BFMA Forms Management Book of Knowledge - Sec 1 and 2

Forms/Template Design and Development 256 / 349 be deployed soon after they are approved and in accordance with the planned implementation. When the printed version is one of many output versions, the Forms Management Program area ensures all output versions of that form edition are ready to deploy at the same time. This is to avoid the risk of a form edition being deployed at different times with different edition dates, which would compromise the integrity of the form edition. Published announcements include relevant details as to how to dispose of stock on hand when a form is modified or replaced by another form or system.  Is the remaining stock to be destroyed or recycled?  Is the remaining stock to be used until it is entirely depleted?  Is staff to return stock they have at their desk to the warehouse for designated staff to recycle or destroy it?  Is the new stock to be distributed immediately or only once the stock of the earlier edition is used up?  Is there a cost to destroying stocks of earlier editions of forms?

Forms/Template Design and Development 257 / 349 It is important to provide clear directions to staff as to what to do with remaining stock of forms. This ensures that the correct form edition is always used and minimizes the risk of older versions circulating in the organization. FORMS CONTROL Quality assurance of deployed form versions Once the form output versions are deployed in production, but not yet announced, the forms technician may assist the forms developer in vetting, launching and testing every output version now in its live environment. The form edition is checked, if the form launch executes properly, included links are functional, tabbing order and features all work. Tracking deployment and implementation Once formally deployed and announcements published about the new or revised form edition, the forms technician:  Logs the actual deployment data in the forms management project database.

Forms/Template Design and Development 258 / 349  Tracks and logs:  The date the Forms Management Program received approval of the announcement.  The date approved announcements and associated reference material were sent for publication.  The actual date they were published. Information management, archiving and form history record The forms technician also makes sure that:  The source file and files of every output version are stored in the designated working directories.  The source file and files of output versions of the previous edition are archived, moved to a different directory or repository where all previous form editions are stored for reference and historical purposes.  Copies of every output version the newly deployed form edition are put in the form history record.

Forms/Template Design and Development 259 / 349  Documentation is put in the form history record, including:  A copy of the associated material created or updated at the same time of the form.  A copy of the published announcement.  Any communications to target partner groups related to the form’s deployment and implementation. Printed forms and inventory system When the Forms Management Program also uses an inventory system to manage its printed forms, the form’s profile is updated to reflect the new edition. The form’s profile is likely updated when a print request for the new form edition is sent, quantities determined, distribution units identified, etc. Deployment details once printed stock is received may be the identification of:  A distribution start date.  A restricted group of users.  Distribution quantity limits. etc. If the remaining stock of the form’s earlier edition continues to be used until depleted:

Forms/Template Design and Development 260 / 349  Both the old edition and new edition co-exist in the inventory system.  The older edition remains the default for distribution and the newer edition on hold. If the remaining stock of the earlier edition is to be removed from circulation, be destroyed or recycled, the form’s profile is archived once the Forms Management Program receives confirmation from the warehouse or designated area that the stock has been destroyed or recycled. PROGRAM MANAGEMENT For many forms projects, the head of the Forms Management Program represents the authority level required to proceed to deployment and implementation with the form client or form owner’s functional area. In many cases, the Program head can quickly approve forms, test samples and announcements to publish. In the case of more complex forms projects, the Program head needs to establish project-reporting requirements to allow for the proper monitoring of projects, their progress and impact on program resources. This is particularly critical when projects

Forms/Template Design and Development 261 / 349 planned deployment and implementation date is fixed and cannot be changed, say due to the enactment of legislation. The Program head oversees that every project element or component required for a successful implementation of forms are tracked and documented. The Program head:  Closely monitors form projects and regularly reports to senior management of projects’ status.  Notifies senior and executive management without delay of problems raised during projects, risks and impacts that could affect the forms project’s delivery and success. Solutions may require further investigation or increased budget or human resources allocation.  Reviews forms approval documentation and associated material (e.g., proofs, test samples, new business or user procedures) before approving or forwarding the package to other authorities for approval. As the representative of the Forms Management Program, the Program head may be called to present approval documentation to key management committees, the Forms

Forms/Template Design and Development 262 / 349 Committee or the Executive Committee in advance of a coming deployment and implementation. This would include:  Copies of the announcements to publish.  What documentation was prepared to assist staff, the enquiries area and technical support staff.  What mitigating measures are planned for D-day to respond to possible enquiries and support calls.

