president, and even CEO. What they all have in common is that their primary HRIS need is to have real-time access to accurate data that facilitate decision making with regard to their people (Miller, 1998). The HRIS provides the manager with data for performance management, recruiting and retention, team management, project management, and employee development (Fein, 2001). The HRIS must also provide the information necessary to help the functional manager make decisions that will contrib- ute to the achievement of the unit’s strategic goals and objectives (Hendrickson, 2003). Easy access to accurate employee data enables the manager for each employee to view and engage in employee life cycle changes such as salary decisions, job requisitions, hir- ing, disciplinary action, promotions, and training program enrollment (Walker, 2001; Zampetti & Adamson, 2001).

Many HRIS products provide real-time reporting and screen-based historical infor- mation that can provide managers with information about their employees or their functional units. There are also several third-party software products available that provide managers with almost continuous data about the status of their unit and the organization—much as a dashboard on a car provides immediate information. The analysis of more complex situations is beyond the capabilities of many of these report- ing and query tools. To facilitate decision making on complex issues, the manager, before making a decision, usually relies on the analyst or power user to complete some type of analysis.

Analysts (Power Users) The analysts or power users are perhaps the most demanding user of the HRIS. The primary role of the analyst is to acquire as much relevant data as possible, examine it, and provide reasonable alternatives with appropriate supporting information to facilitate the decision process of the manager. The analyst is referred to as a power user because this person accesses more areas of the HRIS than almost any other user. Analysts must be proficient with reporting and query tools. Analysts must also understand the process used to collect the data, how new data are verified, and how the HRIS and the employee life cycle interact. They also need to understand the data definitions in terms of what data exist, the structure of the data, and what data fields are up to date and complete. Some HRIS also provide tools that the analyst can use to model scenarios or perform “what-if ” analyses on questions of interest.

As an example, a recruiting analyst might be asked to provide a short list of poten- tial internal candidates for a position that opened in the marketing function of a large

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

50 Part I  Human Resource Information Systems (HRIS): The Backbone of Modern HR

retailer. The potential candidates’ characteristics of interest are queried and may include (1) when they were last promoted, (2) whether they have engaged in continuous personal- skills development, (3) what their undergraduate degrees were, and (4) whether they have ever expressed any interest in marketing. The analyst would query appropriate tables and develop a list of internal candidates.

Another example might have the HR analyst completing an analysis of corporate headquarters turnover to determine if a particular function or salary issue is the cause of the problem. This information would be drawn from existing reports, ad hoc queries, and available salary information. Data could be compiled into categories by salary, function, gender, or organizational level and examined to determine if the cause of the turnover can be pinpointed and then countered.

Technicians (HRIS Experts) Technicians (HRIS experts) straddle the boundary of two functions. Their role is to ensure that appropriate HR staff members have all the access, information, and tools necessary to do their jobs. HRIS experts do this by understanding what is needed from an HR-process standpoint and then translating that into technical language, so the technical employees—programmers, database administrators, and application administrators—know exactly what to do. When the technical staff is planning to install the latest update and one of the results will be a change in functionality, the HRIS expert must take what the technical staff provides and translate that into language HR users understand, so as to indicate how processes and activities might change. For example, if an HR professional required that a new report be generated every other Tuesday, the HRIS expert would learn what data the report requires— perhaps mock the report up with the user—and then explain to the technical people how to make sure that this report is automatically generated on the time schedule.

Clerical Employees Much like power users, clerical employees also spend a significant portion of their day interacting with the HRIS. The difference is one of depth. The clerical employee must understand the process required to enter information into the HRIS and may also need to start the process or generate periodic reports. While clerical staff members in the HR employment department do not generally provide input about whether to hire an individual to a particular position, they bear considerable responsibility for seeing that the new employee gets paid properly. Hiring a new employee requires that someone, for example, a clerical employee, enter the appropriate information into the HRIS—such as the reporting relationship of the new employee as well as his or her benefits, salary, and direct deposit information.

Organizational Employees Organizational employees are essentially all the other employees throughout the organization who interact with the HRIS. These employees serve in roles such as

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

Chapter 3  Systems Considerations in the Design of an HRIS 51

bank teller, nurse, machinist, salesperson, and accountant. These employees are not involved in human resources and are not likely to make decisions with HR data, but they may utilize the HRIS to help manage their personal information. Typically, all the employees in the organization may interface with the HRIS through a self-service Web portal or secure employee kiosk, removing the necessity of an HR clerk or staff member assisting with many routine HR record modifications (Walker, 2001). Self-service capabilities encourage employees to manage their personal HR profiles with respect to a variety of functions, such as benefit and retirement plan monitor- ing or computerized training, in addition to using HRIS-based systems to complete numerous personnel forms (Adamson & Zampetti, 2001; Zampetti & Adamson, 2001). Typical self-service applications are accessible most of the day throughout the week. Employees log on to the system, where their identity is authenticated and verified. Then appropriate change options are offered to the employee based on cer- tain parameters that control the areas where the employee is allowed to make valid alterations to the HRIS—such as personnel data updates, job postings, or desired training enrollments (Adamson & Zampetti, 2001; Zampetti & Adamson, 2001). One fairly large financial-services organization noted that self-service options sig- nificantly enabled them to reduce the annual benefits open-enrollment process by reducing the paper documents generated, reducing necessary mailings, and reducing the data that had to be read and entered into the HRIS. Data entry time alone was reduced from six to two weeks (Bedell, 2003b).

Nonemployees

Job Seekers It is estimated that 70% to 90% of large organizations use online recruitment, and that number continues to increase (Stone, Lukaszewski, & Isenhour, 2005). Online recruiting tends to attract individuals who are well educated, Internet savvy, and searching for higher-level positions (McManus & Ferguson, 2003). Online recruit- ment also attracts people born since 1980, who have grown up with computers and are therefore comfortable with obtaining information on the Internet (Zusman & Landis, 2002). A successful recruitment website needs to be user-friendly and easy to navigate, while attracting candidates to apply to an organization by clearly com- municating the benefits of joining it.

Typical job seekers have little or no prior information about how to interface with the HRIS and have had nearly zero training opportunities with it. Therefore, the recruiting portal needs to provide ease of use and ease of access to up-to-date job information. The Web form that is used to collect applicant data must also be reliably entered into the appropriate fields within the company’s HRIS database. This online recruiting activity will facilitate searches for new employees to fill existing and future positions.

Sourcing Partner Organizations The partner organizations to HR functions require certain information to complete their tasks. Sourcing partner organizations such as Monster.com, Adecco, and most executive

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

52 Part I  Human Resource Information Systems (HRIS): The Backbone of Modern HR

recruiting firms require information about vacant positions, including a position descrip- tion, job specifications, desired candidate competencies, potential salary range, and con- tact information. The information provided is limited to specific searches for open jobs and is updated as needed.

Business partners that are the recipients of decisions to outsource portions of the HR function (e.g., benefit management firms) or that facilitate process completion on behalf of the employee (e.g., banks) require information that is related to current employees. This requirement increases the need for accurate data, training, and specialized security assurances, as employee information is leaving the organization.

