Security Administration Ownership
In my previous roles with various orgs, my team (HRIS) have owned security administration with oversight by IT and Audit.
In my new role, security is owned by IT. We have run into issues in that they do not understand the function of HR so it makes it difficult for them to identify appropriate domains and questions to ask. It has caused a lot of frustration.
We are a company of less than 2500 employees.
Is this the norm that security is owned by IT? I have talked to other WD users where they are also use to security administration living within HRIS.
I plan to argue a case for transitioning the responsibility to HRIS.
For those of you that have security within HRIS or had to transition it to HRIS - what arguments could I make to support the change? What am I missing? I'd like to give real world examples but my mind is coming up blank at the moment. What real world issues have you come up against related to this?
I have:
- Align ownership to business expertise - HRIS knows job context of HR jobs.
- Role changes requires access to staffing transactions which may be confidential where HRIS has access to the data but not IT.
- Separating security from HR configuration creates gaps and inconsistencies.
- Reduces bottlenecks.
- HRIS is positioned with job knowledge to link access decisions to business justification.
- Workday is designed as a business configured system - not purely an IT managed platform. Aligning security with HRIS reflects Workday's intended operating model.
- Enables a balanced operating model where HRIS is execution and IT is governance.