BPO information security training for team leads and compliance staff

Opens with a question auditors ask: think of one control on your floor and the record that shows it worked last Tuesday. Presents four recent cases, starting in May 2025 with Coinbase, whose overseas customer support insiders were paid to copy customer data, and a June 2025 Reuters report of an outsourcing employee with photos of her work screen. Further cases cover a cyber criminal reaching a third-party customer servicing platform through a Qantas call centre, and a group posing as employees to get help desks to reset passwords. Draws the team lead's question: is the control on paper, or in practice with records behind it? Introduces GHI Contact Solutions Inc., a multi-client BPO with its main site in Manila and a second site in Mumbai. Ends with the thirteen modules, four practice exercises and the exam, and a recap.

What you will be able to do

• Explain the patterns behind recent BPO and call centre incidents
• Test whether a control is in practice or only on paper
• Describe how the modules, exercises and exam work

Why it matters

A control is what happens, not what is written; this question prepares team leads for the evidence clients and auditors ask for.

Practice: Practice: Why controls fail on a BPO floor · 3 questions

Starts with a UK bank's yearly questionnaire, where GHI lists three systems holding the bank's data, then the on-site audit finds a shared folder of call lists exported months earlier by the QA team. Explains mapping personal data client by client: what it is, where it sits, who sees it and how long it is kept, shown on the first page of GHI's data map, with collections in Mumbai holding balances, payment plans and sensitive hardship and health notes. Covers classifying data, marking an item sensitive if any rule that applies to that client says so, and labelling it, with scripts and note templates that ask only for what the process needs. Then covers keeping the map alive: searching for hidden copies, updating it at every change, such as Mumbai covering a Manila queue, and recording deletion. Ends with the common mistake and a recap.

What you will be able to do

• Build a data map client by client: data, location, access and retention
• Classify data as sensitive when any applicable rule says so
• Find hidden copies such as exports and shared folders

Why it matters

You cannot protect data you have not found; an accurate map keeps your questionnaire answers true when an auditor checks.

Practice: Practice: Personal and sensitive data, mapped by client · 3 questions

Opens on GHI's IT service desk at ten at night, where a caller posing as a regional director abroad names real colleagues and gets a password reset while the real director is asleep in Manila. Explains six red flags of manipulation to coach agents on. Covers designing identity checks by process, with a verification matrix agreed with each client where the strength of the check follows the risk of the request, call-backs on known numbers, extra care with requests to register a new phone or sign-in app, and separate versions for chat and e-mail teams. Then covers training on hire and yearly, simulations, and the identity check as a critical QA item, with QA checking the check was done in full with open questions and no hints. Ends with the records: approved scripts and matrix, QA results, reset tickets and reported attempts, and a recap.

What you will be able to do

• Design a verification matrix that matches the check to the risk
• Coach agents on six red flags of social engineering
• Check identity verification as a critical item in QA

Why it matters

The process decides, not seniority; a matrix and call-backs stop impersonators from talking their way into accounts.

Practice: Practice: Identity verification and social engineering defence · 3 questions

Starts with the June 2025 Reuters report from Module 1 of an outsourcing employee with photos of her work screen on her personal phone, and why no system log records a photo taken of a screen. Explains the layers of a secure floor: perimeter, entry, client zones and the desk, with no personal devices near the data and settings confirmed by IT in writing. Covers the floor walk as the core control: unannounced, on every shift, logged and followed up fairly, using a walk checklist built from client rules, shown in a good walk record for the billing team on a night shift. Then covers visitors with escorts, zone access reviews and secure disposal. Ends with the evidence: walk logs, visitor logs with escort names, access reviews, disposal certificates and signed rules, and a recap.

What you will be able to do

• Apply layered physical controls from perimeter to desk
• Run unannounced floor walks and log the findings
• Keep visitor, disposal and zone access evidence

Why it matters

Only physical controls stop data copied by a phone camera; floor walks run every shift keep the floor ready every day.

