OrgChart Construction
ID-Org™ -- a solution for constructing and maintaining OrgChart data, is both built into ID-Certify®, and available separately.
Overview:
In some organizations, data connecting users to their managers may be incomplete, inaccurate or both. This can make it difficult to deploy user provisioning automation, where managers often must authorize security change requests that pertain to their subordinates, and access certification automation, where managers must review and approve the access rights of their subordinates.
ID-Org is software from Hitachi ID for constructing and maintaining comprehensive OrgChart data across large organizations. It automatically prompts and reminds managers to identify their subordinates, in order to construct reporting lines for all employees, contractors and vendors in an organization.
Definition of and uses for OrgChart Data:
In the context of ID-Org, OrgChart data is defined as one link from each user profile to that user's manager. This is analogous to the LDAP or Active Directory schema, where each user object has an attribute that may contain the unique identifier of that user's manager.
While many people have "dotted line" relationships with multiple managers, in most organizations every person has a primary manager, with authority to review access rights, to terminate the employee or contractor, to review performance and pay, etc.
OrgChart data is crucial in the deployment and operation of an enterprise identity management system. Some of its uses are:
- Managers may be periodically required to review a list of their direct subordinates and their respective access rights. This process can identify and remove stale accounts and privileges, that do not represent current business needs. Periodic audits are essential for compliance with privacy and corporate governance legislation.
- Managers can be asked to approve changes in access privileges for their subordinates.
- When one manager or application owner fails to respond to a request by the identity management system -- such as a request to approve an access change -- his manager may be asked to respond in his place, as a form of automated escalation.
Problems with Acquiring and Maintaining OrgChart Data:
HR and ERP applications normally do have a place to store OrgChart information, including the identity of each employee's manager. Unfortunately, in most organizations, this data is not sufficient for use in an identity management system:
- Whole classes of users, such as contractors and vendors, are simply not entered into most HR applications.
- Data in the HR application may be stale -- having been entered at the date an employee was hired and never updated.
- Data in the HR application may be incomplete -- available for some users, but not others.
ID-Org is designed to address the problems of data quality and completeness.
It is certainly possible to hire a team of consultants to work with HR and interview managers, in order to construct OrgChart data centrally. This approach has problems, however:
- It can be costly, requiring a lengthy consulting engagement.
- OrgChart data collected at the start of the project may be obsolete by the end of the project.
- There is no way to keep the data complete and accurate after the project is over. Instead, the OrgChart data collected represents a "window" in time.
Deploying and Using ID-Org:
Assuming that a single authoritative directory is used to identify all users (e.g., LDAP or Active Directory) and that the e-mail address for every user can be inferred from this system, it can be configured and moved to production in a week or less. Note: actual software installation only takes a few minutes.
The time required to gather OrgChart data depends on how quickly managers respond to a request to fill in their individual lists of subordinates. For example, in an organization with ten levels of management and staff, where the average manager takes two business days to respond to a request to identify his subordinates, a complete OrgChart can be constructed in about 20 business days.
ERP / HR Application Integrations:
ID-Org can acquire preliminary OrgChart data from an HR or ERP application (e.g., SAP or PeopleSoft). This forms the initial OrgChart, which managers review and correct/complete. As managers submit changes, ID-Org can write them back to the ERP application, either in real time or by constructing update batches that application owners can apply manually.
Reporting
ID-Org includes the following built-in reports:
- Manager listing
- Users Terminated by ID-Org