Important Data As is evident in the previous sections, each customer or user of the HRIS has slightly dif- ferent needs with regard to what information he or she will be using. Some users simply input data and information, a few simply look at data and information provided in the form of reports, while a few others analyze the data and information to make decisions. What these users all have in common is that all the information is about potential and current employees with a focus on managing the organization’s human capital to improve decision making and help to achieve strategic organizational goals. Specific data from the HRIS database fit into three categories:

1. Information about people, such as biographical information and competencies (knowledge, skills, abilities, and other factors)

2. Information about the organization, such as jobs, positions, job specifications, organizational structure, compensation, employee/labor relations, and legally required data

3. Data that are created as a result of the interaction of the first two categories: for example, individual job history, performance appraisals, and compensation information

HRIS ARCHITECTURE HRIS Evolution In the early days of human resource applications (just 30 years ago), large “dinosaurs” roamed the IT landscape. These were called mainframe computers and were primarily built by International Business Machines (IBM). These large systems hosted the payroll applications for most enterprises. Users of the mainframe system, which mainly con- sisted of IT personnel and HRMS administrators, executed large batch processes while directly logged onto the mainframe. Although access to the mainframe could be done via a desktop monitor, no processing was done locally. This architecture is commonly called a single-tier computing system. Everything (user interface, application process- ing, and data storage) resided on the mainframe and had to be accessed by the client company locally.

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

Chapter 3  Systems Considerations in the Design of an HRIS 53

Client-Server (Two-Tier) Architecture During the 1980s, it was discovered that many typical HR functions (such as employee benefits, recruiting, training) did not require such high-powered and expensive process- ing available on the mainframe computers. With the advent of the personal computer (PC), many of these functions could be re-allocated to the local processing power of the PC. The purpose of the two-tier (client-server) architecture was to spread out low- powered processing capability to the dozens of PCs now being used across the enterprise. High-performance applications such as payroll would still be run in a batch process on the mainframe (or large Unix server). Ease of computer usage was a driving factor to include individuals with lower levels of technology experience. By the end of the decade, HRIS vendors such as PeopleSoft began the power of PCs and created the two-tier/client- server) architecture (see Figure 3.1).

Finally, the HR software application technology could be divorced from the database technology. This separation simplified the HR application and allowed an enterprise to select the most appropriate database management system (DBMS) for their needs. Refer to Chapter 2 for comprehension discussion of DBMSs. This time period coincided with the maturation of the relational database model. This model standardizes how data are physically stored on the computer and provides standard data access via the Structured Query Language (SQL).

Three-Tier and N-Tier Architecture From about 1995 to 2010, this division of labor concept expanded from two-tier into three-tier and finally N-tier architectures. With a three-tier architecture, the “back end”

Application server, database, and tools

Presentation and logic

FIGURE 3.1 ■ Two-Tier (Client-Server) Architecture

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

54 Part I  Human Resource Information Systems (HRIS): The Backbone of Modern HR

servers are divided into two components—the database server and the application server (see Figure 3.2).

The client still managed the user interface, but more demanding processing occurred in the middle—the application server tier. For example, if two recruiters updated the same job position at the same time, a transaction processor would ensure that both updates are committed to the database (if possible). This allowed many simultaneous users to access the central database. There are a couple of drawbacks with both two-tier and three-tier systems. First, there exists a large amount of network traffic or bandwidth required to execute database transactions between the client and the server. Second, the user interface client needs to be installed (along with database drivers) on every PC that needs to access the HRIS (with a corollary issue being that employees need to be trained on this application). Therefore, HRIS access tended to be limited to employees within the “four walls” of the enterprise (residing within the local area network). Low-bandwidth access, such as Internet dial-up, was impractical.

To truly provide for employee self-service (ESS) portals (discussed in detail in Chapter 10), the Web browser was adopted to solve the above issues. First, the browser created a “thin client” environment as opposed to the “thick client” envi- ronment described in the two-tier model (architecture). An Internet Web browser comes installed on all major operating systems (OS; e.g., Windows, Mac OS, Linux, Android). The browser’s user interface has become universal. Therefore, very little employee training is required to use a browser-based application. Finally, a browser works well in a low-bandwidth network environment. So now the typical HRIS appli- cation architecture looks like Figure 3.3. A standard Web server, such as Microsoft’s Internet Information Server (IIS) or Apache’s Web Server, manages HTML (Hyper Text Markup Language) communication between the browser and the application server. And the application server also issues transactions to the centralized database server. Instead of just limiting ourselves to a four-tier label, this has been labeled N-tier architecture for the following reasons:

• It is expandable to multiple Web servers and application servers to handle load balancing.

• Web servers can be geographically dispersed to provide world wide access.

• Additional file servers can be added to save documents, reports, error logs, and employee data, which are generated on a daily basis.

• Multiple print servers or specialized printers can be added as needed. For example, payroll check printing requires a security enabled toner called MICR to print encoded checks for bank cashing. These check printers can be physically located in a secure environment, but connected to the HRIS N-tier architecture like any other printer.

• Additional “process schedulers” can be added to handle large batch jobs such as payroll cycles. These servers offload “heavy” processing from the main applica- tion server so that user interaction is not impacted.

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

Chapter 3  Systems Considerations in the Design of an HRIS 55

Laptop

Desktop Computer

Smartphone

Web Server(s)

Application Server(s)

DBMS

Cell Phone

Telephone

Internet

FIGURE 3.3 ■ N-Tier Architecture

Application server(s)

DBMS Java or .Net

SQL

FIGURE 3.2 ■ Three-Tier Architecture

The architecture diagram becomes even more complicated when other ERP com- ponents are added. For example, when payroll is run, financial-related transactions need to be registered in the company’s general ledger (GL) application. Typically, GL exists within the financial/accounting component of large ERP systems from SAP, Oracle, and Microsoft. Therefore, GL transactions must be interfaced between payroll and

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

56 Part I  Human Resource Information Systems (HRIS): The Backbone of Modern HR

these systems. Thus additional application servers and databases enter the picture, as shown in Figure 3.3. So even though the architecture may be more complicated, the logi- cal view of the system remains relatively simple and this complexity is hidden from the end user. For example, a consultant for a large IT services company can travel through- out the world, work with multiple clients, but still be able to record his or her time and expense reports with a single browser application from any hotel room.

Cloud Computing—Back to the Future?! Around 2010, a new architectural model became more prevalent, called cloud computing. Cloud computing can be defined as a computing architecture that uses the Internet and central remote servers to maintain data and applications. Hosted services are then deliv- ered over the Internet. Cloud computing technology allows businesses to use applications without having to go through the complex installation process. It is notable that the “cloud” in “cloud computing” was inspired by the cloud symbol that one uses to repre- sent the Internet in flow charts and diagrams. There exist three general service categories commonly recognized in cloud computing. These include the following:

• Infrastructure as a Service—This type of service basically provides access to an operating system (such as Microsoft Windows or Linux) or cluster of connected systems. For example, Amazon Web Services provides access to on-demand operating systems.

• Platform as a Service —The next level of services includes application and Web server technology prebuilt into the leased computer. Enterprises still build out custom applications on top of these servers. Microsoft Azure is an example of this type of service.

• Software as a Service (SaaS)—In this case, a complete application is deliv- ered over the Internet. This can be as simple as an e-mail service (think Google Mail) or as complex as the entire HRIS application (see Workday, Inc. at www.workday.com) or ERP system (see NetSuite, Inc. at www.netsuite.com).

