<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<TITLE>Excluded Agents</TITLE>
<META content="MSHTML 6.00.2462.0" name=GENERATOR></HEAD>
<BODY>
<DIV><SPAN class=412562911-27072001><FONT face=Arial color=#0000ff size=2>Dear
Jocelyn,</FONT></SPAN></DIV>
<DIV><SPAN class=412562911-27072001><FONT face=Arial color=#0000ff
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=412562911-27072001><FONT face=Arial color=#0000ff size=2>We
have accounted for release of payment by placing a payment block until the work
item has been approved by proper persons. In some cases, only one person
has the authority to approve an invoice. So, the use of the excluded
agents is not really geared towards security. Fraud is not a concern
because all approvals are based on a Financial Authority Table that
includes levels (attesters, approvers) and amounts control mechanism.
</FONT></SPAN></DIV>
<DIV><SPAN class=412562911-27072001><FONT face=Arial color=#0000ff
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=412562911-27072001><FONT face=Arial color=#0000ff size=2>As for
your suggestions, this is how I look at it:</FONT></SPAN></DIV>
<DIV><SPAN class=412562911-27072001><FONT face=Arial color=#0000ff size=2>-
Substitution should stay. It is supported in the system and we have
more than one workflow in the company.</FONT></SPAN></DIV>
<DIV><SPAN class=412562911-27072001><FONT face=Arial color=#0000ff size=2>-
Substitution of a person outside the approval path (evaluation path) might not
be a good idea because of the local expertise/relevance in each approval
path.</FONT></SPAN></DIV>
<DIV><SPAN class=412562911-27072001><FONT face=Arial color=#0000ff size=2>- The
workaround you mentioned by calculating first and second approving persons is
similar to what we do know on a monitoring basis. </FONT></SPAN></DIV>
<DIV><SPAN class=412562911-27072001><FONT face=Arial color=#0000ff size=2>-
Auto-approve for same persons might be an idea. I need to discuss it with
Business.</FONT></SPAN></DIV>
<DIV><SPAN class=412562911-27072001><FONT face=Arial color=#0000ff
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=412562911-27072001><FONT face=Arial color=#0000ff size=2>I was
thinking of completely removing the excluded agents option from the workflow
container. I am not exactly sure about the impact of this on. I did
simple testing and things look OK with the removal. However, I wanted to
hear what others might say; especially those who probably have seen something
like this.</FONT></SPAN></DIV>
<DIV><SPAN class=412562911-27072001><FONT face=Arial color=#0000ff
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=412562911-27072001><FONT face=Arial color=#0000ff size=2>Thanks
for your reply.</FONT></SPAN></DIV>
<DIV><SPAN class=412562911-27072001><FONT face=Arial color=#0000ff
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=412562911-27072001><FONT face=Arial color=#0000ff
size=2>Abdulla Musaid</FONT></SPAN></DIV>
<DIV><SPAN class=412562911-27072001><EM><FONT face=Arial color=#0000ff
size=2>Systems Analyst SAP FI/CO</FONT></EM></SPAN></DIV>
<BLOCKQUOTE dir=ltr style="MARGIN-RIGHT: 0px">
<DIV class=OutlookMessageHeader dir=ltr align=left><FONT face=Tahoma
size=2>-----Original Message-----<BR><B>From:</B> Dart, Jocelyn
[mailto:jocelyn.dart@sap.com]<BR><B>Sent:</B> Friday, July 27, 2001 3:31
AM<BR><B>To:</B> SAP-WUG@MITVMA.MIT.EDU<BR><B>Subject:</B> Re: Excluded
Agents<BR><BR></FONT></DIV>
<DIV><FONT face=Arial color=#0000ff size=2><SPAN class=822232700-27072001>Hi
Abdulla, </SPAN></FONT></DIV>
<DIV><FONT face=Arial color=#0000ff size=2><SPAN class=822232700-27072001>Ok
you have a real live segregation of duties issue, which you need to
discuss with the business. </SPAN></FONT></DIV>
<DIV><FONT face=Arial color=#0000ff size=2><SPAN class=822232700-27072001>The
workflow is set up to ensure (via the excluded agent) that at least 2
DIFFERENT people approve</SPAN></FONT></DIV>
<DIV><FONT face=Arial color=#0000ff size=2><SPAN class=822232700-27072001>the
release. </SPAN></FONT></DIV>
<DIV><FONT face=Arial color=#0000ff size=2><SPAN
class=822232700-27072001></SPAN></FONT> </DIV>
<DIV><FONT face=Arial color=#0000ff size=2><SPAN class=822232700-27072001>My
guess would be that this doesn't change for your business just because someone
has been substituted - you </SPAN></FONT></DIV>
<DIV><FONT face=Arial color=#0000ff size=2><SPAN
class=822232700-27072001>probably still want 2 different people to approve the
release otherwise when Person B is on vacation, Person A</SPAN></FONT></DIV>
<DIV><FONT face=Arial color=#0000ff size=2><SPAN class=822232700-27072001>can
effectively release anything on his/her own - leaving the business exposed to
deliberate or accidental fraud. </SPAN></FONT></DIV>
<DIV><FONT face=Arial color=#0000ff size=2><SPAN
class=822232700-27072001></SPAN></FONT> </DIV>
<DIV><FONT face=Arial color=#0000ff size=2><SPAN class=822232700-27072001>If
you want to handle this in your workflow you could:</SPAN></FONT></DIV>
<DIV><FONT face=Arial color=#0000ff size=2><SPAN
class=822232700-27072001></SPAN></FONT> </DIV>
<DIV><FONT face=Arial color=#0000ff size=2><SPAN class=822232700-27072001>*
Adjust your substitutions so this doesn't happen - e.g. delegate to another
mananger at the same level rather</SPAN></FONT></DIV>
<DIV><FONT face=Arial color=#0000ff size=2><SPAN class=822232700-27072001>than
to subordinates.</SPAN></FONT></DIV>
<DIV><FONT face=Arial color=#0000ff size=2><SPAN
class=822232700-27072001></SPAN></FONT> </DIV>
<DIV><FONT face=Arial color=#0000ff size=2><SPAN class=822232700-27072001>*
Calculate the second approver in a step prior to the second approval workitem
and if the</SPAN></FONT></DIV>
<DIV><FONT face=Arial color=#0000ff size=2><SPAN
class=822232700-27072001>first and second approvers are the same, either send
a workitem to an administrator or business process owner</SPAN></FONT></DIV>
<DIV><FONT face=Arial color=#0000ff size=2><SPAN class=822232700-27072001>who
can dynamically </SPAN></FONT><FONT face=Arial color=#0000ff size=2><SPAN
class=822232700-27072001>pick an alternative agent, </SPAN></FONT></DIV>
<DIV><FONT face=Arial color=#0000ff size=2><SPAN
class=822232700-27072001></SPAN></FONT> </DIV>
<DIV><FONT face=Arial color=#0000ff size=2><SPAN class=822232700-27072001>or
send the second approval workitem itself to the </SPAN></FONT><FONT face=Arial
color=#0000ff size=2><SPAN class=822232700-27072001>administrator/business
process owner who can execute the workitem on someone's behalf.