Forms/Template Design and Development 263 / 349 Environmental and safety awareness The Forms Management Program is aware of and complies with organizational policies related to environmental footprint. As much as possible, it uses eco-friendly, recycled or recyclable products such as soy-based ink, adhesives, recycled papers, and more. It aims to limit the production of toxic waste and by-products from forms. Whenever feasible, the Program encourages the use of electronic forms. FUNDAMENTALS Among the many laws, policies and regulations a Forms Management Program needs to comply with are those related to the environment and an organization’s footprint. Every form project goes through an environmental assessment when delivery channels and form output formats are defined. Each output format entails considerations from an environmental perspective, such as:

Forms/Template Design and Development 264 / 349  Paper forms and other printed product types use recycled or recyclable materials. This may depend on the form type and intended use.  Whether printing of eforms should be allowed or not.  Recycling options.  Impact on peripheral equipment.  Which output format and implementation provides the smallest footprint.  Impact on staff and user health. Historically, Forms Management Programs have adapted their forms design and development processes in line with available technology of the day. As awareness of the effect of products on persons’ heath and the environment grows, new technology and eco-friendly products are being developed to replace older more toxic form production processes. As a rule, Forms Management Program areas ensure environmental concerns are addressed, assessed and documented in the forms history record. They specify eco-friendly products such as recycled papers, soy-based ink, glues and adhesives in their form products.

Forms/Template Design and Development 265 / 349 As much as possible now, Forms Management Program areas encourage the use of technologies that enable eforms, dynamic forms and automated workflow, all of which reduce the need for paper forms, paper catalogs of forms and printed instruction manuals related to forms. There is awareness now of the environmental impact of newer technologies, such as disposal of electronic equipment, use of rare-earth elements, and more. They also ensure Program staff work in a safe environment where they are not exposed to toxic material or are equipped with the necessary personal protective equipment, if their work involves toxic material. BUSINESS PROCESS ANALYSIS The process maps and documentation provided by the business process analyst give a first glimpse of possible areas where improvements could be made to reduce the organization’s environmental footprint. For example A diagram shows a form is filled out by public clients, signed and sent in by mail. The form could be redesigned as a dynamic eform and be submitted and signed electronically.

Forms/Template Design and Development 266 / 349 • Online surveys have indicated that 75% of their client base uses the web. • Although 25% of their clients might continue to mail in their form, 75% of them would take advantage of the online eform version, thereby reducing the number of printed forms and the need to print the eform. • The process map remains essentially the same, with the form being filled by the same client and returned to the same functional area. • Only the methods of how the return action is changed to reflect the different options: mail or electronically submit. This is just one example, but a business process analyst can use process maps to engage discussions with stakeholders on how to improve the business process with an eye to reduce the organization’s environmental footprint. These are noted and documented in the requirements and specifications document and illustrated in process maps sent to the forms analyst and forms developers. The business process analyst is familiar enough with the organization’s environmental policies and form products to notify users and stakeholders that the Forms Management Program

Forms/Template Design and Development 267 / 349 takes these into consideration when recommending form solutions and developing output products. FORMS ANALYSIS As the forms analyst performs a more in-depth analysis of a form’s project, process maps and the requirements and specifications document, more discussions are held with the forms developer. There may be opportunities to further enhance the form’s functionality that could have a greater impact in reducing the organization’s footprint. For example The business process analyst recommends developing the form as a dynamic eform to enable electronic submission. The process map shows: • The form is sent by workflow to the designated processing area. • Once handled, the form is put in the client’s file record. The organization is in the process of establishing an electronic document management system. Could the completed form be saved in the client’s digital record? This would eliminate the printing of an eform and instead

Forms/Template Design and Development 268 / 349 keep a digital record, in line with the electronic process of the form. The forms analyst encourages the use of eforms as the preferred output version and means to reduce their organization’s environmental footprint. When clients have not indicated eforms as an option, the forms analyst proposes it or documents the reason not to use it, which could be justified. The forms analyst weighs the environmental pros and cons of using form output version X vs form output version Y. For example A one-page paper form printed back-to-back on one sheet of paper can quickly be converted to a fillable eform, but now, instead of filling a form printed on both sides of one sheet, users now have to print the form they completed on two separate pages. This is because most home printers don’t print both sides of a sheet of paper. There is no environmental gain here, in addition to the fact the two pages may not stay together for the duration of the handling process.

