CIB-FLOW-001

Every branch of a process must reach an end event

Risk
Moderate

Defence in depth — other controls still give coverage if this one fails.

Evidence
metadata

Decidable from the instance’s own configuration.

Section
Flow

Whether every path through a process actually finishes.

Fix shape
entity · Process

One task per non-compliant process.

Control Statement: Every path through a business process must terminate at an end event.

Description: A branch that stops without reaching an end event — including a decision gateway with no default path — leaves the process instance running when that path is taken. This control requires every path, including the one nobody expected to be taken, to finish.

Rationale: An unfinished branch does not fail; it hangs. The record sits mid-process, holding whatever state the process gave it, and no error appears anywhere. Where the incomplete path is the default branch of a gateway, the process works perfectly for every case anybody tested and hangs on the first case nobody did.

Audit Procedure:

  1. Enumerate the business processes and their diagram elements.
  2. Trace each path from every start element.
  3. Record every path that terminates at anything other than an end event.
  4. Record every decision gateway with no default branch.

Remediation:

  1. For each unfinished path, add the end event it should reach.
  2. Give every gateway a default branch, even where it should never be taken — especially then.
  3. Look for process instances already stuck on that path and complete or cancel them.

Default Value: Creatio permits a process to be published with unterminated branches, and with gateways that have no default path, and reports neither.

Cite this control as CIB-FLOW-001, Implementation Benchmark v0.1.0. Verified against Creatio 8.x. Published by ctx10; not affiliated with or endorsed by Creatio.