The underlying goal with cloud computing is to reduce the resources needed by com- panies in maintaining and running databases and applications. To achieve this, a server “cloud,” or group of computers, is operated off site and accessed through the Internet. In this way, a company can utilize the processing and storage powers of these “clouds” of computers without actually having to own and invest in them. This can reduce software and equipment capital outlays as the company does not need to keep purchasing new software or hardware to keep pace with technology changes. That investment becomes the responsibility of the vendor offering the cloud computing services. Cloud computing can be sold on demand, by the minute or the hour, and is elastic—meaning that an enterprise can consume as much or as little of a service as they want at any given time. From an accounting perspective, an enterprise leases a preset amount of computing power over an annual period. This can be budgeted in a similar manner as telephony or electrical expenses. Computing charges then become part of operational budget expense as opposed to large capital investments.

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

Chapter 3  Systems Considerations in the Design of an HRIS 57

In a sense, cloud computing is a return to the single-tier model of the 1980s. Instead of a single, large mainframe running all of the applications, the Internet is acting as the “supercomputer,” providing the application runtime environment. And instead of a “dumb” terminal accessing the mainframe payroll system, the browser now provides the interface to the entire set of human resources applications. In the ancient history of main- frame applications, human resources departments had to rely upon corporate data centers (or IBM) to provide high-performing and up-to-date applications. With cloud comput- ing, the burden lies with software vendors such as Workday or Oracle’s Taleo (www.oracle .com/us/products/applications/taleo/overview/index.html, a hosted recruiting and tal- ent management solution) to provide the updating. And of course, leveraging the cloud requires solid, high-performance Internet access all of the time.

Mobile Access Increasingly, workforces are mobile and available 24/7. Today, most people have mobile devices that have more computing power than even the fastest supercomputers in the 1980s. Mobile operating systems such as Android and iOS provide an easy to use inter- face that nontechnical people can navigate. Instead of companies forcing mobile devices onto their employees, enterprises encourage bring-your-own-device (BYOD) policies. Employees can access the HRIS through apps installed on their phones in a similar man- ner as installing consumer apps such as Facebook or Twitter. Major HRIS vendors provide apps for user friendly access to the system. Think of mobile devices as the “thin client” in the N-tier model. Tasks such as approving an expense report, viewing budget data, and managing time cards are easily accomplished on mobile devices (from phones to tablets).

Security Challenges Security ranks as a top priority for any human resource information system. Cloud service providers now maintain sensitive corporate data (outside of the four walls and possibly in other countries). So, when choosing a cloud solution, the evaluation process must include a thorough security analysis. Security needs to be addressed to handle the following situations:

• Exposure of sensitive payroll and benefits data between employees

• Loss of sensitive personnel data outside the enterprise (such as Social Security numbers)

• Unauthorized updates of key data such as salary amounts, stock options (both quantity and dates), and so on

• Sharing of personnel or applicant review comments with unauthorized employees

• Sharing data with external organizations and service providers

There are two auditing standards with which cloud vendors should comply. These are the Statement on Standards for Attestation Engagements #16 (SSAE 16) and ISO 27001.

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

58 Part I  Human Resource Information Systems (HRIS): The Backbone of Modern HR

SSAE 16 asserts that a provider meets security process requirements and has been audited. ISO 27001 requires that a provider implements a management and control framework related to security risks. HRIS cloud providers need to pass these certifications on a regular basis. As you consider vendors, it is important to ensure that the vendor is in compliance with these standards. Security for the HRIS is so important that there is an entire chapter that covers this topic in detail. If interested at this point, read and examine Chapter 15 for a comprehensive discussion on HRIS security.

BEST OF BREED An HRIS, as discussed in the previous section, often exists as one of the main parts of an overall ERP software solution for the company. Yet the HRIS is not a monolithic solution even within HR business processes. There exist alternative software applica- tions that solve specific HR business problems. This section addresses these types of solutions, the pros and cons of using multiple applications, and technical infrastruc- ture. In general, an architecture that combines products from multiple vendors is called best of breed (BOB).

The most well-known example of these BOB architectures comes from the audio industry—surround-sound receivers combined with CD players, DVD players, high- end speakers, and even the occasional retro turntable. All these components “plug and play” with each other to provide the best possible sound experience. This architecture works because of the standards that have been established for decades and that enable different devices to work together. We will see below that BOB software components for an HRIS still need to mature somewhat to reach the capability of the analog audio components. Yet the goal remains the same: deliver the best possible point solution to meet the business need.

For this synergy to work properly, three conditions need to be present for each soft- ware solution:

• First, there should be a perceived need for a specialized solution. For example, if a company expects to receive electronic job applications over the Internet 90% or more of the time, an optical character recognition (OCR) program, which scans handwritten or typewritten forms into an electronic format, would not be needed for resume scanning.

• Second, a universally agreed-on set of guidelines for interoperability must exist between applications. This exists at both the syntactical level and the semantic level. The syntactical level refers to the base “alphabet” used to describe an inter- face. For any two applications to communicate, they will need to share data. This data exchange can be done through databases, simple text files (such as Excel), or, increasingly, XML (eXtensible Markup Language). Basically, XML is similar to HTML, which is used in all Internet browsers. XML files can be shared or transmitted between most software applications today. XML presents a structured syntax—an alphabet—to describe any data elements within an HRIS.

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

Chapter 3  Systems Considerations in the Design of an HRIS 59

• Third, applications need to “speak the same language.” Just as the Roman alphabet allows the spelling of words in multiple languages and formats, XML enables data to be described with many different tags. At the semantic level, the language needs to map between software applications. An employee’s data description may consist of various tagged fields, such as Name, Address, Birth Date, Phone, Title, Location, and so on. If one of the applications does not have most of the same set of XML tags, it will not be able to exchange employee data. As important as the shared data semantics between applications is having analogous business process semantics. For example, a time-keeping system may define a pay period differently from the payroll application that actually prints employee checks.

An HR example would consist of selecting the most robust HR software applications— regardless of vendor—for each need and then using the XML language to move data efficiently among those applications. The HR department might select SilkRoad for tal- ent management (recruiting), Workday for most HR applications and data management, Kronos software for time and labor tracking, ADP software for payroll purposes, and a proprietary vendor product for outsourced HR benefits administration. To integrate these applications and create a seamless interface for users, companies will often utilize middleware software that sits on top of the applications, and can give the different appli- cations an overall look and feel and single point login. If the above conditions are met, HRIS applications should be able to interoperate with many point solutions. What are the typical solutions found in an HRIS implementation? The following sections will detail examples of solutions for some of the HR functions in an organization.

Talent Management The business process to recruit new employees for a company has many BOB opportunities. Large HRIS applications tend to focus on the internal hiring processes of the company—creating and approving job requisitions, saving applicant data, schedul- ing interviews, capturing interview results, and, finally, hiring the new employee. Yet there exist other software applications to fine-tune the hiring process. OCR scanning applications can eliminate the rekeying of applicant data from paper-based resumes, and other applications can perform applicant database searches, post job requisitions directly to Internet job sites, and run applicant background checks. These examples of specific functionality are typically not provided in an HRIS.

Time and Attendance Most companies require employees to submit time-keeping data each pay period. For hourly employees, this typically means using a punch card and time clock to track hours. Some solutions use employee badges with magnetic stripes, thereby enabling employees to clock in and out. Again, most HRIS vendors do not provide the hard- ware needed to track time. Time-keeping systems will capture the hourly data from various readers throughout a site. Employee scheduling for various shift coverages

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

60 Part I  Human Resource Information Systems (HRIS): The Backbone of Modern HR

can be implemented with time collection or planning software. For example, transit districts schedule bus operators to cover a very complex route system throughout the week. Unionized rules force certain break periods and preferences for senior operators. Driver schedules are posted for future pay periods, and actual hours worked, reported sick, taken as vacation time, and so on, are collected for prior pay periods. Such data will be reviewed each pay period prior to being transmitted to the HRIS payroll application.