Forms/Template Design and Development 269 / 349 Forms analysts need to examine every impact of the recommended output solutions, cost them and ensure they are not only environmentally worthy in reducing the organization’s footprint, but also in ensuring business process effectiveness. For example An eform that aims to reduce the cost of manufacturing a form ends up being printed at users local or network printers. It is important to cost the difference between • Pre-printing the form combined with the cost of using a pre-printed form (warehousing, shipping, etc.) vs • The cost of a fillable eform but printed locally. Will this wear out ink cartridges and organizations’ printers faster and affect the printer supply budget? Eforms are great tools when implemented with a well-planned holistic approach that also takes into account all associated aspects of its handling process. In the case of printed forms, the forms analyst specifies the appropriate product, preferably a recycled and eco-friendly product, yet compliant to other requirements, as prescribed by the organizational environmental policies and the Forms Style Guide.

Forms/Template Design and Development 270 / 349 For example When permanent physical records are required, the forms analyst ensures to ask for archival quality paper for those specific forms. At times, the forms analyst may solicit the help of industry experts to research and determine what products are environmentally safe and provide the intended result. FORMS DEVELOPMENT The forms developer designs and develops the form according to requirements and specifications received, including those affecting the environment. In discussions with the forms analyst, the forms developer may apply other features or functionality to further improve the environmental footprint of a form. For example Include more electronic features and actions that reduce the need to print the form at different stages of its processing such as automated workflow of tasks, electronic approvals or signatures, data exchange. The forms developer writes print and production specifications using recycled products whenever feasible and practical. Non-

Forms/Template Design and Development 271 / 349 recycled or recyclable products are only used in exceptional circumstances, and their use is documented and justified. If indicated in the Forms Style Guide, the forms developer includes the appropriate recycle or environment logos that apply to the form product being developed. At times, the forms developer may need to ask industry experts for alternate products that are environmentally safe to output in the intended form product. TECHNOLOGY Developments in technology improved safety and removed health hazards in producing and printing forms. Gone are the days when forms were printed on a Ditto machine and reeked of alcohol used to print them. Forms designers and developers no longer create forms on phototypesetting equipment and develop camera-ready artwork with a process similar to that of developing photographs using acid baths. Nowadays  Much of forms design and development is now done on screen using sophisticated desktop publishing and forms software.

Forms/Template Design and Development 272 / 349  The form in progress is viewed, reviewed, demonstrated and updated virtually.  Forms can be deployed and used virtually, helping to reduce the use of paper.  Forms output files are sent to print providers electronically and most of their pre-press process now is also electronic. Many industries developed products aiming to reduce their toxic waste and the impact of their products on the environment and health of people. These technology advances are contributing to reducing the global environmental footprint by lowering paper consumption and increasing global recycling efforts. PRINT PRODUCTION As a rule, forms are printed and produced using eco-friendly products unless exceptionally instructed otherwise for specific and documented reasons. Most print industry manufacturers and printers offer eco-friendly non-toxic material, be they papers, cardstock, adhesives, soy or water-based inks, etc. When unsure of the availability or suitability of a product, industry experts can assist Program staff in finding alternate products.

Forms/Template Design and Development 273 / 349 PROGRAM MANAGEMENT The head of the Forms Management Program ensures its staff are aware of the organization’s environmental policies as well as any environmental legislation in force in their jurisdiction. These are included in the Forms Style Guide. The Program head:  Ensures the forms development process adequately addresses environmental concerns, and that findings and results are documented in the form history record.  Encourages the use eco-friendly products as well as the development of eforms, dynamic forms and automated workflow to reduce paper use and waste.  Reports periodically to senior and executive management on how effective forms management contributes to reduce the overall organization environment footprint and outlines projects which had significant impact.  Ensures that Program staff work in a safe environment, protected from toxic material. In cases where they must work with toxic material, they are equipped with the necessary personal protective equipment.

Forms/Template Design and Development 274 / 349 Signatures The Forms Management Program performs risk assessment to determine if a signature is needed. It uses knowledge of the different types of signatures and their application. The Forms Management Program implements signature process flows, including deadlines and the designation of alternates for routing, tracking and approving forms or form-related tasks, as required. The Program is aware of the legislation and regulations of their jurisdiction with respect to signatures and understands their obligations. It also applies the organization’s established signing authority delegation chart and policy, as well as the internal and external security and audit standards. This ensures the appropriate delegated authority signs and approves forms in the correct form process context and that the signature process is traceable, repeatable, auditable and tamper-proof. FUNDAMENTALS When working on a form project, the Forms Management Program performs risk assessment to determine if a signature is needed. The context of each form and the events, actions or

