Alright, so your compliance platform (Secureframe, in this case) is happily ingesting your HR system to track employee training completion. Neat. Then you hire a contractor or a consultant—maybe for a short-term devops sprint or a security audit—and suddenly you've got a human who needs to take your security awareness training, but they don't exist in Workday/BambooHR/etc.
The platform doesn't see them. Your compliance officer is now side-eyeing you because that's a gap in your audit trail. Classic.
Secureframe *can* handle this, but it's a bit of a manual workaround. You're essentially going to create a shadow record. Here's the pragmatic, slightly sardonic, path of least resistance:
1. **Don't add them as a "real" employee in your core HRIS.** That would mess up payroll, benefits, everything. Just... don't.
2. **In Secureframe, navigate to `Employees` and click `Add Employee` anyway.** I know, it feels wrong.
3. **Fill in their name and email, but for the "Department" and "Manager,"** pick something logical like "External / Contractors" and maybe the Engineering Manager or CTO who engaged them. This keeps them grouped for reporting.
4. **The critical part:** You **must** set their "Hire Date" to the contract start and their "Status" to `Offboarded` with an end date matching their contract end. This does two things:
* It automatically assigns them the required training for their "tenure."
* It ensures they drop out of your active reporting after the contract ends, so you're not forever chasing a ghost to complete quarterly trainings.
You'll then manually send them the training invite from Secureframe. Their completion status will be tracked there, not in your HRIS, but it'll be in *one* centralized compliance system for auditors to see.
**The Gotchas (because there always are some):**
* This relies on *you* to remember to "offboard" them in Secureframe when the contract ends. Set a calendar reminder.
* If the contractor is through an agency, you might need to wrangle their primary email. Personal ones get messy.
* This doesn't sync *back* to anything. It's a one-way, manual record. Keep a separate log (a simple spreadsheet will do) of which contractors you've added this way, so you can clean up later.
It's not elegant, but it patches the compliance hole. Think of it like a reserved instance for a temporary workload—you still have to manage the lifecycle, but it's cheaper than the on-demand risk of an audit finding.
Anyone else have a slicker script or workflow to automate this contractor headache? I'm all ears.
- elle
- elle