Payroll In some cases, the entire payroll process may be outsourced to another vendor, such as ADP. ADP specializes in providing payroll services for companies of all sizes. For some enterprises, the cost of maintaining a payroll application and staff in-house may outweigh the benefits of controlling the process. In this case, employee time data, pay rate, and benefit information would be transmitted to ADP for processing. This choice of using an outside provider is conceptually the reverse of the typical BOB motivation. The enter- prise is not looking for the best technical or functional solution, but for a provider offering a commodity service at the lowest cost. In the case of a large multinational corporation with lots of employee levels, it would probably be prudent to purchase the HRIS payroll application.

Benefits Each year, most employers present their employees with what is called the benefits open enrollment period during which signing up for benefits is similar to course enrollment for students each semester. Instead of enrolling in courses, though, employees enroll for major medical, dental, and insurance benefits. For example, employees choose between health care providers such as Kaiser or Blue Cross for their medical insurance. These providers support interfaces with the major HRIS applications so that, as employees log into the enrollment software, they can review offerings tailored to their company’s plan. Thus, when employees select a particular insurance program, they can then transmit enrollment data to the provider through their organization’s HRIS.

As one can see in Figure 3.4, BOB solutions introduce additional complexity into the software architecture. This complexity can add IT expense in the form of new software licensing and programming charges. The justification for the added func- tionality needs to compensate for these additional costs. So a cost-benefit analysis should be performed by the HR function to determine whether the BOB alternative is to be used. Detailed procedures to compute a cost-benefit analysis are covered in Chapter 7.

In summary, BOB options can create a much more powerful solution than a stand- alone HRIS. The BOB alternative also creates system f lexibility, as each application can be managed and upgraded independently. Yet this power and f lexibility may end up costing the IT department by giving rise to more complex systems administration issues.

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

Chapter 3  Systems Considerations in the Design of an HRIS 61

PLANNING FOR SYSTEM IMPLEMENTATION A variety of authors, consultants, and others have discussed implementation methods for information systems. Rampton, Turnbull, and Doran (1999) discuss 13 steps in the implementation process. Jessup and Valacich (1999) divide the implementation of a system into five steps, with a focus on the systems side of the process. Regan and O’Conner (2002) provide eight steps for implementing information systems. Some organizations have proprietary processes that they use for all implementations. Points to remember in regard to system implementation as this section is examined are as follows: (1) This is a process that will take a team of individuals anywhere from six weeks to three years to complete; (2) a variety of ways to manage this process may be attempted, so long as the key issues are examined and organizational goals for the implementation are achieved; and (3) there is no single definitive approach to be used in all situations.

The first key step is planning. This is an absolutely critical step in any business process and especially in the design of any large-scale software implementation involving multiple- process interfaces. Note that the planning process doesn’t guarantee success—rather, it increases the probability that the implementation will be successful. The systematic examination of the following topics provides the organization with the opportunity to see how the implementation will work—to peer into the crystal ball—and identify some contingencies for implementation steps that might not go perfectly. In other words, a robust planning process provides a framework within which the implementation team can proceed, and it provides some decision-making parameters for any unforeseen dif- ficulties that might appear (Bedell, 2003a).

HRS System

AP I Layer

ERP Connector

Legacy Adapter

DBMS Adapter

B2B Adapter

External Web

Services

DBMS

Mainframe

EAI – Message Oriented Middleware

FIGURE 3.4 ■ Best-of-Breed Solutions Architecture

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

62 Part I  Human Resource Information Systems (HRIS): The Backbone of Modern HR

The topics that need to be discussed during the various steps of the planning process include, but are not limited to, the following:

• Project manager

• Steering committee/project charter

• Implementation team

• Project scope

• Management sponsorship

• Process mapping

• Software implementation

• Customization (vanilla vs. custom)

• Change management

• “Go live”

• Project evaluation

• Potential pitfalls

Rather than go into a lengthy discussion of all of the topics above regarding systems development, Chapter 4 address them more in-depth, and Chapter 6 discusses issues sur- rounding change management processes in HRIS implementations.

Summary

The implementation of an HR IS goes beyond simply placing a new technology into the organization. The organization the challenges of coordinating different organizational, people, and technical needs. The first section considers the important internal and external users or customers of the HR IS and organizational goals. In the second section, four different types of HR IS architectures are enumerated. The evolution of technology, from legacy “dinosaur” systems to contemporary N-tier architectures as well as cloud and mobile computing, has dramatically affected the scope and inf luence of HR IS in organizations. Therefore, the strengths and weaknesses of each architecture

are discussed. The third section of the chapter discusses the best-of-breed approach to HR IS adoption and the pros and cons of this approach in different functional areas. Finally, the chapter concludes with a general discussion of the steps that organizations might take to plan and imple- ment an HR IS and of the factors that can affect these processes. In summary, organizations that are able to man- age the people, processes, and technology involved in an HR IS implementation should be more likely to find that the new HR IS is able to meet their goals more effectively in terms of budget, functionality, and usability than those who are unable to do so.

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

Chapter 3  Systems Considerations in the Design of an HRIS 63

Case Study: Vignette Revisited

This case is revisited with some additional information that involves the understanding of the material in this chapter. The additional information will be added to the situation described in the vignette at the beginning of this chapter.

A billion-dollar retailer with more than 4,000 stores finds that it cannot move fast enough to beat the competition.

The organization’s senior management arrives at the con-

clusion that it would be easier to achieve the strategic

Key Terms

bandwidth 54 best of breed (BOB) 58 cloud computing 56 enterprise resource planning (ERP)

software 46 eXtensible Markup Language

(XML) 58 Hyper Text Markup Language

(HTML) 54

implementation team 48 infrastructure as a service 56 load balancing 54 middleware 59 operating systems (OS) 54 optical character recognition

(OCR) 58 platform as a service 56 project manager 62

project scope 62 semantic level 58 software as a service (SaaS) 56 sourcing partner organizations 51 syntactical level 58 three-tier architecture 53 two-tier (client-server)

architecture 53

Discussion Questions

1. Identify the various types of users or customers of an HRIS.

2. What are the three broad categories of data that an HRIS manages?

3. How does network bandwidth affect a two-tier (client- server) architecture?

4. How does an N-tier architecture simplify the IT department’s task of maintaining client software?

5. Research www.hropenstandards.org. How many transac- tions or interfaces do the standards support? How many software vendors are involved with the organization?

6. Take a specific industry, say the K–12 education industry. How might HireRight’s integration with

Oracle’s PeopleSoft assist the process of hiring employ- ees such as bus drivers, janitors, or campus security?

7. When might BOB not be best?

8. The systems development process has been discussed by many. Name five discussion topics that need to be com- pleted during the planning process.

9. How does network bandwidth impact a two-tier (client- server) architecture?

10. How does an N-tier simplify IT departments’ task of maintaining client software?

11. How does the use of smartphones and other devices make delivery of HRIS functionality more effective? More complicated?