Forms/Template Design and Development 275 / 349 transactions that are recorded on the form need to be carefully examined to determine whether a signature is in fact required, what type and at what authority level. The requirement for a signature varies depending on the criticality of the transaction performed on the form and the requirements of the organization. The main issues are:  What is the likelihood that someone would want to forge a signature on this form or for this transaction?  What is the potential for loss if they did. For example • Why would someone bother to forge a signature on a Vacation Request? How would they benefit? • If they did forge a signature, what is the potential loss to the organization? Probably no signature is necessary, but if one is desired, it could be a low-level signature such as a system or password approval to show the supervisor saw and agreed to the request. For example

Forms/Template Design and Development 276 / 349 A Change of Beneficiary could involve big dollar loss and even end up in court some years later. Risk of loss and desire to counterfeit are much larger in this process. The risk assessment considers:  The amount of individual transactions.  The total expected volume of transactions.  The transaction type.  If the transaction type is such that it is unlikely that anyone would want to counterfeit another person’s signature (such as many routine internal transactions) and the risk of dollar loss is low, the signature may be omitted entirely or a system or password approval could be used.  If not, a more robust digital solution process may be required. In any case, if signed, the signature is designed to tie the signer to the specific transaction and affirm that the signer attended to agree to the transaction. All forms requiring a signature should be identified in the forms management database. The selected signature technology can then be applied to each form.

Forms/Template Design and Development 277 / 349 In matters of signatures and evidence, the Forms Management Program staff applies the legislation and regulations in effect in their jurisdiction. It also relies on the organization’s policy on signatures and its signing authority delegation chart and policy. The signing authority delegation chart defines delegated signing and approving authorities of set position levels of the organizational chart. There are different types of signatures and all aim at proving the identity and intent of the signer, and for a contract or agreement, that the signer agrees to the terms. The three key features of all types of signatures are authentication, non-repudiation and integrity. That is, the signature serves to:  Authenticate the identity of the sender and signer (authentication).  Ensure the sender cannot deny having sent the message or document (non-repudiation).  Ensure that the message or document was not tampered with in transit (integrity).

Forms/Template Design and Development 278 / 349 Below is a summary of various signature types found in today’s business world. Wet signature52 – Refers to the wet ink used when applying a handwritten signature, often a stylized depiction of one’s name, a simple “X”, fingerprint, mark or name seal to a document that uniquely identifies the signer. Once signatures became electronic or digital, this newly coined term was necessary to identify a handwritten signature (or mark) from other types of signatures. For example  The Great Peace of Montreal treaty53 shows the marks of the signing First Nations representatives present. Most were pictograms such as of a Bear, Turtle, Thunderbird, among others.  The US’s Declaration of Independence54 has 56 wet signatures. 52 John Horliby, “wet signature”, Words Worth, January 23, 2007, http://wordsworthonline.blogspot.com/2007/01/wet-signature.html 53 Wikipedia, “Great Peace of Montreal” 54 Shutterstock, “Images: declaration of independence signature”, https://www.shutterstock.com/search/declaration+of+independence+signature

Forms/Template Design and Development 279 / 349 Wet signatures have been around almost since the invention of forms. There is a large body of knowledge around wet signatures, as well as legal precedents. For wet signatures, forensics have been well established to ensure the signer is who they say they are. By definition, wet signatures use passive authentication, that is, the signature is accepted up front and is verified only if challenged. By affixing one’s signature to a form, the signer attests to the specific transaction described in the form. Generally, the signature block is placed at the bottom of the form along with fields for the printed name, title (if appropriate) and date signed. It is generally accepted that the signer is attesting to information above the signature block. Sometimes there is a need for a notary signature, seal and witnesses to authenticate the signer’s identity and tie them to the particular transaction. Electronic signature – An electronic signature55, or e-signature, is any electronic means that indicates: 55 Wikipedia, “Electronic signature”

Forms/Template Design and Development 280 / 349 • A person adopts the contents of an electronic message; and/or • The person who claims to have written a message is the one who wrote it; and/or • The message received is the one that was sent by this person. As defined in the US’s Electronic Signatures in Global and National Commerce Act (ESign Act), it is “an electronic sound, symbol, or process attached to, or associated with, a contract or other record and used as the legal equivalent of a written signature.”56 It can be a scanned facsimile of a person’s signature, a password, or any other mark. The term “electronic signature” remains the most confusing of signature designations. • Some confuse it with digital signature57, which it is not. 56 govinfo.gov, “Electronic Signatures In Global And National Commerce Act”, Public Law 106-229 – June 30, 2000, Sec. 106, Definitions, (5) Electronic Signature, https://www.govinfo.gov/content/pkg/PLAW- 106publ229/pdf/PLAW-106publ229.pdf 57 Wikipedia “Digital signature”

