Every branch of a process must reach an end event
- Risk
- Moderate
- Evidence
- metadata
- Section
- Flow
- Fix shape
- entity · Process
Defence in depth — other controls still give coverage if this one fails.
Decidable from the instance’s own configuration.
Whether every path through a process actually finishes.
One task per non-compliant process.
Control Statement: Every path through a business process must terminate at an end event.
Description: A branch that stops without reaching an end event — including a decision gateway with no default path — leaves the process instance running when that path is taken. This control requires every path, including the one nobody expected to be taken, to finish.
Rationale: An unfinished branch does not fail; it hangs. The record sits mid-process, holding whatever state the process gave it, and no error appears anywhere. Where the incomplete path is the default branch of a gateway, the process works perfectly for every case anybody tested and hangs on the first case nobody did.
Audit Procedure:
- Enumerate the business processes and their diagram elements.
- Trace each path from every start element.
- Record every path that terminates at anything other than an end event.
- Record every decision gateway with no default branch.
Remediation:
- For each unfinished path, add the end event it should reach.
- Give every gateway a default branch, even where it should never be taken — especially then.
- Look for process instances already stuck on that path and complete or cancel them.
Default Value: Creatio permits a process to be published with unterminated branches, and with gateways that have no default path, and reports neither.
Cite this control as CIB-FLOW-001, Implementation Benchmark v0.1.0. Verified against
Creatio 8.x. Published by ctx10; not
affiliated with or endorsed by Creatio.