(Continued)

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

64 Part I  Human Resource Information Systems (HRIS): The Backbone of Modern HR

goals enumerated by the board of directors if the various

organizational functions would share information. Shared

information would enable them to develop and deploy

new actions and tactics more quickly. The CEO and the

president have therefore ordered the major functions to immediately update their information systems so that data sharing is possible. The SVPs of accounting and human resources immediately decide that the only solution is to decide jointly on an ER P product. ER P software applica- tions are a set of integrated database applications, or mod- ules, that carry out the most common business functions, including human resources, general ledger, accounts pay- able, accounts receivable, order management, inventory control, and customer relationship management. To speed the installation along, they will install it using a rapid implementation methodology that a company down the street used. The goal is to have the new systems opera- tional in nine months.

Shortly after this decision is made, the SVP of HR calls you into his office and tells you that you will be management sponsor for this project. You have to decide on everything. You sit back in your nice office and think:

What’s the problem with this scenario? It shouldn’t be difficult to select a vendor and then borrow the methodology from down the street. It worked for them; it should work for us! We’ll call a few ven- dors in the morning and find out about cost, time frame, and implementation methods. In the mean- time, I should find out a little more about how to do this and who will be using it. I remember from my information systems class in college that this is a reasonable first step when it comes to buying software.

What do you think your response would be to this inquiry? Has your response changed now that you have read this chapter? If so, how?

New Information for the Case: Part 1

After some discussions with department heads from all the departments in the organization, you realize that there are a large number of people (stakeholders) who will be affected by the new systems. Furthermore, you come to realize how important HR data really are to these stakeholders. Based on this information, you think, “Wow, there are far more people who could be potentially using this information system than I expected!” The old textbook and the vendor information should provide a lot to think about.

Using the information from the section of this chapter titled “HRIS Customers/Users: Data Importance,” please answer the following questions:

1. Identify some of the customers who would be logical members of the implementation team and explain why.

2. Think through an HR process and sketch out what data are necessary to complete your sample process well. How much history does the organization need to convert to continue functioning?

3. Pick one area of the HR function (e.g., recruit- ing), and make a list of processes that will need to be mapped and possibly reengineered during this implementation.

New Information for the Case: Part 2

Over the next month, as you continue to obtain information about the design and implementation of the new system, you are still somewhat confused about what to do. Once again, we find you in your office thinking:

There are so many potential decisions to make with regard to hardware! I wonder what we need to schedule, if we need to buy hardware, and how we should con- figure the servers to ensure maximum security. And this

(Continued)

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

Chapter 3  Systems Considerations in the Design of an HRIS 65

bring-your-own-device stuff is going to drive us nuts! It’s time to make another list of questions!

Based on the information in the section of the chapter titled “HRIS Architecture,” please respond to the following:

1. Make a list of questions for each of the following individuals: lead hardware technical expert, net- work manager, and chief software manager.

2. What configuration should the company use? Make a suggestion and support it!

3. Make some recommendations about security and bring-your-own-device.

New Information for the Case: Part 3

As part of your investigation, you have uncovered a system concept called “best of breed.” You are in your office again trying to decide what to do, and you think, “Perhaps best of breed might be the easiest and best way to go.”

1. Make a recommendation as to whether a BOB option should be chosen or a more standardized option with simpler interfaces between hardware and software should be selected.

2. Think about what the best answer should be when you have to connect your system with accounting and finance. Make a recommendation and support it!

New Information for the Case: Part 4

You have just sat down in your office feeling as if there is way too much to do! Your IS software professional has given you the information from one of the potential vendors about the various steps that need to be taken in implementation of the HRIS. Your immediate reaction is, “Man, am I going to be at work late for the next many months!”

Case Study Questions

Based on the information in this chapter, answer the follow- ing questions:

1. Develop the first few steps of the project plan.

2. Discuss the potential political necessities outlined in this section as they relate to this type of implementation.

3. Think about and create a list of steps that make sense for your organization.

4. Is the nine-month rapid-implementation time frame feasible? Or will it just lead to failure?

INDUSTRY BRIEF JIM PASCARELL, VICE PRESIDENT, NFRASTRUCTURE

Designing and implementing an HRIS is one of those initiatives that every organization encounters, yet most of the individuals within an organization usually have little or no experience in going through the process. This combined with the continuous evolution of technology puts organizations in the precarious spot of trying to figure out the best approach to successfully choosing and implementing a solution that provides the organization with all of the necessary value-added benefits, yet manages the risk of a potential failed implementation.

(Continued)

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

66 Part I  Human Resource Information Systems (HRIS): The Backbone of Modern HR

Organizations, whether they are commercial, education, or public sector, that have had the most success follow a design methodology that is centered on people, process, and technology. Those of us that have spent a great deal of our careers designing and implementing these systems have learned, sometimes through trial and error, that the planning and design of the system arguably plays the most critical part in determining success. Common characteristics shared by organizations that have been and are most successful are as follows:

Commitment: A frequently used word that is only proven to be true by actions. Defining and under- standing what the system needs to provide so that it can be an enabler for the organization and used as a competitive differentiator.

Proper Resource Allocation: Having your best and brightest be part of the design, participating throughout the lifecycle of an implementation. Insight is critical and to avoid sloppy design, it is worth the sacrifice to dedicate some of the most knowledgeable resources in the organization. The cost of not doing this will be paid later on due to rework and changes.

Understanding of Technology: Designing a system that will evolve along with technology, not one that will be restricted as technology changes. There are too many organization design systems that are somewhat outdated in a short period of time. This is primarily caused by the lack of understand- ing as to what the capabilities of the technology are and how they can help the system continue to be enhanced. I unfortunately have been part of many projects where once a system was “live” and operational, it almost immediately needed to be “upgraded” due to improper design upfront.

Clear and Realistic Expectations: Once set, these expectations need to be constantly communicated to all stakeholders. This provides a common bond and keeps everyone focused on what needs to be accomplished.

Acceptance of Change: Through education and training, acceptance defeats resistance. Too many orga- nizations choose the right technology yet fail to allocate the proper attention to change management.

Over 25 years of working and assisting with many diverse organizations as they design their HRIS, the most successful have truly understood and successfully managed the points above. Through dedication and perseverance, these organizations have become leaders in their industries by using all of the benefits a properly designed HRIS can provide. As we continue into the digital age with access to more data faster than we could have ever imagined, it has never been more important for organizations to “get it right” when it comes to designing their HRIS.

Student Study Site

Visit the Student Study Site at study.sagepub.com/kavanagh4e for additional learning tools such as access to SAGE journal articles and related Web resources.