Forms/Template Design and Development 281 / 349 • Others believe that a scanned graphic image of their handwritten signature is also an electronic signature, which it may or may not be. Note: It is important to check in one’s jurisdiction whether a scanned image of one’s handwritten or wet signature is considered legally binding. The scanned image of the signature alone may be considered a valid electronic signature, but not a digital signature. Most forms design software support a signature field with specific properties such that when the user tabs into the signature field, a dialog box appears and asks the user to enter a password to affix an image indicating the form has been signed. Sometimes the signature is automatically applied based on the login to the active directory. Electronic signatures tend to be less secure than digital signatures and may not hold up as evidence in court. Below are some familiar examples of e-signatures: • A personal identification number (PIN) entered into a bank’s ATM with one’s debit or credit card.

Forms/Template Design and Development 282 / 349 A PIN is a numeric password to authenticate users to access a system. Commonly, it is associated to a bank user and its debit or credit card information. It is needed whenever the user wishes to do financial transactions with the bank, such as take money out, execute payment transactions, etc. The card is necessary to execute these transactions; it is used with other usernames, passwords and peripheral equipment such as card terminals. • Contact information at the end of an email or electronic letter (with or without a graphic image of one’s handwritten signature). Contact information such as one’s name, position title, telephone and fax numbers, email, is included to identify the sender of email messages. They can be used, for example, to approve form content elements by the client or stakeholders. Returned emails with “Approved” or “Agreed” can be accepted and put in the form history record as decision documents. The same procedure is used for acknowledging receipt of digital proofs from the print provider and to return the “Approved” digital proof by email.

Forms/Template Design and Development 283 / 349 • Systems’ business rule-driven approvals. Some organization-wide systems, even if they don’t use encrypted digital signatures, have implemented more sophisticated mechanisms to authenticate approvers. The system may check: − The user and login registry, username. − The position level and signing authority delegation chart for the position’s corresponding signing authority. Forms developers may also program business rules in automated workflow of tasks and actions to process approvals, forcing the form to the next approving level by date X if the form has not been approved. The automated system signature block is likely to include the approver’s name, username, title with action options or checkboxes such as “Approved” and “Not approved”. Depending on the decision made, the system triggers routing and other automated tasks, such as recording the decision, notifying interested parties. Note: An electronic scanned image and representation of one’s handwritten signature can be considered an electronic signature, but usually when

Forms/Template Design and Development 284 / 349 combined to other authenticating elements or measures such as an approver’s login, username, password. • Clicking “Agree” to terms and conditions of a contract. It is mostly used in connection with software licenses or online services. A pop-up window appears and one indicates its assent by clicking the “OK” or “I agree” button. The user clicks on “Cancel” or closes the window to reject the transaction. • Signature Pads allow a user to sign on the pad, which is connected to a computer, and an image of the signature is captured and placed on the form. These are often used at retail stores, post office, shipping companies or physician’s offices. Digital signature – A digital signature58 is a mathematical scheme for demonstrating the authenticity of a digital message or document. A valid digital signature gives a recipient reason to believe that the message was created by a known sender, such that the sender cannot deny having sent the message 58 Wikipedia “Digital signature”

Forms/Template Design and Development 285 / 349 (authentication and non-repudiation) and that the message was not altered in transit (integrity). Increasingly, digital signatures are used in eCommerce and in regulatory filings since digital signatures are more secure than a simple generic electronic signature. The concept itself is not new, with common law jurisdictions having recognized telegraph signatures as far back as the mid-19th century and faxed signatures since the 1980s. A digital signature is a specialized type of electronic signature that provides a greater security level than the common electronic signature. When signing a document using a digital signature, it’s a bit like including an encrypted fingerprint. To do this, digital signature software uses encryption and decryption technology to confirm the authenticity of messages and documents. This information is embedded in the document and includes an audit trail. For example59 59 Example here was adapted from scenario found at:StakExchange, Information Security, “What is the difference between an electronic signature and a digital signature”,

Forms/Template Design and Development 286 / 349 When using digital signature with asymmetric cryptography, a person uses a private key and a public key. These are virtual keys, like codes or passwords.  The person uses its private key to sign and encrypt messages.  The public key is made available to anyone who needs it to open documents received from that person. Digital signatures offer more robust security and are more commonly used for financial transactions, contract management, legal offices, and any cases where it is critical to assert the authenticity and integrity of the signer and document, to confirm that no forgery or tampering occurred. The software for digital signatures can include: − Biometrics such as fingerprints, retina scans, voice. − Digital certificates. https://security.stackexchange.com/questions/17554/what-is-the-difference-between-an-electronic- signature-and-a-digital-signature

