Recertification policies are policies that you add to audits to generate recertification review tasks for the access assignments given to people, roles, groups, and Query-Based collections. Person The person validity recertification is a method of determining whether or not the person is still required. Certain actions must be made if the persons are no longer required. In other words, a person validity recertification policy is used to certify the whether a person should exist or not. Possible decisions are: certify, disable and delete. We will create a person validity type recertification policy in this post and add a target to it.Pre-requisite for recertification policies, audit compilation and fulfilment of business requests.
For the recertification, a recertification policy is created, a recertification audit is created, the recertification policy is added to the audit, then the audit is compiled, which generates business requests that are sent for approval.
In the case of person validity recertification, the recertification engine bundles the recertification items into business requests as per the responsible partyassigned. For any item being recertified where its responsible party is null, it bundles them into one business request as per the fall-back assignee.
The possible decisions are generally set to certify, disable or delete. However, these decisions are configurable. This configuration is described under decision configuration at the end of this page.
Note: For the recertification to work in EmpowerID, certain prerequisites must exist.
Create a Person Validity Type Recertification Policy
Log in to the EmpowerID web application as an auditor or other person with the ability to configure audits.
On the navbar, expand Compliance and select Recertification.
On the Recertification page, select the Recertification Policies tab
Then click + icon to create a new Recertification Policy
The policy details page opens up.
Select policy type as ‘Person Validity.’ Enter any name, display name, and description.
Click on Save.
Add the target type “Business Role and Location” to the policy createdClick on the '+' icon at the bottom of the policy details page to add the target
The attestation policy target section opens up.
Under the type dropdown, select ‘Business Role and Location.’
Under the business role dropdown, please search for a business role and select it.
Under the location dropdown, please search for a location and select it.
Click on Save.
Add the target type “Group” to the policy createdClick on the '+' icon at the bottom of the policy details page to add the target
The attestation policy target section opens up.
Under the type dropdown, select ‘Group.’
Under the enter, a group name to search dropdown, search for a group, and select it.
Click on Save.
Add the target type “Location” to the policy createdClick on the '+' icon at the bottom of the policy details page to add the target
The attestation policy target section opens up.
Under the type dropdown, select ‘Location.’
Under the location dropdown, please search for a location and select it.
Click on Save.
Add the target type “Management Role” to the policy createdClick on the '+' icon at the bottom of the policy details page to add the target
The attestation policy target section opens up.
Under the type dropdown, select ‘Management Role.’
Under the enter a management role name dropdown, please search for a management role and select it.
Click on Save.
Add the target type “Management Role Definition” to the policy createdClick on the '+' icon at the bottom of the policy details page to add the target
The attestation policy target section opens up.
Under the type dropdown, select ‘Management Role Definition.’
Under the enter a management role definition name dropdown, please search for a management role definition and select it.
Click on Save.
Add the target type “Person” to the policy createdClick on the '+' icon at the bottom of the policy details page to add the target
The attestation policy target section opens up.
Under the type dropdown, select ‘Person.’
Under the enter a person name to search dropdown, please search for a person and select it.
Click on Save.
Add the target type “Set Group” to the policy createdClick on the '+' icon at the bottom of the policy details page to add the target
The attestation policy target section opens up.
Under the type dropdown, select ‘Set Group.’
Under the enter a query-based collection name to search dropdown, please search for a query and select it.
Click on Save.
The person validity recertification policy type with various target types is created as below.
Decision Configuration for Person Validity
The possible decisions for group validity recertification policy type are configurable. For configuring them we need to take the following steps.
Log in to the EmpowerID web application
On the navbar, expand IT Shop and select Approval Flow Policies.
On the Approval Flow Policies page, select the Item Type Actions tab.
Then search for Recertify Person Validity.
Click on the Recertify Person Validity and scroll down to select Decisions for Approval Flow Steps.
Click on the + icon to add more approval decision if needed.
As shown in the above screenshot, what happens when the approval decision is taken as
Certify - no fulfillment work flow is needed.
Delete - Person validity delete fulfillment work flow is started.
Disable - Person validity disable fulfillment work flow is started.You can also edit or change the workflows that should execute as per an approval decision. Just click on the edit icon on the above image.
To see how the business requests generated are grouped for approval, we need to open the approval step selected by right click and open in new window. Here the approval step is person manager step as shown in the image above. In this case it is bundled as per two rule types ( target person manager and target resource line manager) as shown in the image below. So based on what is configured in approval step the business requests generated will be routed to for approval.
Workflow used: When you edit the Item Type Actions named Recertify Person Validity, you would be able to see the fulfillment workflow. For this item the fulfillment workflow selected is Recertification Fulfillment as shown in the image below. For the fulfillment the selected workflow is run. This workflow assigned is configurable as well. You can delete it and select another workflow if needed.
We have created the person validity recertification policy and added target to it. the next step would be to creat an audit and add the person validity policy to it.
Next Steps
...