(Continued)

FOR THE USE OF STRAYER UNIVERSITY STUDENTS AND FACULTY ONLY. NOT FOR DISTRIBUTION, SALE, OR REPRINTING.

http://study.sagepub.com/kavanagh4e

00_KAVANAGH_4E_FM
01_KAVANAGH_4E_CH-01
02_KAVANAGH_4E_CH-02
03_KAVANAGH_4E_CH-03
04_KAVANAGH_4E_CH-04
05_KAVANAGH_4E_CH-05
06_KAVANAGH_4E_CH-06
07_KAVANAGH_4E_CH-07
08_KAVANAGH_4E_CH-08
09_KAVANAGH_4E_CH-09
10_KAVANAGH_4E_CH-10
11_KAVANAGH_4E_CH-11
12_KAVANAGH_4E_CH-12
13_KAVANAGH_4E_CH-13
14_KAVANAGH_4E_CH-14
15_KAVANAGH_4E_CH-15
16_KAVANAGH_4E_CH-16
17_KAVANAGH_4E_CH-17
18_KAVANAGH_4E_GLOSSARY
19_KAVANAGH_4E_REF
20_KAVANAGH_4E_AUTHOR INDEX
21_KAVANAGH_4E_SUBJECT INDEX
22_KAVANAGH_4E_ABOUT THE EDITOR
23_KAVANAGH_4E_ABOUT THE CONTRIBUTORS

Principles of Incident Response and Disaster Recovery, 2nd Edition

Chapter 02

Planning for Organizational

Readiness

Objectives

Discuss why an individual or group needs to be appointed to create a contingency policy and plan

Describe the elements needed to begin the contingency planning process

Define business impact analysis and describe each of its components

List the steps needed to create and maintain a budget used for the contingency planning process

Principles of Incident Response and Disaster Recovery, 2nd Edition

Introduction

Planning for contingencies

Complex and demanding process

Systematic methodology

Organize the planning process

Prepare detailed and complete plans

Commit to maintaining those plans

Rehearse plans with a military rigor

Completed after normal working hours

Maintain the processes

Principles of Incident Response and Disaster Recovery, 2nd Edition

Beginning the Contingency Planning Process

Contingency planning management team (CPMT)

Consists of an individual or team

CPMT responsibilities

Obtain commitment and support

Manage and conducting the overall CP process

Write the master CP document

Conduct the business impact analysis (BIA)

Assist in identifying and prioritizing threats and attacks

Assist in identifying and prioritizing business functions

Principles of Incident Response and Disaster Recovery, 2nd Edition

Beginning the Contingency Planning Process (cont’d.)

CPMT responsibilities (cont’d.)

Organize and staff subordinate teams leadership

Incident response

Disaster recovery

Business continuity

Crisis management

Provide guidance to and integrate the work of the subordinate teams

Principles of Incident Response and Disaster Recovery, 2nd Edition

Beginning the Contingency Planning Process (cont’d.)

CPMT positions

Champion

Project manager

Team members

Representatives from other business units

Business managers

Information technology managers

Information security managers

Representatives from subordinate teams

Principles of Incident Response and Disaster Recovery, 2nd Edition

Beginning the Contingency Planning Process (cont’d.)

Principles of Incident Response and Disaster Recovery, 2nd Edition

Commitment and Support of Senior Management

Clear and formal senior executive management commitment required

Prevents CP process failure

Managers and employees provide time and resources

Support gained from communities of interest

Each should complement the others

Information security communities of interest

Information security managers and professionals

Information technology managers and professionals

General management managers and professional

Principles of Incident Response and Disaster Recovery, 2nd Edition

Information Security Management and Professionals

Protect information systems and stored information from attacks

Tightly focused on protecting system integrity and confidentiality

Sometimes lose sight of availability

Principles of Incident Response and Disaster Recovery, 2nd Edition

Information Technology Management and Professionals

Design, build, or operate information systems

IT managers and skilled professionals

Systems design, programming, networks

Related disciplines categorized as information technology (IT)

Same objectives as information security community

Focus

System creation and operation costs

System users ease of use

System creation timeliness; transaction response time

Principles of Incident Response and Disaster Recovery, 2nd Edition

Organizational Management and Professionals

Includes executive management, production management, human resources, accounting, legal, and others

IT community category reference

Users of information technology systems

Information security community category reference

Security subjects

All IT systems and information security objectives

Implement broader organizational community objectives and safeguard effective use and operation

Principles of Incident Response and Disaster Recovery, 2nd Edition

Elements Required to Begin Contingency Planning

Four required CP process elements

Planning methodology

Policy environment (enables planning process)

Understanding causes and effects of core precursor activities (business impact analysis)

Access to financial and other resources

Articulated and outlined by the planning budget

Development of CP policies and plans

Occurs once CPMT organized and staffed

Expands the four elements

Principles of Incident Response and Disaster Recovery, 2nd Edition

Elements Required to Begin Contingency Planning (cont’d.)

Complete CP development methodology adaption

NIST Special Publications 800-34, Rev. 1, Contingency Planning Guide for Federal Information Systems (2010)

Special Publications 800-61, Rev. 2, Computer Security Incident Handling Guide (2012)

Complete process

Form the CPMT

Develop contingency planning policy statement

Conduct the business impact analysis (BIA)

Principles of Incident Response and Disaster Recovery, 2nd Edition

Elements Required to Begin Contingency Planning (cont’d.)

Form subordinate planning teams

Develop subordinate planning policies

Integrate the BIA

Identify preventive controls

Organize response teams

Create contingency strategies

Develop subordinate plans

Ensure plan testing, training, and exercises

Ensure plan maintenance

Principles of Incident Response and Disaster Recovery, 2nd Edition

Contingency Planning Policy

Required for effective contingency planning

Purpose of policy

Define the CP operations scope

Establish managerial intent with regard to timetables for incident response

Recovery from disasters

Reestablishment of operations for continuity

Establish responsibility for the development and operations of the CPMT in general

Provide specifics on CP-related team constituencies

Principles of Incident Response and Disaster Recovery, 2nd Edition

Contingency Planning Policy (cont’d.)

CP policy sections

Introductory statement

Scope and purpose statement

Call for periodic risk assessment and BIA

Specification of major CP components to be designed

Call for, and guidance in, selection of recovery options and BC strategies

Requirement to test the plans on a regular basis

Identification of key regulations and standards impacting CP planning

Principles of Incident Response and Disaster Recovery, 2nd Edition

Contingency Planning Policy (cont’d.)

Identification of key individuals responsible for CP operations

Challenge to individual members

Asking for their support

Reinforcing their importance in the overall CP process

Additional administrative information

Each CP meeting should be documented

Principles of Incident Response and Disaster Recovery, 2nd Edition

Business Impact Analysis

Business impact analysis (BIA)

Investigation and assessment of the impact that various events or incidents can have on the organization

Provides detailed identification and prioritization of critical business functions

Different from the risk management process

Begins with prioritized list of threats and vulnerabilities

Question

If an attack succeeds, what do you do next?

Principles of Incident Response and Disaster Recovery, 2nd Edition

Business Impact Analysis (cont’d.)

Five “keys to BIA success”

Set the project scope carefully

Initiate data-gathering process

Find information senior managers need

Seek out objective rather than subjective data

Determine higher management needs prior to data collection

Gain validation of the results:

Derived from risk assessment and BIA

From owners of the business processes being examined

Principles of Incident Response and Disaster Recovery, 2nd Edition

Business Impact Analysis (cont’d.)

CPMT conducts the BIA in three stages

Principles of Incident Response and Disaster Recovery, 2nd Edition

Determine Mission/Business Processes and Recovery Criticality

First major BIA task

Analyze and prioritize business processes

Based on relationships to mission

Evaluate independently to compare with organization as a whole

Business process = “mission/business process”

Task performed in support of the overall mission

Collect critical information before prioritizing

Avoid “turf war”

Useful tool: BIA questionnaire

Principles of Incident Response and Disaster Recovery, 2nd Edition

Determine Mission/Business Processes and Recovery Criticality (cont’d.)

Weighted analysis table resolves most critical issues

Weighted analysis process

Identify organization categories

Assign weights to each category

Assigned weights add to a value of one (100 percent)

Identify various business functions

Importance value assessed on a scale of one to 10

Weights are multiplied by the scores in each category

Weights summed to obtain that business function’s overall value to the organization

Principles of Incident Response and Disaster Recovery, 2nd Edition

Determine Mission/Business Processes and Recovery Criticality (cont’d.)

