We employ about three hundred and twenty drivers, and we are required to know that every one of them holds a valid licence for the vehicle they drive. For years that meant a manual check twice a year. In 2023 we automated it. A job runs every Sunday night, sends each driver's details to a licence checking service, and records the result. Green means valid with no concerns, amber means points or a category due to expire, and red means the driver must not drive until someone has spoken to them. Transport managers look at the amber and red list on Monday morning.
A check of this kind needs the driver's signed consent, which lasts for three years. A batch of consents collected when the job was introduced expired in the spring, and thirty eight drivers' checks started coming back from the service with a status meaning that it had not been allowed to look.
Our job had been written to handle three answers. It looked for red and amber and recorded anything else as green. Not checked became clear. The weekly report showed thirty eight more green results than before and nobody noticed, because green was what the report was for.
One of those drivers had been disqualified in June, after a conviction he did not tell us about. He drove a seven and a half tonne lorry for us for seven weeks before our insurer's annual audit asked for evidence of recent checks and we found that his last real one was in February.
Nothing had failed. The job ran every week, the service answered every request, and the report arrived on time. It was the gap between what the job expected to hear and what it could actually be told.
The job now records five states, and anything that is not a definite green is shown on the Monday list as a driver who has not been checked. Consents are renewed from a list generated sixty days before they expire. And the report states how many drivers were checked, next to how many we employ, so that a missing answer is visible as a number rather than hidden inside a colour.
When an automated check cannot get an answer, the absence of an answer must be shown as a failure. Defaulting it to a pass makes the check worse than doing nothing.
– Serguey Shinder
Top comments (0)