There is a problem with the workflow in MOSS. For some reason Microsoft decided that they need to purge the workflow associations after they are 60 days old. This means that when you looks at the workflow history for an item you will not see workflow history older than 60 days. The information about the workflow is still in the tasks and workflow history lists, but the association between the workflow and the item has been purged from the database. I know of some people who have already contacted Microsoft about this problem and created support cases for it. The answer they keep getting is that it is by design for performance reasons. What about auditing reasons Microsoft, don't you think this will be a huge issue for enterprise clients?
My question is how many clients out there are using this for important business processes thinking their audits will be covered? If you are a Microsoft support customer and are using workflow for important business process that will be audited. PLEASE CALL THEM AND COMPLAIN!!! The only way it seems that Microsoft will move on this is if they get a large enough response from the community. Obviously a couple large enterprise companies (50,000+ employees) aren't enough to concern them.
Below are some details of the issue and some correspondence with Microsoft support...
- Document losing their “approval workflow details” after 60 days.
- Workflow details still on site, but no longer associated to respective documents.
- Issue identified by Microsoft and not listed as a bug as originally told – this expiration of 60 days is something that was done purposely - “by-design”.
- MS provided code that will allow us to extend the document/workflow history relationship past 60 days. (code needs to run everyday to change new associations)
- Testing has not been done by Microsoft for the provided solution.
Here is a list of findings and concerns on this situation:
- FINDING - A table that contains associations between workflow details and documents contain this expiration date of 60 days.
- FINDING - This field can be changed, on a site basis, to a maximum of 9999 days – 27 years or so… at least according to Microsoft (untested as of yet).
- PROBLEM – If code works successfully, it will have to be ran constantly. This must be done as new workflows are completed on documents or risk losing the associations after 60 days.
- PROBLEM – This impacts all sites in a content database as they will all use this association table. I foresee a problem with maintaining separate expiration times for different sites. This will now become the responsibility of the operations group to maintain, based the respective customer. If it doesn’t retain this permanently or semi-permanently, then this should be a setting that is configurable at a site or library level, providing the customer the ability to set the expiration period.
- CONCERN – From audit perspective, Sarbanes or other, this is totally unacceptable. NO WARNING to indicate that critical detailed information will be disassociated with its counterpart document after 60 days. Unwary users could be audited 12 months after a document went thru a workflow approval and be none the wiser that their document actually was approved and their workflow history was “cleaned” 10 months earlier…
- CONCERN – One of the biggest selling points for MOSS was the ability to have enhanced workflow on your documents. Almost any company is going to be negatively impacted by this “feature”. Not only financial or healthcare companies, but any financial department within a company is going to be impacted if they use this feature in MOSS. I can’t question the DOD5015 compliance as I do not know if proof of approval history is a requirement. If it is, it certainly is not DOD5015 compliant.