CIB-TRIG-001

An update trigger must name the columns it depends on

Risk
Moderate

Defence in depth — other controls still give coverage if this one fails.

Evidence
metadata

Decidable from the instance’s own configuration.

Section
Triggers

What starts a process, and whether it starts more often than it should.

Fix shape
entity · Process

One task per non-compliant process.

Control Statement: A process started by a record-updated signal must specify the columns whose change should start it.

Description: Creatio allows an update signal to leave its watched columns unspecified, in which case the process starts on every save of the record. This control requires the columns to be named, so the process runs when the data it cares about changes and not otherwise.

A start condition is not a substitute. The condition narrows which saves proceed; it does not stop the signal firing on a change to a field nobody cares about.

Rationale: An unnamed column list turns every save into a process start. On a record type touched by an import, an integration or a bulk update, that is thousands of starts doing nothing — and they are indistinguishable, in the log and in the load, from the ones that matter. The cost stays invisible until the instance is slow, at which point the cause is buried in volume.

Audit Procedure:

  1. Enumerate the processes started by a record-updated signal.
  2. For each, inspect the signal’s watched columns.
  3. Record every signal with no columns named.
  4. For each, identify which fields the process actually reads or depends on.

Remediation:

  1. Name the columns the process depends on, on the signal itself.
  2. Keep the start condition as well — the two do different jobs.
  3. Verify the process still starts when those fields change, and no longer on unrelated saves.

Default Value: Creatio leaves the watched-column list empty by default, which starts the process on every update of the record.

Cite this control as CIB-TRIG-001, Implementation Benchmark v0.1.0. Verified against Creatio 8.x. Published by ctx10; not affiliated with or endorsed by Creatio.