Principles of Incident Response and Disaster Recovery, 2nd Edition

Determine Mission/Business Processes and Recovery Criticality (cont’d.)

NIST Business Process and Recovery Criticality

NIST Special Publication 800-34 Rev. 1

Large quantities of information needed

BIA data collection process needed

Principles of Incident Response and Disaster Recovery, 2nd Edition

Determine Mission/Business Processes and Recovery Criticality (cont’d.)

Principles of Incident Response and Disaster Recovery, 2nd Edition

Key Downtime Metrics

Maximum tolerable downtime (MTD)

Total amount of time the system owner/authorizing official willing to accept for a process outage

Includes all impact considerations

Recovery time objective (RTO)

Time period within which systems, applications, or functions must be recovered after an outage

Recovery point objective (RPO)

Point in time to which lost systems and data can be recovered after outage; determined by business unit

Principles of Incident Response and Disaster Recovery, 2nd Edition

Key Downtime Metrics (cont’d.)

NIST Special Publication 800-34 Rev. 1

Contains additional definitions for MTD, RTO, RPO

Reducing RTO requires mechanisms to shorten start-up time or provisions

To make data available online at a failover site

Reducing RPO requires mechanisms to increase data replication synchronicity between production systems and backup implementations

Critical need: avoid exceeding MTD

RTO must be shorter than MTD

Principles of Incident Response and Disaster Recovery, 2nd Edition

Cost Balance Point

Different for every organization and system

Based on financial constraint, operating requirement

Principles of Incident Response and Disaster Recovery, 2nd Edition

Prioritize Information Assets

Helpful to understand information assets used by prioritized processes

High-value information assets

May influence a particular business process valuation

Task normally performed as part of the risk-assessment function of risk management

Perform task now if organization has not performed this task

Principles of Incident Response and Disaster Recovery, 2nd Edition

Identify Resource Requirements

Need to determine resources needed to recover prioritized processes and associated assets

Resource intensive processes: IT functions

Resources require extensive sets of information processing, storage, and transmission

Supporting customer data, production data, and other organizational information

Business production-oriented processes

Require complex or expensive components to operate

Principles of Incident Response and Disaster Recovery, 2nd Edition

Identify System Resource Recovery Priorities

Last stage of the BIA

Prioritize resources associated with the mission/business processes

Brings better understanding of what must be recovered first

Create additional weighted tables of the resources

Develop a custom-designed “to-do” list

Use a simple valuation scale

Primary/Secondary/Tertiary

Critical/Very important/Important/Routine

Principles of Incident Response and Disaster Recovery, 2nd Edition

BIA Data Collection

Not a discrete step

Methods

Online questionnaires

Facilitated data-gathering sessions

Process flows and interdependency studies

Risk assessment research

IT application or system logs

Financial reports and departmental budgets

BCP/DRP audit documentation

Production schedule

Principles of Incident Response and Disaster Recovery, 2nd Edition

Online Questionnaires

Online or printed questionnaire

Identify and classify

Business functions and impact they have on other organization areas

Enables a structured collection method

Collect information directly from those most knowledgeable

Examples

Web site for the Texas State Office of Risk Management BIA questionnaire areas

See Table 2-3 and Table 2-4

Principles of Incident Response and Disaster Recovery, 2nd Edition

Online Questionnaires (cont’d.)

Principles of Incident Response and Disaster Recovery, 2nd Edition

Online Questionnaires (cont’d.)

Principles of Incident Response and Disaster Recovery, 2nd Edition

Facilitated Data-Gathering Sessions

Focus group (facilitated data-gathering session)

Collecting information directly from the end users and business managers

Individuals brought together

Brainstorm answers to BIA process questions

To yield quantity or quality of information desired

Ensure a relaxed, productive session

Provide clear session structure

Encourage dialog

Restrict managers’ ability to take control

Principles of Incident Response and Disaster Recovery, 2nd Edition

Process Flows and Interdependency Studies

Systems diagramming

Documents ways systems operate

Charts process flows and interdependency studies

Used for both manual and automated systems

Common diagramming techniques

Use case diagrams and supporting use cases

Specifically designed to help understand interactions between entities and business functions

Principles of Incident Response and Disaster Recovery, 2nd Edition

Process Flows and Interdependency Studies (cont’d.)

Principles of Incident Response and Disaster Recovery, 2nd Edition

Process Flows and Interdependency Studies (cont’d.)

Uniform modeling language (UML) models

Class diagrams, sequence diagrams, collaboration diagrams

Traditional systems analysis and design approaches

Workflow, functional decomposition, and dataflow diagrams

Quite complex

Only use if organization has them in place

Principles of Incident Response and Disaster Recovery, 2nd Edition

Risk Assessment Research

Risk assessment and risk management effort

Provides a wealth of information for BIA effort

Some modification may be necessary

Risk management process

Primary starting point for the BIA

Alternative efforts required if risk assessment not performed

Teams may collect information from outside sources on risk assessment

Principles of Incident Response and Disaster Recovery, 2nd Edition

IT Application or System Logs

IT staff

Valuable in determining categorical data

Frequency of occurrence

Probability of success

Provide information from various logs

Logs collect and provide reports

Failed login attempts, probes, scans, denial-of-service attacks, malware detected

Provides more accurate attack environment description

Principles of Incident Response and Disaster Recovery, 2nd Edition

Financial Reports and Departmental Budgets

Documents from normal operations

Provide insight into business operations

Costs and revenues provided by each functional area

Useful in prioritizing business areas and functions

Provides insight into the area’s profitability and revenues contribution

Calculating business impact most common method

Review financial reports and budgets

Lost sales, idle personnel costs, and other opportunity costs easily obtained

Principles of Incident Response and Disaster Recovery, 2nd Edition

Audit Documentation

Paid external consultant audits

Used by larger organizations and publicly traded firms

Audit function compliance

Federal and state regulations

National or international standards,

Part of proactive ongoing improvement program

Audit reports

Provide additional information for the BIA process

Principles of Incident Response and Disaster Recovery, 2nd Edition

Production Schedules

Information valuable in the completion of the BIA

Production schedules, marketing forecasts, productivity reports, other business documents

Include information collected from multiple sources

Rather than redundantly re-collecting it from the same sources

If information not collected directly by the BIA team

Make sure it is current and accurate

Undated information often worse than no information

Principles of Incident Response and Disaster Recovery, 2nd Edition

Budgeting for Contingency Operations

Incident response

May not require dedicated budgeting

Disaster recovery and business continuity

Require ongoing expenditures, investment, and service contracts to support their implementation

Many organizations are “self-insured”

Put money into an account

Draw upon it should replacements be required

Some organization forego “self-insured” investments

Due to tight budgets and drops in revenues

Principles of Incident Response and Disaster Recovery, 2nd Edition

Incident Response Budgeting

IR capabilities

Part of a normal IT budget

Data protection and response, backup and recovery methods

Uninterruptible power supplies (UPSs)

Antivirus/antispyware/antimalware software

Redundant arrays of independent disks (RAID)

Network-attached storage (NAS) or storage area networks (SANs)

Additional expenses

Protection of user data outside common storage areas

Principles of Incident Response and Disaster Recovery, 2nd Edition

Incident Response Budgeting (cont’d.)

