The Quiet Floor

EXCEPTIONS

By eleven twenty-three, Priya Banerjee had been asked to approve three things nobody could explain and one thing everybody insisted was urgent.

This was not unusual.

The urgent thing was a temporary extension to an access permission that had already been temporary for eighteen months. The first inexplicable thing was a control marked not applicable by somebody who had then attached six pages explaining how they complied with it. The second was a spreadsheet containing three different numbers labelled total. The third was sitting opposite her now, although Priya had not yet decided whether it was inexplicable or merely irritating.

“You can’t have no owner,” she said.

Daniel Morris from Technology Risk gave her the tired expression of a man who had hoped the meeting would consist primarily of Priya agreeing with him.

“It has an owner.”

“Who?”

“The Platform Controls team.”

“That’s a team.”

“Yes.”

“Teams don’t have access.”

“This one does.”

Priya looked down at the paper in front of her.

Strictly speaking, it was not paper. Northcote Banking Group had spent several million pounds over the previous five years becoming a paperless organisation, a project that had resulted in every meeting room containing a printer.

She had printed the access report because Daniel’s version kept changing whenever he filtered it.

The highlighted row said:

PAYMENTS DATA HUB — PRIVILEGED SERVICE ACCOUNT

OWNER: PLATFORM CONTROLS

Priya looked back at him.

“Which human being is responsible for it?”

Daniel sighed.

“That’s what the recertification is meant to establish.”

“No. The recertification is meant to confirm that the person responsible still requires the access. We’re not meant to discover the person while we’re doing it.”

“There was a restructure.”

“There is always a restructure.”

“It moved from Infrastructure.”

“To?”

“Platform Controls.”

“Which human?”

Daniel leaned back.

“I’ll find one.”

“Good.”

“You know they won’t know anything about it.”

“Then find someone who does.”

“They’ll just tell me it belongs to the team.”

“Then explain that the team won’t be the one sitting opposite a regulator if somebody uses it to move customer data.”

Daniel gave her a look that suggested regulators were a device Priya personally invented whenever she wanted to win an argument.

She smiled.

He knew he’d lost.

“All right,” he said. “End of day.”

“Tomorrow lunchtime.”

“Generous.”

“I thought so.”

He took his laptop and left.

Priya drew a line through the account on her printout, then immediately regretted printing it because the list beneath continued for another eleven pages.

Northcote’s Identity Governance Remediation Programme had started as an internal review, become a regulatory commitment, been renamed twice, acquired a steering committee and was now, according to one slide she had seen that morning, entering its accelerated delivery phase.

This meant the deadline had not changed, but everybody had become more frightened of it.

Thirty-one thousand employees, contractors and assorted other human beings had somehow accumulated just over two hundred thousand permissions to systems, files, payment functions, customer records, buildings and things whose purpose nobody could adequately describe. Most were ordinary. Some were not.

The current exercise concerned the ones that mattered.

People who could approve.

People who could override.

People who could alter.

People who could move money or prevent other people moving it.

Every privileged account now had to be connected to a verified living human owner.

That final word had appeared in bold in the regulatory letter.

Living.

It had become a small office joke.

Northcote had spent years establishing who owned its systems.

Apparently nobody had thought to establish whether they were alive.

Priya turned back to her screen.

There were forty-three unread emails.

Six carried red exclamation marks, which usually meant somebody had decided their poor planning deserved a colour.

Her calendar informed her she had nineteen minutes before the next meeting.

She opened the least threatening subject line.

Quick question

It was from Mina Doyle.

Priya closed it again.

Mina’s quick questions were rarely quick.

A shadow appeared at the edge of her desk.

“Have you got five minutes?”

Priya looked up.

Mina was holding a laptop under one arm and a coffee in the other hand. The coffee looked untouched. This was normal. Mina bought coffee with conviction and drank it with less consistency.

“I’ve got nineteen.”

“That’s loads.”

“It isn’t an invitation to use all of them.”

“I only need five.”

“Which, in Mina time, means?”

“Eight.”

Priya gestured towards the chair.

Mina sat down and put the coffee on the desk, directly on top of a coaster Priya kept there largely because nobody else ever used it.

