Appearance
Workflow Templates
Where to find it: Administration, then Workflow Settings (/settings/workflow).
A workflow template defines the stages a governed object passes through, who acts at each, what transitions are available, and where segregation of duties applies.
Anatomy of a template
| Element | Purpose |
|---|---|
| Key | The template identifier |
| Name | A human-readable description of the chain |
| Object type | What kind of record it governs |
| Stages | The ordered steps |
Each stage carries:
| Element | Purpose |
|---|---|
| Key and label | Identity and display |
| Assignee | A fixed role, or a resolver |
| Bucket hint | Which Workbench bucket the stage projects into: work, review or terminal |
| Transitions | The actions available and where each leads |
| SoD flag | Whether segregation of duties applies at this stage |
Assignee resolution
| Type | Behaviour |
|---|---|
| Role | Routes to whoever holds the named tenant RBAC role key |
Resolver: owner | Routes to the record's owner |
Resolver: owner_department_head | Routes to the owner's department head |
Role keys are strings your administrator controls
The workflow engine has no notion of what compliance_manager means. It routes to whoever holds that role key.
Renaming or remapping a role in your tenant changes who receives the stage, without any change to the template.
System templates
OrviQ seeds a set of system templates covering every governed object. They are tenant-editable.
| Object type | Templates |
|---|---|
| Requirement | Work to Close; Work, Review, Close; Work, Department Review, Compliance Review, Close; Work, Department Review, Compliance Review, Management Approval, Close |
| Finding | Work, Risk Review, Compliance Review, Close |
| Policy | Draft, Compliance Review, Published (four-eye); Draft, Compliance Review, Executive Sign-off, Published (six-eye) |
| Exception | Draft, Review and Approval (four-eye); Draft, Risk Review, Senior Management Approval (six-eye) |
| Risk acceptance | Request, Risk and Compliance Review, with escalation to Senior Management or CCO |
| Applicability | Draft, Independent Compliance Review, with escalation (four-eye); Draft, Compliance Review, Executive Sign-off (six-eye) |
| Mapping | Draft and Propose, Independent Mapping Review |
| Audit plan | Draft, Audit Review and Approval |
| Audit engagement | Fieldwork, Independent Audit Review, with escalation to Executive or CAE Sign-off |
| Regulatory inspection | Draft Response, Independent Compliance or Legal Review, with escalation to Executive or Committee |
| BIA | Draft, Risk and Continuity Review, with escalation to Business or Committee Approval |
| Continuity plan | Draft, Continuity Review, with escalation to Executive Approval |
| Resilience exercise | Conduct, Independent Review and Sign-off, with escalation |
| Resilience assessment | Assess, Resilience Review and Sign-off |
| Incident | Investigation and Remediation, Independent Review and Closure Sign-off, with escalation |
| Third-party engagement | Prepare, Risk Review, with four decision outcomes |
Bindings
A binding selects which template governs which object type, optionally by routing tier.
| Object type | Tier | Template |
|---|---|---|
requirement | * | Full four-stage chain with management sign-off |
requirement | tier_3 | Lighter Work, Review, Close chain |
policy | * | Four-eye publication |
exception | * | Four-eye approval |
A tier binding does not force or skip stages mid-run
Bindings select the template at the point a workflow run starts. Changing a binding does not reshape a run already in progress.
This is deliberate: a decision part-way through a three-stage chain should not silently lose a stage because configuration changed.
Editing a template
Templates are tenant-editable. Before changing one:
- Understand what is in flight. Existing runs continue on the template they started with.
- Check role coverage. A stage bound to a role nobody holds routes nowhere.
- Check segregation actually holds. A chain where one person holds two consecutive stage roles has fewer eyes than it appears to.
- Record why. Approval chain changes are the kind of thing an auditor asks about.
Requires workflow.configure.
Terminal stages
A stage with a terminal bucket hint concludes the run. Reaching a terminal stage is what triggers the domain module to update its authoritative business state.
Intermediate approvals in a multi-stage chain advance the stage; they do not publish a policy, approve an exception or close an incident.
Permissions
| Action | Permission |
|---|---|
| Define workflow steps and stages | workflow.configure |
| Assign step responsibility | workflow.assign |
| Approve transitions | workflow.approve |
| Administrative override | workflow.override |
workflow.configure is an administrative permission.
Example
A bank tightening its exception chain.
Before: all exceptions used the four-eye exception_review_approve template — draft, then review and approval by the Compliance Manager.
Trigger: an internal audit observation that exceptions on critical systems were being approved at the same level as routine ones.
After: a second binding was added so that exceptions on critical systems use the six-eye exception_review_mgmt_approve template — draft, then risk review, then executive or CCO approval.
Effects observed over the following quarter:
| Metric | Four-eye | Six-eye |
|---|---|---|
| Exceptions processed | 41 | 9 |
| Median time to decision | 4 days | 11 days |
| First-time approval rate | 88% | 56% |
The six-eye chain is slower and rejects more, which is the intended trade-off for the nine decisions that carry the most consequence. Applying it to all fifty would have added a week to every routine exception and produced pressure to avoid the process.
In-flight runs: the seven exceptions already in the four-eye chain when the binding changed completed on that chain. None silently gained or lost a stage.
Troubleshooting
"A stage routes to nobody." Its role binding names a role no user holds. Check role assignments.
"Changing a binding did not affect an in-flight approval." Correct. Runs complete on the template they started with.
"The chain has fewer people than stages." One person holds multiple stage roles. See Segregation of Duties.
"An approval did not update the business state." It was not the terminal stage.