Forms/Template Design and Development 287 / 349 − Signature pads to capture a signature. In order for electronic and digital signatures to meet the three key features of authentication, non-repudiation and integrity, there are considerations for the user and for the process. With digital signatures, it is all about the process used. Also see  What is the difference between an electronic signature and a digital signature60 User requirements (front end) For the user interface, the form presented needs to be documented in terms of:  The actual form.  The edition date of the form used.  A method for tying the variable data to the specific form container. 60:StakExchange, Information Security, “What is the difference between an electronic signature and a digital signature”, https://security.stackexchange.com/questions/17554/what-is-the-difference-between- an-electronic-signature-and-a-digital-signature

Forms/Template Design and Development 288 / 349 Presentation of the form to the signer is accompanied by acceptance of the signed transaction by the issuer (generally accomplished in the “Submit” script.) The format presented needs to be consistent throughout the transaction, and all fields need to be locked when the signature is applied. If the process allows for un-signing a form, the signature must be fully removed and the process starts again. A complete record of the transaction is stored in a tamper-proof manner. Each transaction is processed in an identical manner. Both parties to the transaction need to have access to a copy of the signed form and the entire process must be tamper proof. Process requirements (back end) As signed transactions are submitted, logs should be created and maintained that describe all transaction details. These logs must be stored in a secure manner and any attempt to alter the transaction data must be detected and recorded. Data must be encrypted during transmission (both ways) and confirmations provided to the user throughout the process. An audit process is built into the signing process so, at any point, proof of the transaction can be verified.

Forms/Template Design and Development 289 / 349 The so-called signing ceremony (all signing ceremonies are typically carefully planned, scripted, and managed) consists of multiple files that, collectively, define and prove the transaction. Such documents are stored with the form The lack of an electronic signature methodology is one of the greatest impediments to the implementation of fully automated eforms and applications. It is up to every organization to determine and implement the signature framework that meets its business needs and requirements. The signature framework is included in the organization’s policy, including the context in which each signature type it is to be used and applied. BUSINESS PROCESS ANALYSIS As a business process analyst, one of the first tasks is to examine the workflow requirements, then perform the risk analysis, and determine if a signature is necessary.  Many internal forms may not need to be signed at all, depending on the results of the risk analysis.  For those forms that do need to be signed, an electronic signature may suffice.

Forms/Template Design and Development 290 / 349  If a form is signed only because a manager feels they need that control, a simple electronic signature tied to the logon should be sufficient.  For high risk transactions (beneficiary designations, contracts, insurance applications, etc.), a digital signature or wet signature may be required.  Legally binding or official documents might require the use of special paper, the signature of witnesses, that a number of document sections be initialled, or that an official seal be applied, at times on all pages. Signing forms inside the firewall (internally used) may need the same level of process documentation as forms outside the firewall – it depends on the risk assessment results. For many internal forms, the risks are minimal and a simple electronic signature (if one is even necessary at all) may suffice. This includes vacation requests and other routine approvals, acknowledgements, etc. Outside-the firewall requirements tend to be more stringent but it again depends on the risk assessment. Many credit card transactions do not require any signature at all, as the risk of loss for any single transaction is generally small. However, the need to

Forms/Template Design and Development 291 / 349 authenticate the signer is much more difficult and will require more detail, such as moving to a digital signature and all that entails. When submitting business cases and forms solution options for decision, the business process analyst includes, for each proposed option, the recommended signature type and process to use. These are either in line with existing signature policy and framework, or are presenting new signature options for decision, approval and implementation. Approvals and signatures are significant steps in a business process and are generally noted in business process maps. The business process analyst documents details of an approval step and confirms the position title or authority level required. For example • If contract amount less than $10,000, approved by area manager. • If contract amount $10,000 or over but less than $25,000, approved by area director. • If contract amount $25,000 or over but less than $100,000, approved by the vice-president. • If contract amount $100,000 or over, approved by the Chief Executive Officer.

Forms/Template Design and Development 292 / 349 Some forms may include a first step of reviewing and recommending an action before it is submitted for approval. This is also documented in the process maps. When possible, the business process analyst simplifies the approval process by analyzing the different steps, seeing if some could be removed and streamlining without compromising the legitimate purpose of the approvals. This requires that the business process analyst:  Is familiar with the signing authority delegation chart, signature technology and framework.  Can engage discussions with stakeholders and provide insight on options through demos and presentations using other existing forms or with the project’s draft form. The business and approval processes are confirmed with stakeholders before being recorded in supporting documentation such as process maps, procedures and approval documents. This information is relevant to the forms analyst and forms developer who apply rules, workflow and programming to form approval fields and sections.

