What We Forget When a Worker Leaves an Organization

Minimizing System Disruption When a Worker Leaves an Organization

When an employee or contingent worker leaves an organization, there are many offboarding activities that occur. An organization’s focus is generally removing the user’s security or system access, but what about downstream impacts to tasks and reports the user owns in Workday? Kognitiv sees this gap too often!

There should be a process in place to avoid business disruption and address reports, future scheduled processes, and business process step actions the user owns. Although not top of mind, these items could cause extreme impact, such as business users not receiving key reports or integrations no longer running, if not addressed.

The steps laid out below provide a framework for creating an Integration System User (ISU) that can own vacated processes. This user owns all reports, integrations, business process steps and general scheduled future processes.

1. Audit reports, integrations, scheduled future processes and BP steps for impacts.
2. Create an Integration System User.
3. Assign security to the ISU dependent on which domains the user needs to be able to run reports and processes.
4. Transfer report ownership and scheduled future process ownership to the new ISU.
5. Update the Run as User prompt within all Business Processes to be the ISU.

Consider the following tips and tricks when implementing this process:

• Remember to check the Do Not Allow UI Sessions box for the ISU once all steps have been completed.
• If the newly created ISU does not show as an option when transferring, there is a discrepancy in the security for the report/process and the ISU’s security.
• The “Share” tab for any process will be wiped when the process is transferred. Download or screenshot the sharing permissions prior to transferring the task to the newly created ISU.
• If report groups need to be transferred to the ISU, individual report prompts and filters may also need to be updated.
• Don’t forget to give the ISU domain access to Notification Alerts and Scheduled Report Processes.
• Since the ISU is not a “real person” in Workday, you will not be notified when a scheduled process is either the final or penultimate run. An audit process for these scenarios will need to be considered on a consistent frequency.
• Decide on approach and frequency for password rotation on ISU account.

In summary, this approach will streamline your organization’s offboarding strategy for Workday administrators. By transferring ownership of key processes to a dedicated ISU, your organization can have peace of mind that risks are mitigated, and disruption is minimized when a worker leaves.

Integration System User (ISU) Creation

One common way to address these ownership issues is through a dedicated Integration System User (ISU). The steps in creating this ISU are:

1. Create ISU
– Create Integration System User

2. Create Security Group
– Create Integration System Security Group (Unconstrained)
– Assign ISU created in step 1 to the security group

3. Assign Security
– Use related action off the security group to access Maintain Domain Permissions for Security Group
– Requires audit of Worker/Report security in Workday
– At a minimum, the ISU will need Custom Report Creation domain access. Depending on the security of the owner(s) this may grow to the majority of the domains in Workday.

Report Clean Up

Process:

– Run Task Transfer Ownership of Custom Reports
– Report Names > My Reports > Select All
– New Owner > (Best Practice Selection)
– Use Report “All Custom Reports – CF” with prompt updated to user account we are auditing
– Report output should be empty

Considerations:

– If the newly created ISU does not show as an option when transferring, there is a discrepancy in the security for the reports and the security the ISU has
– If report is not shared, the ISU will be the only one with the ability to access

Scheduled Future Process Clean Up

Process:

– Run Custom Report “Scheduled Future Processes – CF”
– Update prompt for “Owned by User”
– Leave other prompts blank (if you want to filter by type for analysis, you can update the “Process Type” prompt as needed)
– Filter by “Owned by User” column
– For Alert Notification & Job types
    – From the Scheduled Process > Schedule Future Process > Transfer Ownership
– For Report type
    – If not addressed by Report Clean Up Section, from the Process > Custom Report > Transfer Ownership

Considerations:

– This round of activities will need to be completed while logged into the ISU account
– The “Share” tab for any process will be wiped when the process is transferred. Please remember to download or screenshot the sharing permissions prior to transferring the task to the newly created ISU.
– If there are report groups that need to be transferred, this will require the group to be transferred to the newly created ISU, report prompts updated and for new report filters to be created, saved, and updated as a part of the Report Configuration.
– The newly created ISU may need View and Modify access for:
    – Notification Alerts
    – Scheduled Report Processes
Once these tasks are completed:
    – Edit the ISU Workday account to have the Do Not Allow UI Sessions box checked.

Business Process Steps Clean Up

Process:

– Run Custom Report “CF – BPs”
– Update prompt for “Run As User”
– Click on “Workflow Step” for each row
– Click “Configure Generate Document Step”
– Update “Run as User” to new user account

Considerations:

– If the newly created ISU does not show as an option when transferring, there is a discrepancy in the security for the reports and the security the ISU has
– This is an area that can be tested in an implementation tenant or Sandbox to ensure there is not disruption to the business process flow

This approach is recommended because it mitigates the impact when a worker in the organization exits. By transferring ownership of processes to a dedicated ISU, there is a standardized process in place for minimizing disruption when a worker leaves.

Now that you have done this, think about using this same approach with other reports/process NOW, before people leave, thus making your tenant cleaner and less maintenance heavy moving forward. Be proactive in transferring ownership of any reports you create that are going to end up in Production, as well as scheduled processes. If you stay disciplined here, it will save you a ton of time and headaches moving forward.

Interested in learning more? Email us at info@kognitivinc.com to learn how Kognitiv can aid in optimizing your Workday strategy.

Blog Post Summary:
When an employee or contingent worker leaves an organization, there are many offboarding activities that take place. The main focuses may be on security or system access, but what about specific tasks or reports they own in Workday?