From a flagged claim to its source row

Guide · Worked example

Updated

Browse documentation
On this page

Published synthetic sample · Engine 18.6.0rc450

Trace a finding to its source rows

Verify the count with SQL, inspect the matching claims and follow each event back to the original export. The sample gives you the inputs, configuration and result file. Every query below runs in your browser on the published sample.

1. The Reader reports it.

In the published Reader preview, Measures › Rules & checks shows how many claims were checked and how many broke each rule. The highlighted row contains this finding.

The rules table from the earlier Reader preview of the published claims sample: nine rules, each with its checked count and hit count. The row for the same person doing both Assess Claim and Approve Claim shows 224 checked and 109 hit.

2. The result file states it.

The same result is stored in the rules table of the SQLite file. Run this query in any SQLite tool.

select checked_count, hit_count
from rules join analysis_windows using (scope_id)
where analysis_window = 'all' and analysis_domain = 'process_flow'
  and rule = 'role_separation' and activity = 'Assess Claim';
Returned by the query on the sample result
checked_counthit_count
224109

3. Recount from the events.

Count directly from the events to check the published result independently. This query compares the person recorded on each claim’s two steps.

with step as (
  select object_id, activity, employee_id
  from events
  where is_process_step = 1 and employee_id is not null
    and activity in ('Assess Claim', 'Approve Claim'))
select count(distinct a.object_id) as claims_checked,
       count(distinct case when a.employee_id = b.employee_id then a.object_id end) as same_person
from step a join step b on a.object_id = b.object_id
where a.activity = 'Assess Claim' and b.activity = 'Approve Claim';
Returned by the query on the sample result
claims_checkedsame_person
224109

4. Each hit is a claim.

The rule hit 109 claims. The file lists them in rule_hits: 218 event rows, two for each claim. These are the first three.

The first three claims the rule hit. Times are UTC, as stored in the file.
ClaimPersonAssessedApprovedRows in claims_ops.csv
C-1004Kaj Malm (u11)29 and 30
C-1006Rolf Sand (u17)46 and 47
C-1008Nina Palm (u14)57 and 58

5. Each event is a row in your export.

Every event names the row it came from. These are the two rows behind the first claim, copied from the input file.

C-1004, as written in claims_ops.csv: rows 29 and 30 below the header, 6 of 16 columns. The Engine reads these clock times in the declared time zone, Europe/Stockholm, and stores them in UTC.
event_refstep_noactivitystartedhandled_byteam
C-1004-033Assess Claim2026-03-27 12:11:10.960Kaj MalmClaims Assessment
C-1004-044Approve Claim2026-03-27 14:46:09.290Kaj MalmClaims Assessment