Auditing Workday business processes

I've previously talked about Business Process functionality in Workday.  Today a topic near and dear to my heart is auditing those business processes (BPs).

Most companies have auditing or corporate governance in place to minimize risk; in the HCM world areas that often require auditing are processes and procedures that relate to hiring, pay changes and terminations.  These are areas where fraud can occur, such as the hire/term of a 'ghost' employee, or pay increases that are not authorized.

How do you audit business processes in Workday?

 

Similar to how there are many routes into a city, there are a variety of ways to get this job done.  In our case, our Compliance department decided that these 4 Workday BPs should be audited quarterly:

-Hire
-Change Job
-Request Compensation Change
-Termination

Our Compliance department does not state 'how' you need to do a job, but instead they have requirements of what is necessary to prove at the end.  Their requirement from us is to 'show that no unauthorized changes occur on the business processes.'

How do we do this? 

We have a set of Work documents for each process; they include a variety of details about the process, such as the process description, the participants, requirements, regulatory reports required from the process (if any) and importantly for us here, the business process flow broken down by steps (both internal and external to the system).

Our locked down Word documents are the 'golden copy' and our Workday business processes should always mirror the same tasks, performed by the same roles, with the same conditional logic, etc.

So for each audit, it's a matter of using the Excel button in Workday to download each BP and then bringing our Word documentation steps into this Excel and manually going line by line to make sure that they match on 'who,' 'what' and 'how'.

Isn't there an easier way?

 

You'd think there should be, as WD always highlights the audit aspects of their system.  So I set out to find a way to do this task in a more efficient manner than I just described.  In addition, back in the early days of my career, as an auditor myself, it was always easier to pass a process which was locked down systematically and performed automatically, as opposed to one that someone had to remember to do and where eyes can sometimes miss a line or a step.

Here are some items that I looked into:

 

1. Use the 'Audit trail' feature 

One of the nice things about Workday is that it has a built-in audit trail automatically turned on.  So while you're on a page, such as the Hire BP, you can click through to "View Audit Trail" and see an audit trail for the object:

Does this solve my problem?

Unfortunately, no.  While it will cover the 'big things' like if a step or notification is added/deleted it does not show the changes if a step is edited, for example.

2. Use the 'View User or Task or Object Audit Trail' report  

This one looked promising, like it would allow you to audit all BPs for changes at once, rather than individually per process.  (We'd like to be able to edit more than the four I previously specified, but using the manual method did not justify the risk.)

Here's what this one looks like:

When you run it in a Sandbox environment it looks quite interesting showing new value, old value, the operator who made the change, date/time stamp, etc.

  
Does this solve my problem?

Unfortunately, no.  When I ran this one in Production for a one month time frame, I got the message:  "The number of transactions found in the specified time range exceeds the report limit of 50,000. Please narrow the time range and try again."  Looking on Workday's Customer Connection, it seems that others have the same experience.  It seems that something is not indexed correctly or there is some other issue that you're filtering through all transactional audited data rather than only the BP audit data.  Those could perhaps be workable if you're a smaller company or have less transactional data or are only auditing on a very narrow time frame, such as a week.

So now what?

I turned to the trusted Workday Community, with the hope that some brighter mind than me has come up with an awesome solution.  It seems that the question has been asked many times in the customer forums over the past few years so I sifted through the responses with high hopes.

There are some newer features and customers have presented some ideas.  I will not bore you with these in the meantime, but the above was meant to illustrate the types of steps that you need to do as a Workday customer to meet a basic business requirement when it's not delivered out of the box.

But I just want a basic report!

We are currently trundling through our rest of world (non US, Canada, Mexico) Workday implementation. We are in the second round of test loading data.

As a part of our data validation our Workday implementation partner is issuing reports to us from the test system. I am combining these reports with PeopleSoft reports in Access. Then our HR community is reviewing the data to ensure that it matches.

One of the items that we need to validate is 'HR Partner.' In PeopleSoft we have an HR partner assigned at the department level. We're bringing that over to Workday and assigning an HR partner to a supervisory org (along with other roles such as Absence partner).

I have a report from PeopleSoft, it includes two fields: Department ID and HR manager ID.

Trying to get the equivalent from Workday is like trying to get blood from a stone.

First our Workday implementation partner ran me a report that looked something like this:


Our Workday implementation partner seems to be staffed with consultants who have never worked in-house. Fair enough, a lot of consulting houses are like this, as they've never done operational support they have no concept of how things actually work once the software is turned on.

I know everyone likes to say how great Workday is, that you no longer need to know codes you can work off of description but try matching on names from two different systems. People get married, etc. it's just inefficient.

Also, how am I supposed to parse all of the gobbletygook in the box?

I clarified the request and asked specifically for 'Supervisory Org code' and 'HR Partner employee ID'. In return I received this response:

Due to the Worker, Sup Org, and security business objects in Workday, we’re limited from splitting out a single org’s assignments into multiple rows when an org has multiple assignments. We’re trying one last effort during India time tomorrow to see if we can get it to work, but it’s not looking promising.

I mentioned a while back when I took the reporting class, how Workday reporting is not intuitive, but these folks are experts, Workday certified consultants.

I'm not quite sure if the problem is consultant knowledge or the Workday system itself. If I ever get to the bottom of it I'll let you know. In the meantime we'll just go on a wing and a prayer than our HR Partner data is being converted successfully.