Out of Office delegation

To better comply with SOX requirements, activities and approvals cannot be routed back to the process originator through Out of Office delegations.

SOX states that a submitter of a request should never be able to approve their own request. It can occur that one person submits a form, and the normal approver of that form has set an out of office delegation which designates the approval task back to the person who submitted the form (the "originator").

Example: Jake is team lead for a sales group and his manager Marisa normally approves time-off requests. Marisa is out on vacation and has set her Out of Office to Jake so that he may approve requests while she is away. During the time period that Marisa is out on vacation, Jake could set a time-off request for himself and approve it.

With this change, when a delegated activity or approval is going to be reassigned to the delegated person, Winshuttle checks to see if the originator of the form (the submitter) is also the target (the person to whom the activity or approval has been delegated). If the originator of the form is the target, Winshuttle will require the process adminstrator to reassign the task to another user. The originator is not allowed to complete or approve the task.

Out of Office delegations allow a task assignee or approver to automatically re-route incoming tasks to another employee. A normal form user may select out of office delegations for themselves only; the form user is presented with an option to select another person to receive their tasks and approvals.

Users with the Central Application Administrator role may manage delegations for other users.

A delegation applies to all forms sites in the SharePoint web application. If rules are applied, the delegation will be constrained to those forms sites where the rule criteria are met.

Creating a delegation

1. On a forms site, in the Winshuttle Workflow web part, click the Processes tab, if visible.

2. Click the Out of Office link.

a. Any existing delegations for yourself will be shown here.

3. Click Add.

4. Select another user to delegate tasks to. This person must have the same access to the forms site and the same ability to interact with the form as you do (they may, for example, have the same type of license that you have).

5. Select a start date and an end date. Start dates begin at 00:00:00 on that date. End dates end at 11:59:59 on that date.

6. Create a rule for advanced routing.

7. Click Add.

Rules for advanced routing

Using the Add Rules option, you can create multiple delegations that route to different users. For example, by selecting all solutions where the name begins with “Material Creation,” all material creations can be routed to a master data analyst. Or, by setting a rule where the solution name contains “plastics,” all plastics-related solution tasks can be delegated to a master data analyst specializing in plastics.

Note: Extended Attributes is a legacy option not used by Composer solutions.

When multiple entries are present, the workflow engine evaluates the rules from the top down, meaning lower rules take precedence over conflicting rules which occur higher up.

If you use multiple entries, tasks not matching a rule will not be delegated. This means you need to add a general delegation with no rules to catch all other tasks.

Originator check enabled

The workflow configuration key OriginatorApprovalCheck, can be set to “True,” which enables additional SOX compliance functionality impacting out of office delegations.

If the OriginatorApprovalCheck key is enabled, an originator will not be able to take actions on tasks submitted by himself (even through out of office delegation). If the originator receives such a task, it will have to be re-assigned by the process administrator.

Forms

For any task or approval re-routed through out of office delegations back to the originator:

• The ability to save changes will be disabled.

• Email approvals will fail and will generate a message that reads: “This action is restricted as you are the originator of the request.” The message will include a reference to the task. The workflow key, EmailApprovalReceipt, will need to be set to True to see this message; otherwise, the approval will simply not go through until reassigned and the task is opened in the browser.

• Bulk approvals will be denied.

• If attempting to reassign to the originator using a process control or Workflow Participant element, a warning will indicate that the reassignment is not allowed.

Approval properties

Auto approvals will not be completed, and a process administrator must intervene to move the workflow along.

Administrative delegation management

For users with the Central Application Administrator’s role in Foundation, overall delegation management is available through the Out of Office Delegations page in Foundation settings.

From this page, all existing delegations are shown.

Access to this page grants the ability to create delegations on the behalf of another user (used, for example, when an employee leaves for vacation and forgets to set a delegation), delete delegations, modify existing delegations, and re-order delegations.