HR Software Security: Lessons for Workforce and Payroll Continuity
Practical security and continuity questions for HR and workforce systems: sensitive data, access, vendor evidence, incident communication and payroll...
2 min read
Michael Brandt
:
May 22, 2025, 8:38:43 AM
Hiring technology can help a team organize applications and manage a large volume of work. It can also make it harder for applicants and employers to understand how a recommendation was produced. That deserves careful attention.
The litigation in Mobley v. Workday, Inc. brought these questions into public view. Applicants alleged discrimination involving Workday's application tools. A May 2025 court order granted preliminary collective certification on an age discrimination claim. That procedural decision did not establish that the alleged discrimination occurred. The court-authorized notice explicitly states that the court had taken no position on the merits of the claims or defenses.
This article focuses on the operational lessons, rather than reporting the current status or outcome of that case.
Ask what a system actually does: organizes records, searches for a skill, ranks applications, recommends a next step or filters someone out. These functions deserve different levels of review. The team needs to know which inputs are used, which choices it controls and how a result can be investigated.
A vendor's description is a starting point. Test the workflow against the roles and applicants the organization expects to serve, and document how the tool is configured and used.
Human involvement should mean more than accepting a recommendation. Reviewers need relevant context, training and authority to challenge an output. Applicants need clear instructions and an appropriate route for assistance, correction or an accommodation request.
Consider whether a process is understandable and usable across different experiences and abilities. A technically completed application does not necessarily mean the person had a fair opportunity to present relevant information.
Define who owns evaluation and what evidence is needed. Work with the appropriate legal, HR, accessibility and technical specialists to assess the process, including potential adverse effects. Revisit the review when models, configuration, job requirements or the applicant population change.
Preserve enough documentation to explain decisions, while limiting access and retention of sensitive information to an approved purpose. The NIST AI Risk Management Framework offers a voluntary reference for considering trustworthiness and risk throughout an AI system's use.
Inovium's view is that AI should give people more capacity and better context. In HR, that may mean less time assembling records and more time understanding a role, supporting an applicant or making an informed decision. Efficiency matters, but it should be evaluated alongside the experience and accountability of the process.
Explore our approach to human-centered AI and digital transformation.
Practical security and continuity questions for HR and workforce systems: sensitive data, access, vendor evidence, incident communication and payroll...
A modern WFM system needs modern thinking. Challenge outdated processes and rethink enablement to unlock your workforce's full potential.
Turn workforce reporting into practical decisions with trusted data, clear definitions, operational context and accountable follow-through.