Forms/Template Design and Development 293 / 349 FORMS ANALYSIS When finalizing a form’s requirements and specifications document, the forms analyst includes all form elements such as images, content, instructions, features, actions, events, sequence, legislation, policies, and regulations that apply to that form. This includes those that apply to approval processes and signatures. The forms analyst specifies every detail of the approval process and the different scenarios possible.  Does it require a recommendation first?  Does the approval position and authority level change based on a financial range or maximum?  What is the risk of this transaction? The approving authority level is based on the transaction risk, criticality and nature of the approval. Answering these questions and knowing the approval context allow the forms analyst to provide clear specifications to the forms developer who converts the specified rules in programmed events. For example Recommending a contract document be signed may only require a system approval based on programmed rules

Forms/Template Design and Development 294 / 349 routed by workflow to the person authorized to sign. The system uses the person’s username, name, position title and signing authority level to direct the contract at that step of the process. Other rules are programmed to determine the next step depending on the recommender’s outcome. − If not recommended, it is automatically returned to the author seeking approval. − If it is recommended, the contract is routed via workflow to next approving level or the actual contract approver. These actions are also rules-based. As for the actual contract approval, the organization may require digital signatures. This decision could be due to the higher risk of signing contracts of significant financial value and therefore wishes to ensure the authentication, non-repudiation and integrity of signed contracts. The forms analyst details signature field properties. Using the above example, the forms analyst specifies

Forms/Template Design and Development 295 / 349 − What rules (e.g., contract value entered) determine the profile, data fields and field content that apply to the signature block of the signer. − Which generic positions of the signing authority delegation chart are to be called from the chart’s schema or database. For example The possible signers may have different titles, such as Vice-President of Human Resources, Vice-President of Communications, and Vice-President of Administration. On the delegation chart, the position titles are generic and apply to all positions at that level. In this case, the position of Vice-President defines the authority levels for that position type. On the other hand, the signing authority delegation chart schema may show distinct authority levels for each position level in every functional area, or group them into a few generic levels that apply to different functional

Forms/Template Design and Development 296 / 349 areas (e.g., Vice-President administrative areas, Vice-President program areas). The forms analyst provides additional information to stakeholders and users as necessary. Specifics about the functionality of a signature or approval field may be given to satisfy the all parties and stakeholders of the form’s design and features. The forms analyst illustrates the signature functionality by making demos or presentations to stakeholders, users, and testers, as needed. As well, the forms analyst includes a timeline and deadline by which the form is to be approved. This allows the forms developer to program routing and workflow tasks within the prescribed timeline. For example − The contract needs to be in effect by a specific date. − There are other activities to be performed by the Contract Management area after approval and signatures are obtained in order to activate the contract.

Forms/Template Design and Development 297 / 349 The forms analyst needs to provide the expected time lapse a form remains at one step of the approving process before it is triggered to move to the next level. − Say the contract is recommended by staff and forwarded to the area Director for approval and signature. − After 48 hours of inactivity, the workflow triggers an action that assigns the contract as a task to the next authority level (e.g., Vice-President). This ensures: − There are no lapses in process flow. − No activities or tasks that remain unassigned and left unattended which could negatively impact the organization’s business activities. Specific instructions are included for each output version with respect to routing, approvals, signatures, saving and archiving forms completed by users and approved. Text instructions are included for printed versions; paths, directories, filenaming conventions or electronic document management system specifications are included for eforms.

Forms/Template Design and Development 298 / 349 This is to ensure that a record of the form’s approvals is made in every case. FORMS DEVELOPMENT The forms developer makes sure the required technology is in place to apply the signatures and approvals as per the requirements and specifications provided. The forms developer creates forms’ signature fields and blocks within the technology set available. Questions and design issues are discussed further with the forms analyst and stakeholders until resolved. Where new technology or equipment may be suggested, these would first be discussed with the business process analyst, forms analyst, stakeholders and the Information Technology area. Depending on the scope and intended use of the technology, a business case may be required. Working with the Information Technology area, an approval to procure would be required early in the project to ensure compatibility and interoperability with the overall technology architecture of the organization. This also allows procurement and quality assurance activities to take place before deployment.

Forms/Template Design and Development 299 / 349 The look, features and functionality of the signature block areas on forms vary depending on their respective output version format. For example The approval block section of: • A printed form may: − Be designed to show the different authority levels required depending on the dollar value with instructions. − Still function using wet signatures. • An eform: − Displays the exact approver’s information based on the outcome of the form’s programmed rules based on the value field. − Benefit from electronic or digital signatures. The forms developer applies data mappings, programming, tasks and action sequence based on the approval process defined and based on the organization’s approved signing authority delegation chart.