Required budgeting

Maintenance of redundant equipment

Use the “rule of three”

Keep an online production system

Keep an online or very nearly online backup system

Keep an offline testing and development system

Online “hot” servers have redundancy incorporated

Backup or “warm ”server

Provides redundant functions standing by in a near-online state

Principles of Incident Response and Disaster Recovery, 2nd Edition

Disaster Recovery Budgeting

Number one DR budgetary expense

Insurance policies

Provide for the capabilities to rebuild and reestablish operations at the primary site

Data loss policies

Many organizations cannot afford them

Losses from a distributed denial-of-service attack (DDoS) not so familiar

Insurance difficult to estimate exactly

Many expenses not covered by insurance

Loss of water, electricity, data, and the like

Principles of Incident Response and Disaster Recovery, 2nd Edition

Business Continuity Budgeting

Requires the largest budget expenditure

Staggering cost to maintain high level of redundancy

Example: service level agreements (SLAs) for hot sites

Set aside “war chest” of funds for items needed during continuity operations

Safety deposit boxes at a local bank

Store corporate credit cards, purchase orders, cash

Consider nonsalaried employee overtime

Principles of Incident Response and Disaster Recovery, 2nd Edition

Crisis Management Budgeting

Fundamentals of crisis management

Focused physical and psychological losses associated with catastrophic disasters

Primary budget item

Employee salaries if unable to come to work

Establish a minimum budget for paid leave

Other items

Funeral and burial expenses; employee counseling services

Principles of Incident Response and Disaster Recovery, 2nd Edition

Summary

Approach CP using a systematic methodology

CPMT responsible for contingency policy and plans

Obtains commitment and support, manages the overall process, writes documents, conducts the BIA, organizes and staffs leadership, provides guidance

Roster includes champion, project manager, others

Effective CP begins with effective policy

Policy provides guidance from executives

Policy contains statements, calls for action, guidelines and additional administrative information

Principles of Incident Response and Disaster Recovery, 2nd Edition

Summary (cont’d.)

BIA: investigation and assessment of event impact

Detailed identification and prioritization of critical business functions

Key element: placing priorities and values on mission/business process

Insurance : number-one budgetary expense for DR

Larger deductibles provide lower monthly premiums

Set aside funds to cover deductibles

Business continuity: largest budget expenditure

Consider employee overtime, employee loss expenses

Principles of Incident Response and Disaster Recovery, 2nd Edition

Graded Assignments may be found at the end of each chapter of the required textbook under the title "Real-World Exercises". Each assignment is due between Monday to Sunday evening by 11:59 p.m. EST. of the respective week. Each student is to select one exercise (per module exercise) from the grouping as identified below. Provide documented evidence, in Moodle, of completion of the chosen exercise (i.e. provide answers to each of the stated questions). Detailed and significant scholarly answers will be allotted full point value. Incomplete, inaccurate, or inadequate answers will receive less than full credit depending on the answers provided. All submissions need to directed to the appropriate area within Moodle. Late submissions, hard-copy, or email submissions will not be accepted.

Assignment 1:

using a web browser, search for any information security policies used at your academic institution. Compare them to the ones discussed in this chapter. Are there sections missing? If so, which ones?

Assignment 2:

Using a Web browser and a search engine, search the terms “CitiBank backup tapes lost.” You will find many results. Select one article and identify what that article considers a shortcoming in CitiBank’s planning. What part of the contingency planning process came up short (IR, BP, or CP)? How could the shortcoming have been prevented?

APA Format

1 Primary post should contain at least 250 words. At least 3 peer reviewed journal references.

2 Secondary posts should contain at least 250 words each. At least 2 peer reviewed journal references for each secondary post

Module 1 Discussion Question Search "scholar.google.com" for a company, school, or person that has been the target of a network or system intrusion? What information was targeted? Was the attack successful? If so, what changes were made to ensure that this vulnerability has been controlled? If not, what mechanisms were in place to protect against the intrusion.

Module 2 Discussion Question Search "scholar.google.com" for a company or school that has defined the role of endusers in the creation of a contingency plan. Discuss why it is (or is not) important to include end users in the process of creating the contingency plan? What are the possible pitfalls of end user inclusion? 

Module 3 Discussion Question Search "scholar.google.com" for a company or school that has reported issues, problems, concerns about their backup procedures. Discuss the issue of securing backups. There have been several incidents lately in which backup media containing personal customer information were lost or stolen. How should backup media be secured? What about off-site storage of backups? 

Module 4 Discussion Question Search "scholar.google.com" or your textbook. Discuss the technical skills required to have a CSIRT response team consisting of employees with other job duties (i.e., not a full-time CSIRT job category)? Why or why not? What factors will influence their decision? 

Module 5 Discussion Question Search "scholar.google.com" or your textbook. Discuss what role end-users typically play in incident reporting? Should end users be encouraged to report suspicious occurrences? If so, why; if not, why not. What factors typically influence the end-user decision to report (or not report) a potential incident? 

Module 6 Discussion Question Search "scholar.google.com" or your textbook. Discuss ways organizations have built a CSIRT. What are the components to building an effective and successful CSIRT team? 

Module 7 Discussion Question Search "scholar.google.com" or your textbook. Discuss how organizations have faced the challenges that incident handlers are challenged with in identifying incidents when resources have been moved to a cloud environment. 

Module 8 Discussion Question Search "scholar.google.com" or your textbook. Discuss the issues organization’s face with regards to the protection of its customer information. How might an organization notify its users that all communications are being monitored and preserved? How will end users typically respond to such announcements? NO LATE WORK WILL BE ACCEPTED

APA Format

1 Primary post should contain at least 300 words. At least 3 peer reviewed journal references.

3 Secondary posts should contain at least 150 words each. At least 2 peer reviewed journal references for each secondary post

Topic: Computerized Operating Systems (OS) are almost everywhere. We encounter them when we use out laptop or desktop computer. We use them when we use our phone or tablet. Find articles that describes the different types of operating systems (Linux, Unix, Android, ROS, z/OS, z/VM, z/VSE, etc). Do not select MS WINDOWS. Write a scholarly review of comparing any two or more OS; attach a copy of the article to your postings. Remember, this assignment is to be scholarly; it is not enough for you to simply post your article and add cursory reviews. Cited references are required. In addition you must read the postings of the other students and comment significantly on those areas. Please see Discussion Forum of the class syllabus for additional details on content.

The primary goal for the discussion forum assignment is to simulate the free sharing of ideas among peers that is typically experienced in graduate courses delivered in the more traditional, face-to-face environment. Evaluating a student's performance on the assignment is not, therefore, very concrete. There are a number of factors that impact the quality of a student's participation. The content of the contributions is, of course, one rather obvious factor, but the context in which the contributions have been made is equally important. In evaluating performance on this assignment, the following factors will be considered: Add value to the content of the discussion by posting well-written, on-topic contributions.Share resources with others by providing support for you contributions in the form of citations from the literature. Promote peer-to-peer discourse by:Initiating one quality major topics of discussion and actively participating throughout the period of the forum with at least 2 quality engagement postings responses to follow student's major topics of discussion thread - responding to postings of others in a timely manner (within 72 hours). Each contribution (treads and replies) is expected to be though provoking and critical (i.e. "While a database is sometimes consider to consist of a large single site repository, researchers have suggested..." and not simplistic (i.e. "Yes, I agree" or "Thanks for ..."). Please see class syllabus for specific grading details.

blog1

Get help from top-rated tutors in any subject.