Practice: Practice: The secure floor: desk, screens, phones, visitors · 3 questions

Opens with a control SOC auditors test closely: an agent on GHI's billing team resigned on a Friday, his account on the clinic group's billing system stayed open for three weeks, and the SOC 2 auditor reported it as an exception. Explains access that follows the job: role templates approved by the client, tickets naming the template, and no template, no access. Covers treating each move as a leave and a join, and same-day removal for staff who leave, triggered by the notice from HR. Then covers strong sign-in, with multi-factor authentication confirmed on day one, tightly limited privileged and shared accounts, and the access problem special to BPOs: accounts on systems the client controls, which GHI cannot see. Ends with real access reviews, checked line by line against today's role, actioned, dated and signed, and a recap.

What you will be able to do

• Grant access only through approved role templates
• Remove access the same day a person leaves
• Run an access review line by line against today's role

Why it matters

The last day of the job is the last day of access; leaver removals are among the first controls a SOC 2 auditor samples.

Practice: Practice: Access control: joiners, movers, leavers, reviews · 3 questions

Starts at the weekly recording check on GHI's retail refunds team, where QA finds three calls in one week with card numbers and security codes recorded, all from agents in their first month. Explains card data controls: no security code kept after authorisation, masked card numbers on screens, and every recorder checked weekly, including the forgotten screen recorder. Covers the shared duty with the client in a written responsibility matrix, with GHI's retailer matrix splitting telephony, recorders, desktops and agents from the payment page, and scope confirmed every year. Then covers bank, lender and insurer data: note templates with short reason codes, activity log reviews, audit rights and provider oversight duties met through the contract. Ends with the evidence, a recap and a practice exercise building on the card controls table.

What you will be able to do

• Apply card data controls for calls, screens and recordings
• Agree a responsibility matrix for card controls with the client
• Meet bank client duties for activity logs and audits

Why it matters

A weekly recording check turns a slip by new agents into a fixed cause instead of a card data breach.

Practice: Practice: Payment card and financial data · 3 questions

Opens on GHI's billing team for a US clinic group, where a team lead exports four thousand denied claims with patient names, dates of birth and codes into a spreadsheet on a laptop to clear a backlog. Explains the business associate agreement that sets GHI's duties: permitted uses, safeguards, reporting, and the same restrictions for subcontractors. Covers minimum necessary in practice: role tables approved by the clinic group that become access templates, standard protocols for routine disclosures, monthly access log reviews and the addressable safeguards such as security reminders and log-in monitoring. Shows a second example at a medical coding BPO in Bengaluru. Then covers notifying the clinic on time, identifying each person affected, well inside the sixty-day limit, with a good notice for a statement mailed to the wrong patient. Ends with a recap and a practice exercise.

What you will be able to do

• Explain a business associate's duties under the agreement
• Build a minimum necessary role table for a team
• Write a breach notice to the client within the deadlines

Why it matters

The backlog is not a reason to move PHI; working inside the client's system keeps patient data logged and protected.

Practice: Practice: Medical data · 3 questions

Starts at the UK bank's yearly audit of the collections line in Mumbai, where the oldest call in the recorder is three years old although the contract allows thirteen months, because nobody set the retention period. Explains the five stores where conversations end up: voice, screen, chat and e-mail, AI output and screenshots, each belonging in the data map. Covers the three controls that carry the weight: access by need, every playback logged with monthly log reviews and follow-up of unusual playbacks, and retention set per client with a deletion log. Then covers automatic masking of card-number patterns in chat transcripts, the common mistake of screenshots made with good intentions, and deleting on time, including backups and copies held by vendors, with the backup schedule from IT kept with the evidence. Ends with a recap.

What you will be able to do

• Map the five stores where conversation data ends up
• Set retention per client and keep a deletion log
• Review playback logs monthly and follow up unusual access

Why it matters

Data you deleted on time cannot be stolen; retention set per client turns old recordings from a risk into a record.

Practice: Practice: Call recordings, chats and screenshots · 3 questions

Opens with an agent's younger brother installing a game on the work laptop in the evening, bringing malware onto a device that reaches a client's systems the next morning. Explains running home working as a controlled programme: eligibility, client approval and a signed agreement. Covers the standard every home laptop at GHI carries: encryption, no administrator rights, VPN with multi-factor sign-in, no USB storage or printing and remote wipe, with personal phones allowed only to receive sign-in codes where the client agrees. Then covers the home workspace and keeping checking through spot checks and yearly re-confirmation, avoiding the common mistake of checking once and never again. Shows the first hour of the response to a lost device. Ends with a recap.

