Description

This example shows how to identify violations of a segregation of duties policy with PQL.

Segregation of duties enforces that within one case certain activities are not executed by the same department. For example there could be the policy that an approval can not be granted by the same department that requests the approval.

To analyze if the duties are separated, we assign labels to each case:

• Segregation of duties fulfilled: Selected activities were performed by different departments, e.g. Approval Requested (Department 1) → Approval Granted (Department 2)
• Segregation of duties violated: The same department performed the selected activities, e.g. Approval Requested (Department 1) → Approval Granted (Department 1)

Challenge

Identify cases in which the segregation of duties is violated for the activity pair 'Approval Requested' and 'Approval Granted'. One can assume that an 'Approval Granted' activity or the case end will eventually follow after an 'Approval Requested' activity. In between, any kind of activity can happen.

Solution

Step-by-Step Solution

Now let's take a closer look on the operators REMAP_VALUES and SOURCE/TARGET which are used in the solution.

This way we can do calculations and comparisons between consecutive activities. But to solve the problem it is not enough to compare directly consecutive activities. We are only interested in the activities 'Approval Requested' and 'Approval Granted'.

Based on the result above it is easy to build a FILTER which identifies rows in which the SOURCE(department) equals TARGET(department). Results of the SOURCE/TARGET operator are joined to the case table, which itself is joined to the activity table. In the solution below Celonis propagates the filter to the activity table.

To just obtain the violating case-IDs, the above filter expression can be applied to the case column of the case table as shown in the 'Solution' section above.