It is another Monday morning and after a relaxing weekend you are sitting in your office preparing your agenda for the week. As the IT manager of a small financial services company you have to prepare for your staff meeting at 10am when all of your 15 IT team members will be present. You are planning to discuss the launch of your new promotion scheme, which is due to begin at the end of the week. Fortunately, Paul, who is the main market analyst for the company, was prepared to do some extra work at home over the weekend in order to make sure the forecasts were ready for the meeting. While sipping your first cup of coffee someone knocks at the door. It is Fred, the hardware manager. He looks a bit embarrassed, and after a little stilted small talk, he tells you that â€˜a problemâ€™ has come up. He has just checked-in the laptop that Paul the market analyst had taken out of the companyâ€™s pool and used at home over the weekend in order to finish the forecasts you had asked for. However, when completing the routine check of the laptop, Fred tells you he noticed links to various pornography sites in the history file of the laptopâ€™s internet browser. He tells you that they must have been accessed over the weekend when Paul had the laptopâ€”the access dates refer to the last two days, and as is usual practice, the history file was emptied after the last person had borrowed it. There is a strict company policy prohibiting employees from making personal use of company hardware, and access to sites containing â€˜material of an explicit natureâ€™ is tantamount to gross misconduct and may result in the immediate termination of the employeeâ€™s contract. When your hardware manager leaves the office, you take a big breath and slowly finish your coffee. After a few minutes thinking through the problem, you ask Paul to come into your office. You have a quick chat about his work and tell him that you are really pleased with the forecasts he put together over the weekend. Then, you bring up the problem with the laptopâ€™s history file. When you tell him what has surfaced, Paul is terribly embarrassed and assures you that he has absolutely no idea how this could have happened. After some thought, though, he tells you that he did allow a friend to use the laptop a couple of times over the weekend to check his email. Although Paul says that this is the only possible explanation for the mystery files, he does not volunteer any more information about the friend involved. As it happens, this does not make you feel much better about the situationâ€”the companyâ€™s code of conduct also prohibits use of IT equipment by anyone other than employees. The company deals with a lot of private data that no one outside the company should have access to. You remind Paul of this and he tells you that he did not realize there was any such policy. You are left wondering when the last time was that anyone did any training around the ethics policyâ€”certainly not recently. Scratching your head, you tell Paul that you will need 24 hours to think it over, and you get on with preparing for the team meeting. While driving home that evening, you turn the issue over and over in your head. Yes, there is a corporate policy with regard to web access and personal use of company resources. And in principle you agree with thisâ€”after all, you were part of the committee that designed the policy in the first place. A company like yours has to be able to have clarity on such issues, and there have to be controls on what the companyâ€™s equipment is used forâ€”no doubt about that. You cannot help thinking that Paul has been pretty stupid in breaking the rulesâ€”whether he visited the sites himself or not. On the other hand, you are also having a few problems with taking this further. Given the amount of embarrassment this has caused Paul already, is this likely to be just a one-off? Does the company not need Paulâ€™s experience and expertise, especially now with the big launch a few days off? Why cause problems over a few websites, especially when the company has not been very active in communicating its ethics policy? Would it be better to keep it quiet, give him a warning, and just get on with the launch? This looks set to be a tough call.