</SPAN></FONT></DIV>
<DIV> </DIV>
<DIV><FONT face=Arial color=#0000ff size=2><SPAN class=822232700-27072001>If
you don't care about segregation of duties in this case you could auto-approve
the second approval step but</SPAN></FONT></DIV>
<DIV><FONT face=Arial color=#0000ff size=2><SPAN class=822232700-27072001>I
wouldn't recommend that. </SPAN></FONT></DIV>
<DIV><FONT face=Arial color=#0000ff size=2><SPAN
class=822232700-27072001>Regards,</SPAN></FONT></DIV>
<DIV><FONT face=Arial color=#0000ff size=2><SPAN class=822232700-27072001>
<DIV style="WIDTH: 374px; HEIGHT: 90px"><FONT size=2>
<TABLE>
<TBODY>
<TR>
<TD></TD></FONT>
<TD>
<DIV><FONT size=2><FONT color=#0000ff>Jocelyn Dart</FONT> <BR><FONT
color=#0000ff>Consultant (EBP, BBP, Ecommerce, Internet Transaction
Server, Workflow)</FONT> <BR><FONT color=#0000ff>SAP
Australia</FONT></FONT></DIV>
<DIV><FONT color=#0000ff><FONT size=2>Email </FONT><A
href="mailto:jocelyn.dart@sap.com"><FONT
size=2>jocelyn.dart@sap.com</FONT></A><BR><FONT size=2>Tel: +61<SPAN
class=153385400-09052000> 412 390 267</SPAN><BR>Fax: +61 2 9935
4880</FONT></FONT></DIV></TD></TR></TBODY></TABLE></DIV></SPAN></FONT></DIV>
<DIV> </DIV>
<BLOCKQUOTE>
<DIV class=OutlookMessageHeader dir=ltr align=left><FONT face=Tahoma
size=2>-----Original Message-----<BR><B>From:</B> Abdullah Musaid
[mailto:AMusaid@qatargas.com.qa]<BR><B>Sent:</B> Thursday, 26 July 2001
10:06 PM<BR><B>To:</B> SAP-WUG@MITVMA.MIT.EDU<BR><B>Subject:</B> Excluded
Agents<BR><BR></DIV></FONT>
<P><FONT face=Arial size=2>Hi Folks,</FONT> </P>
<P><FONT face=Arial size=2>We have a Release for Payment WF running in the
company. The Release for Payment task "407862" is used with
Activity_EXCLUDED_AGENTS configured to receive agents from Reference table
"WFSYST" & Reference field "ACT_AGENT" in the ABAP Dictionary. The
evaluation path (also called approval path) consists of a multi-level WF
procedure with different people at different positions/levels.
</FONT></P>
<P><FONT face=Arial size=2>The problem occurs when someone at a lower level
approval an invoice. This person (say "Person A") is also acting
(substituted) for another person ("Person B") where "Person B" is on the
same approval path, but at a higher level. After "Person A" completes
the approval. The WF takes the item to the upper level for
approval. But, because that "Person B" is on vacation and had
substituted "Person A"; the WF will try to take the work items back to
"Person A" for approval. This is where the work item gets stuck
because "Person A" is an excluded agent by the definition of the Release for
Payment task "407862". </FONT></P>
<P><FONT face=Arial size=2>The problem also occurs when "Person A"
substitutes "Person B". The WF system knows who completed the work
item and will remember not to send it to that person again.</FONT></P>
<P><FONT face=Arial size=2>Running transaction "SWI1", the work item will
appear with status "Ready" and "blank" value for the Actual Agent
field. This is where we manually end and approve the invoice using
special authorization by a Basis person. </FONT></P>
<P><FONT face=Arial size=2>Well, I need to you what you think is a good
solution for this problem.</FONT> </P>
<P><FONT face=Arial size=2>Regards,</FONT> </P>
<P><B><FONT face=Arial size=2>Abdulla Musaid</FONT></B> <BR><I><FONT
face=Arial size=2>Systems Analyst SAP FI/CO</FONT></I>
</P><BR></BLOCKQUOTE></BLOCKQUOTE></BODY></HTML>