She was twenty-seven and had been on the remediation programme for just under four months. Priya had initially worried that she was too junior for some of the reconciliation work she’d been given. Within two weeks, the concern had shifted. Mina was perfectly capable of doing it. The real problem was persuading her that occasionally the answer to why does this system say that? was simply because this system is rubbish.

Mina opened her laptop.

“I’ve got some exceptions.”

“Everyone has exceptions.”

“These are weird.”

“Everyone’s exceptions are weird.”

“No, everyone else’s exceptions are boring-weird. These are weird-weird.”

Priya glanced at the clock in the corner of her screen.

“Eight minutes.”

Mina turned the laptop.

A spreadsheet filled the display.

Priya recognised the extract. Human Identity Reconciliation. Name, employee number, role, employing entity, cost centre, manager, directory status, physical access, privileged system access, certification status.

Several rows were highlighted yellow.

“How many?”

“Seven.”

“That isn’t many.”

“I know.”

“What failed?”

“Human verification.”

Priya waited.

Mina waited back.

“And?”

“They don’t have any.”

“Any what?”

“Human verification.”

“Yes, I understood that bit.”

“I mean anything that verifies they’re human.”

Priya looked more closely.

The first row belonged to someone called Helen Voss.

Role: European Regulatory Liaison.

Directory status: Active.

Privileged access: Active.

Manager: Group Regulatory Oversight.

“Group Regulatory Oversight isn’t a person.”

“I know.”

“Have you checked the hierarchy?”

“Yes.”

“And?”

“It loops.”

“How?”

Mina clicked into another screen.

Helen Voss reported to Group Regulatory Oversight. Group Regulatory Oversight was listed as a functional reporting structure owned by European Control Services. European Control Services had an accountable executive but no individual line-management entry for Helen.

“Legacy matrix reporting,” Priya said.

“Probably.”

“What about payroll?”

“Nothing.”

“Contractor?”

“That’s what I thought.”

“And?”

“Nothing in current contingent worker management.”

“Legacy contractor?”

“There’s an old classification.”

“There you go.”

“Except there’s no agency.”

“Old data.”

“No contract reference.”

“Old data.”

“No end date.”

Priya looked at her.

“Old bad data.”

Mina nodded as though Priya had confirmed something important.

“Exactly.”

“That wasn’t agreement.”

“I know.”

Priya scrolled across.

Helen Voss possessed active permissions to three governance workflow platforms and one regulatory document repository.

“Why is she in scope?”

“She can reject approvals.”

“What level?”

“Depends on workflow.”

“Mina.”

“Some quite high.”

Priya scrolled farther.

The oldest recorded account creation date was fourteen years earlier.

“There was a migration from Bracken around then.”

“I checked.”

“And?”

“There are loads of bad Bracken records.”

“So—”

“But not like this.”

Priya sat back.

This was the point in conversations with Mina where she usually discovered that Mina had already done the three obvious checks and had been waiting politely for Priya to catch up.

“All right. What about the other six?”

Mina brought up the names.

Martin Reeve — Senior Integration Controls Officer

David Chenery — Senior Conduct Assurance Manager

Anika Lenz — Group Controls Review

Peter Halloran — Transaction Governance Lead

Rachel Iqbal — Whistleblowing Oversight Manager

Celia March — Senior Governance Secretariat

Priya read them twice.

“What exactly do you mean by no human verification?”

“No current payroll. No pension link I can find. No current contract. No proper manager record. No current contingent worker record. No emergency contact on the main HR feed.”

“That last one isn’t unusual.”

“No.”

“Physical access?”

“Messy.”

“That means?”

“Some of them have records, but not anything recent enough to help.”

“Directory profiles?”

“All active.”

“Emails?”

“All active.”

“Have you emailed them?”

“Not yet.”

“Why not?”

“I wanted to check whether I was being stupid first.”

Priya gave her a look.

Mina corrected herself.

“Whether there was an obvious explanation I was missing.”

“Better.”

Priya clicked Helen Voss’s directory profile.

A standard Northcote card appeared.

No photograph.

That was not unusual. Half the photographs in the directory had been taken in another geological period and the other half were grey silhouettes.

Helen’s profile listed her London location as HQ — Floor 23.

Priya clicked Martin Reeve.

