Process controls
Process controls
A process control says what records of a kind must have before they are resolved. Under Settings → Process controls, New control opens the control's page, in three steps:
| Part | What you set |
|---|---|
| The control | A name, an optional reference from your control framework (CC6.2, A.5.18) and what the control is for. |
| 1. Applies to | Cases or incidents (with Incident Management), and the conditions a record must meet. |
| 2. Requirement | What it must have, with exactly the inputs that requirement needs. |
| 3. Mode | Enforced or checked. |
On the right, In plain words reads the control back as one sentence while you write it, for example “Every case in Payroll whose priority is High or Urgent needs an approval by someone with Service Manager before it is resolved, enforced: the desk won't resolve it until then.”
Preview counts the records of the last 90 days (the latest 300) the control applies to and how many of them meet it now, with some that don't and why. Open records can still meet it before they are resolved. Anything still missing is listed by name (“Condition 2 (Priority is): pick at least one value”) before the control can be saved.
Which records: the conditions
Add condition adds a row: the field, the comparison and the values. A record must meet every condition. With no conditions the control applies to every record of its kind in the organization.
Values are picked, never typed in a list:
- short lists are checkboxes;
- units are added one by one;
- forms, teams, accounts and services are searched;
- labels and words are typed and added with Enter.
Each value shows as a chip with × to remove it. Several values in one row mean any of them (is, is in, include, contains any of) or none of them (is not, is not in, don't include).
| On | Conditions |
|---|---|
| Cases | Unit (and the units below), channel, form, priority (also “is at least”), team queue, labels, requester email and language, account and account labels, subject, subject or message, a form field, a case, requester or account data property, and the plugins' conditions on cases, such as the service with Service Configuration |
| Incidents | Unit (and the units below), priority (also “is at least”: at least P2 is P1 or P2), category, an incident data property |
Cases are checked with the same conditions, and the same evaluation, as automations.
[!NOTE] Status, assignee and time conditions aren't offered: they change while the case is worked, and a control must apply the same way when the case is opened and when it is resolved.
Controls made before the conditions existed (lists of units, forms, priorities and labels) keep working; editing one shows its lists as conditions and saves it that way, as a new version.
What the requirement checks
| Requirement | What you set | Met when | For |
|---|---|---|---|
| The customer's approval | Nothing | The requester approved on their case page, with a code, and the request wasn't changed afterwards (see approvals). | Cases |
| An approval by someone else | Who may approve: anyone with Approve cases, or only holders of a role you pick | Someone other than whoever resolves it as its assignee approved it, and, with a role, holds that role for the case's unit or a unit above, or everywhere, directly or through a team. Only roles with Approve cases are offered. | Cases |
| A second person | Nothing | Someone other than whoever resolves it worked on it: a reply, a note or an approval. | Cases, incidents |
| A data property filled in | The data property, and what it must be: filled in, is, is not, contains, more or less than a value | The record's data property matches, for example Risk assessment is “Done”. | Cases, incidents |
| A time limit met | Cases: the service level's resolution target, or a number of hours from being logged | It was resolved in time. Cases without a resolution target pass the first; the hours are calendar hours. Incidents use their resolve target. | Cases, incidents |
| A review written | Nothing | The post-incident review is written. | Incidents |
When a requirement isn't met, the record says what was missing in words: “Risk assessment is “Pending”; it must be “Done””, “Approved by Per, who doesn't hold Service Manager”, “Not resolved within 4 hours of being logged”.
Enforced or checked
Control applies → Resolve or close → Result recorded on the record → In the evidence
Resolve or close → Refused: an enforced control isn't met yet
Result recorded on the record → Exception: a checked control wasn't met
- Enforced (a preventive control): the desk refuses to resolve or close the record until the requirement is met, and says which control stops it. For incidents both resolving and closing are checked.
- Checked (a detective control): resolving goes ahead. The desk records whether the requirement was met, and a miss becomes an exception.
An example: cases in the unit Payroll that came in through the form Access change need the customer's approval before they are resolved. Make a control on cases with:
- two conditions, Unit is in Payroll and Form is Access change;
- the requirement The customer's approval;
- the mode Enforced.
An agent who tries to resolve such a case without the approval is told “The control “Access change approval” isn't met: Needs the customer's approval”.
What is kept
- On each record. When a record is resolved (and again when it is closed), every control that applies is recorded on it, met or not, with the proof: who approved and when, the fingerprint of what they approved, who else worked on it, the data property's value, the role the approver held, or the time limit.
- On each control. Every change to a control is a new version in its history (the clock button on its row): created, changed, switched off and on again, with who did it, when and what the control was then, read back as a sentence. The auditor can see that a control was on, and unchanged, for the whole period.
The list of controls shows each one's conditions and how often it was met and not met.
Exceptions
Settings → Exceptions lists every record where a checked control wasn't met in a period (the last year by default), with the control, the record, what was missing and when. Explain… records why, and who explained it (“Weekend on-call: one person by design, reviewed on Monday”), so each deviation is answered before the auditor asks. Download it as Excel, CSV or PDF.
[!TIP] An empty list for the period is evidence too.