What you will be able to do

• Set eligibility and approval rules for home working
• Check that home laptops carry the required controls
• Respond to a lost device within the first hour

Why it matters

At home, the device is the floor; locked-down laptops and spot checks keep client data safe outside the office.

Practice: Practice: Home working and devices · 3 questions

Starts with GHI's quality team months after an AI scoring tool went live, where a team lead finds agents from one region scoring lower because the tool mishears their accents. Explains managing AI on a BPO floor with the ISO AI management system standard as the frame: an inventory of AI tools with owners and intended uses, under an approved AI policy. Covers assessing the impact on customers, agents and clients, shown in an extract from GHI's impact assessment for the QA scoring tool, including card digits in transcripts. Then covers shadow AI, recalling Samsung's May 2023 instruction to staff, clear rules for agents, client approvals, monthly checks of AI scores against human reviews, logs of concerns and AI incidents, and re-testing after every change. Ends with the common mistake of approving a tool once and never checking it again, and a recap.

What you will be able to do

• Build an AI inventory with owners and intended uses
• Assess the impact of an AI tool on customers, agents and clients
• Run monthly accuracy checks of AI output against human reviews

Why it matters

An AI tool is a control to be managed, not a judge to obey; monthly checks stop agents being coached for mistakes they never made.

Practice: Practice: Responsible AI and the AI management system · 3 questions

Opens on the UK bank's collections line late on a Friday night, when an agent e-mails a statement to the wrong address and reports it by chat to a team lead who reads it on Monday, missing the bank's twenty-four hour contract deadline. Explains how every incident moves through six stages, with triage within the hour, at any hour, and treating it as the more serious when in doubt. Covers the notification matrix that sets who tells whom, by when, for each client, inside the outer limits the laws set, and why initial notices under the GDPR and HIPAA should not wait for the full picture. Shows an extract from a good incident record for a home laptop stolen from a billing agent's car, and a ransomware case at a multi-client BPO in Johannesburg. Ends with a tabletop exercise and a recap.

What you will be able to do

• Run an incident through six stages with triage within the hour
• Build a notification matrix for each client's deadlines
• Write an incident record that times every stage

Why it matters

Notify on time with what you know and update as you learn; a rehearsed matrix keeps contract and legal deadlines.

Practice: Practice: Incidents and breach reporting · 3 questions

Starts with three account teams at a growing BPO answering three client questionnaires with three different access review frequencies, until a client's auditor asks which one is true. Explains the four kinds of rules behind the practices: laws, an industry standard, certifications and attestations, each with its own evidence, including India's Digital Personal Data Protection Act of 2023 for the Mumbai site and SOC reports of Type 1 or Type 2. Covers how heavily they overlap, so one well-run control often meets four rulebooks at once, with client contracts such as processor terms and business associate agreements. Then shows how to build one control set mapped to every requirement, owned and run on an evidence calendar of monthly and yearly tasks, with client add-ons on top. Ends with the common mistake of a system per client, and a recap.

What you will be able to do

• Map one control to several laws and standards at once
• Build an evidence calendar with owners and frequencies
• Add client-specific requirements on top of one control set

Why it matters

Map once, run once; one control set keeps every client's questionnaire answer consistent and saves audit effort.

Practice: Practice: One control set, many clients · 3 questions

Opens with GHI's last SOC 2 audit, where the auditor sampled leavers from the twelve-month period and nobody could show when access was removed for three of them, so an exception was reported to the UK bank. Explains how SOC 1 and SOC 2 Type 2 reports test controls across the whole period, unlike a Type 1 report at a point in time, so evidence must be made all year. Covers ISO certification audits and nonconformities, client questionnaires, and how GHI hosts the UK bank's yearly on-site audit, with banks expected to use their audit rights and read reports critically. Shows an extract from GHI's evidence index and the common mistake of the audit-week scramble. Ends with your road map: list controls and owners, run the evidence calendar and audit yourself first, a recap and the final exam.

What you will be able to do

• Explain the difference between SOC 2 Type 1 and Type 2 reports
• Keep an evidence index that answers auditors in minutes
• Build a road map of controls, owners and an evidence calendar

Why it matters

Make evidence as you work, not for the audit; a year of records is what keeps exceptions out of the report clients read.

Practice: Practice: Client audits and your road map · 3 questions