Floor 23.

David Chenery.

Floor 23.

Rachel Iqbal.

Floor 23.

“That’s probably the old integration floor,” Priya said.

“That’s what I thought.”

“You keep saying that in a way I don’t like.”

Mina leaned forward.

“Look at certification.”

Priya did.

Helen Voss’s access had been recertified six months earlier.

“By who?”

“That’s the thing.”

The certification showed approval by European Control Services Governance Owner.

Priya rubbed the bridge of her nose.

“Another functional role.”

“Yes.”

“That shouldn’t be possible anymore.”

“Apparently it was six months ago.”

“Who owns the functional role?”

“I’m still trying to find out.”

“So find out.”

“I will.”

“And check historical HR. Not just the new platform. Bracken contractors were migrated badly. Some secondees never had proper payroll records here because their home entity paid them.”

“I’ve checked the first archive.”

“The first?”

“There are three.”

“Of course there are.”

“One doesn’t open.”

“Also of course.”

“The second says Helen was an integration resource.”

“There you are.”

“From 2011.”

“Yes.”

“And she’s still here.”

“People do stay at companies.”

“Without ever becoming employees?”

“If she’s an international secondee—”

“Fourteen years?”

Priya stopped.

“That would be an enthusiastic secondment.”

Mina smiled.

Priya looked at the other names again.

The roles sounded important, but Northcote contained hundreds of roles that sounded more important than the people occupying them. Anyone who had worked there long enough knew titles were less a hierarchy than a sedimentary record of reorganisations.

“What do they actually do?” Priya asked.

“That’s my next question.”

“So at the moment you’ve got seven badly maintained records.”

“Active badly maintained records with approval authority.”

“Yes.”

“And nobody can tell me who they are.”

“You’ve asked?”

“Two people.”

“Two isn’t nobody.”

“One said Helen’s in Regulatory.”

“She is.”

“The other said to ask Helen.”

Priya laughed despite herself.

Mina pointed at the screen.

“That’s what I mean.”

“No, what you mean is you’ve found some legacy workers nobody has cleaned up properly.”

“They can reject things.”

“Then we clean them up properly.”

Mina’s expression changed only slightly.

Priya recognised it.

“You think I’m dismissing you.”

“No.”

“You do.”

“A little.”

“I’m not.”

“It sounded dismissive.”

“I’m telling you the most likely explanation.”

“Which is?”

“Bracken.”

“Bracken isn’t an explanation. Bracken is a historical event.”

Priya looked at her.

Mina lifted both hands.

“That came out more argumentative than I meant.”

“No, it came out exactly as argumentative as you meant.”

“Fair.”

Priya glanced again at the clock.

Seven minutes had become thirteen.

She had six minutes until her next meeting and the room was on the other side of the floor.

“Log them as exceptions.”

Mina frowned.

“That’s it?”

“For now. That’s what an exception is for. You can’t verify the human owner, so don’t certify the access.”

“What happens then?”

“They get resolved during remediation.”

“By who?”

“The business owner.”

“Which is another functional role.”

“Then that gets resolved too.”

Mina closed the laptop halfway but did not stand.

Priya knew this manoeuvre. It meant Mina had one more thing.

“What?”

“I looked at Helen’s activity.”

“You said that was your next question.”

“I lied.”

“Good governance culture.”

“She’s approving things.”

“You’ve told me.”

“No. I mean recently.”

“How recently?”

Mina opened the laptop again.

She clicked through a sequence of screens, quicker than Priya could follow.

“There.”

A governance action from nine days earlier.

European Product Governance Review

Decision:

FURTHER REVIEW REQUIRED

Reason:

Independent regulatory assessment to be completed prior to progression.

Helen Voss.

Another.

Three weeks earlier.

Cross-Border Customer Data Initiative

Decision:

DECLINED — CONTROL EVIDENCE INCOMPLETE

Another.

Five weeks earlier.

Project Lark — Governance Stage 3

Decision:

REFER TO LEGAL

Priya stopped thinking about her next meeting.

“These are live?”

“Yes.”

“Not migrated history?”

“I checked the transaction timestamps.”

“And the underlying users?”

“Helen.”

“No, I mean technical user IDs.”