Forms/Template Design and Development 300 / 349 The forms developer ensures programmed workflow tasks and events take into account specified timelines and deadlines providing an effective tool to manage the approval and signature process. The forms developer also includes routing, saving and recordkeeping instructions. For example • The printed form provides routing instructions regarding where to send the signed and approved form for processing, and where to put a copy on record. This may appear as an important note in the approval signature block area of printed forms. • On eforms, routing might be programmed using workflow tools and actions programmed to save a record on a specific drive and path or in a specified digital record. Draft forms are presented to stakeholders and interested parties for them to see the signature in action, especially on dynamic eforms. This allows them to validate the functionality of electronic or digital signatures, to feel confident that the authentication and

Forms/Template Design and Development 301 / 349 integrity of the signer and of signed documents is maintained. Discussions and user tests continue until results prove successful. DATA COLLECTION AND PRESENTATION With respect to signatures, the data collected is about what was approved, at what value, the date and time the approval was received, by whom, the date the approved document is received, and if other events followed (e.g., a letter sent to a client or supplier). In essence this data provides a necessary audit trail for ensuring the integrity of business processes and transactions. When forms use wet signatures, the critical form data may be re-entered in another system, scanned for data upload or record purposes. The date the approval was received and the date the document was received for action are logged. In certain business processes, the signature date is important to determine whether the document is receivable or not. Regardless of the output version, signatures on forms are validated to ensure the correct authority approved, to authenticate the identity of the approver and of the signed form. In the case of eforms, the form data fields’ content (entered data when filled) may be electronically transmitted to an organization,

Forms/Template Design and Development 302 / 349 but held in a temporary database until handwritten, electronic or digital approval is received. Once approval is received, an automated task or staff action the form to upload the data in the database formally. Approval signature data and details are also recorded in the system or database. TECHNOLOGY With technology evolved a good number of methods to electronically sign documents or forms. Some signature software solutions are more complex and more expensive than others to implement, such as digital signatures. The investment value of the technology to assure the authentication of signers and documents needs to be balanced against the criticality and nature of the organization’s business. For example Parcel deliverers capture their recipients’ handwritten signature on a small signature device that electronically captures the signature and stores it with the parcel delivery details. While signature devices are efficient and convenient for parcel deliverers, they would not suffice for approving legal

Forms/Template Design and Development 303 / 349 documents or engineering plans that require a more rigorous approval and signature process. Organizations work in collaboration with the Information Technology area to determine and implement the signature technology that best meets their business needs. The organization also needs to establish a signature framework with guidelines as to what type of signature, authority level and technology is to be used to assure the legitimate purpose of transactions commonly made by staff while working. This signature framework and guidelines also take into account the legislation of the jurisdiction, are published in a policy and procedure to guide staff. For example The policy may state that internal administrative processes can be approved using common electronic system approvals and that financial expense over a certain value and legal documents need to be digitally signed. This helps the Forms Management Program staff align their forms design with the correct technology, signature process and develop accordingly.

Forms/Template Design and Development 304 / 349 Federal, state and local laws that require signatures can be slow to change and will still require either a wet signature or a full digital signature. Each organization should decide what digital signature technology they will use for these instances and standardize the signing process throughout. Selecting a specific technology to use can be a daunting task, as there are a lot of competing solutions, each with features, advantages and disadvantages. Many such solutions can be expensive and difficult to use. This is where a comprehensive forms strategy is useful to determine what signature technology is required and will be supported in the organization. This requires a thorough review of all policies and procedures to determine where signatures are required by policy. The Forms Management Program staff are aware of the signature policy framework and guidelines, of the technology architecture, systems and tools, and work within its possibilities and limitations. PROGRAM MANAGEMENT The head of the Forms Management Program ensures that the Forms Policy is aligned with the organization’s policy with respect

Forms/Template Design and Development 305 / 349 to signatures. The Program head takes care to keep its staff aware of the legislation and regulations that apply to their jurisdiction with respect to signatures, of where to obtain reference or advice as necessary when working on forms projects (likely Legal Services). The Program staff are also knowledgeable of and familiar with the signature technology architecture, its software, systems, tools and equipment. Program staff understand how each work and can apply signature and approval sections on forms based on the signature framework. The Program head and staff are aware of the signing authority delegation chart, on what it is based, how it is to be interpreted and applied to forms.