“Helen’s.”

“Session authentication?”

“I don’t have access.”

“Don’t try to get it.”

“I wasn’t going to.”

“You were thinking about it.”

“I was thinking about asking.”

“Good. Ask.”

Mina nodded.

Priya scrolled through another set of decisions.

The activity did not look like abandoned accounts. It looked like work.

Routine work, mostly. The small acts through which organisations accumulated decisions.

Approve.

Reject.

Return.

Escalate.

Request evidence.

A person did not need to be visible to change what happened next.

“What about the others?”

“Same sort of thing.”

“All seven?”

“Five definitely. Two I’m still checking.”

Priya felt the first small movement of genuine discomfort.

Not fear.

Nothing remotely like fear.

More the sensation of finding a door in a familiar corridor that she could not remember ever seeing before.

“Who assigned these to you?”

“The reconciliation engine.”

“So randomly?”

“Basically.”

“Anyone else got similar records?”

“Probably.”

“Mina.”

“I’ll check.”

“Don’t widen this into a private investigation.”

“I haven’t.”

“You’ve asked people whether Helen Voss exists.”

“I asked where she worked.”

“That’s not what you told me earlier.”

“One of them became whether she existed.”

Priya sighed.

“Be boring.”

Mina looked offended.

“For twenty-four hours. Can you manage that?”

“I can be extremely boring.”

“I’ve seen no evidence.”

“That’s because I don’t document it.”

Priya smiled despite herself.

“Check the old HR sources. Check contingent worker data. Check the manager chains. Get the access authentication through the proper team. And email the people.”

“All of them?”

“Yes. Something deeply sophisticated like: Hello, we’re recertifying your access. Please confirm your employee details.”

“What if they answer?”

“Then your mystery has had an embarrassingly short life.”

“And if they don’t?”

“Then we escalate.”

Mina finally shut the laptop.

“Fine.”

She picked up her coffee.

“That’s cold.”

“I know.”

“You haven’t drunk any.”

“I was going to.”

“You bought that before the nine o’clock.”

Mina looked down at it.

“I’ve been busy.”

“With people who don’t exist?”

Priya meant it lightly.

Mina did not answer lightly.

“Maybe.”

Priya watched her for a second.

Then shook her head.

“Legacy contractors.”

“Probably.”

“Bad migrations.”

“Probably.”

“Stale accounts.”

“Probably.”

“And until you’ve ruled those out?”

“They’re exceptions.”

“Exactly.”

Mina stood.

Priya turned back towards her own screen, already mentally late for the next meeting.

At the edge of the desk, Mina stopped.

“Priya?”

“What?”

“There are people working here who don’t exist.”

Priya looked up.

Mina’s expression was not dramatic. That was what made the sentence land differently the second time.

She was not trying to make it sound strange.

She was trying to describe the data accurately.

Priya glanced at the clock.

Three minutes.

“Log them,” she said. “We’ll clear them properly.”

Mina nodded.

Then she left.

Priya gathered her notebook, phone and printed access report and hurried towards Conference Room 8.

By the time she returned forty-seven minutes later, Daniel Morris had emailed to say he had identified a human owner for the Payments Data Hub.

The human owner had responded to say he had never heard of it.

Priya dealt with that first.

Then two urgent emails.

Then a message from Legal.

Then somebody rang her about a steering committee paper containing the phrase residual risk acceptance pathway without being able to tell her what risk was being accepted.

It was nearly one when she remembered Mina.

She opened the corporate directory.

Typed:

Helen Voss

The profile appeared.

HELEN VOSS

EUROPEAN REGULATORY LIAISON

GROUP REGULATORY OVERSIGHT

LONDON HQ — FLOOR 23

No photograph.

No mobile number.

A landline extension.

Green status indicator.

Available.

Priya stared at that for a moment.

Then, feeling faintly ridiculous, she clicked the message icon.

A blank conversation opened.

At the top of it, beside Helen Voss’s name, the green circle remained.

Available.

Priya typed:

Hi Helen—

She stopped.

Deleted it.

This was Mina’s exception.

Mina was already investigating it.

Priya closed the window.

For perhaps two seconds, nothing happened.

Then the green circle beside Helen Voss changed.

Away.