Client
A Singapore religious services provider
Role
Analyst, architect, builder, tester
Discipline
Process redesign · productivity
Delivered
Three production systems
This page
The flagship of the three

Two admins retyped every certificate by hand

The benefit

What was achieved

Process improved
7 days → 3 hrs
Two admins, freed for a week
Process improved
99%
Of names correct on first issue
The problem

Every certificate name was retyped by hand. Two admins spent a full week on 7,242 files.

My contribution

What I personally did on this

Owned
Process analysis · requirements · solution design · the data model
Built
All three production systems, personally, end to end
Led
Rollout and the handover to the admin staff
What was delivered

The certificate stopped being posted to you

Before
  • Files arrived named by machine, opened one at a time to find the name inside
  • Renamed by hand, per file, and matched to an order by reading it
  • One email per order, certificates attached manually
  • A missing or wrong name was chased by a person, or not chased at all
  • A corrected name meant sending the whole thing again
  • Replies landed wherever they landed
After
  • Generated straight from the order record, in a single run
  • Named and matched on the order number, never on spelling
  • One message per order carrying a link, no attachments
  • A bad or blank name triggers its own WhatsApp, asking that customer to supply it
  • A correction regenerates at the same address, nobody is contacted
  • An enquiry button puts every request in one place
~/Certificates · 12,000 files
□scan_0001_export_final_v2.pdfBEFORE
□scan_0002_export_final_v2.pdfBEFORE
□scan_0003_export_final_v2.pdfBEFORE
↓  Step 1 — Preview  ·  Step 2 — Commit  ↓
✓1587 - Ahmad Hassan.pdfAFTER
✓1588 - Siti Khadijah.pdfAFTER
✓1590 - Yusuf Ibrahim.pdfAFTER
Preview runs first and writes nothing. You see every rename before a single file moves, and the commit is a separate deliberate step. Names above are invented.
The whole process, end to end · four actors, two decisions, one loop
End to end swimlane across four actors: customer, online store, certificate system and admin staff. The customer places an order and types the names into one free text box. The store records order, product and quantity. The system extracts the data, cleans each name, then tests for a confident match on the order number; if it is not confident, staff rule on the name. The system renders the certificate, assigns a permanent address, publishes and sends one message per order. The customer opens the link, finds the certificate and judges whether the name is right. If it is wrong, staff confirm the correction from the queue and the system regenerates at the same address, so the link the customer already holds updates with no further message sent.
Before and after workflow. Before: a batch of machine-named files is opened one at a time, renamed by hand, matched to an order by reading it, then one email per order is composed with the certificates attached, and replies land wherever they land. After: order data is extracted, certificates are generated and named by key in a single run, published to a lookup portal, and one message per order carries a link the customer opens themselves.
Seven steps down to six, and the two that cost the most are gone entirely
What was delivered

Watch a name get cleaned

Name normalisation · one real order shape
As typed at checkout
01
Split the numbered list
One box, two people. The numbering is not part of anyone’s name.
02
Repair broken characters
The apostrophe arrives corrupted by the export. Fixed, never guessed.
03
Strip what a filename cannot carry
One illegal character ends the whole run if it gets through.
04
Fix casing and spacing
Typed in a hurry on a phone. It still has to print properly.
05
Match on the order number
Not on the spelling. That is what stops a typo mis-delivering.
06
Count the names against the order
Three units paid for, two names given. The gap is the anomaly.
07
Chase it automatically over WhatsApp
That customer gets asked for the missing name. Nobody had to notice.
Two certificates issued, one chased, nobody typed a thing
What was delivered

Now look one up

Certificate lookup · reconstruction DEMO DATA · not the live system
Order number or recipient name
Demo data. Connected to nothing.
Workflow analysis

Where the time actually went

Before
The batch arrivesComplete and on time. Sourcing was never the problem
→
⚠ Bottleneck Rename each file, then email each order Two per-item steps in a process measured in thousands of items, and neither one needed a judgement
→
Field the repliesThe part that genuinely needed a person
After
The order record arrivesSame input, read by a script rather than by eye
→
✓ Automated Generate, name, publish, notify One run. The order number decides the match, so spelling stops being load-bearing
→
✓ Unchanged A person rules on the name Deliberately. A wrong name on a religious certificate is worse than a slow one
Notes

What shaped the decisions

Why it previews before it commits

Twelve thousand files renamed in one pass is twelve thousand chances to be wrong at once. The preview is what makes that survivable — and it is the reason a person stayed in the loop without a person doing the typing.

The decision the whole thing rests on

Every certificate got a permanent address before a single message went out. That is what turns a correction into a regeneration instead of a re-send — and it is the cheapest decision on this page to make early, the most expensive to retrofit.

The misspelling case

A matcher confident enough to correct a name is confident enough to attach the wrong family to a sacrifice. So above the bar it matches, below the bar it asks — and the question goes to the one person who can actually answer it, which is the customer.

Requirements

What it had to do, and why it mattered

Five, and the fourth one is the reason the system survived its first correction round.

  1. 01
    Take the order record as it is, not as it should be
    Names typed free text at checkout: one to eight per box, numbered three different ways, with characters the export corrupts.
    Nobody was going to retrain thousands of customers on how to fill a text box. Absorbing that mess is the system’s job, not a precondition for it.
    Ingest
  2. 02
    Match on the order number, never on the spelling
    The order number is the key. The name is payload, and payload is allowed to be wrong.
    The old process matched by reading a filename. That makes a typo into a mis-delivery, and on this document a mis-delivery is not a clerical error.
    Match
  3. 03
    Refuse to guess below a confidence bar
    Above the bar it matches. Below it, the pipeline stops and puts both options in front of a person.
    An automation that is never wrong is slower than one that is occasionally wrong. Here the occasional wrong answer is the one thing that is not survivable, so it buys accuracy with a person’s time.
    Escalate
  4. 04
    Give every certificate a permanent address
    Unguessable, and stable across regeneration. A corrected certificate reuses the address it already had.
    This is the requirement that removes the re-send from the process. Without it, every future correction is another campaign; with it, the correction is invisible to the person who already has the link.
    Publish
  5. 05
    Send one message, and route the reply back to one place
    One message per order carrying a link, and an enquiry button on the portal that collects every request in a single queue.
    The old process lost track of who had replied because there was nowhere for a reply to land. A queue is not a feature, it is the difference between handling enquiries and remembering them.
    Deliver and resolve
What was replaced

Eight manual steps, and what each became

Eight manual steps, and what each one was replaced by
The manual stepWhat it costWhat replaced it
Renaming each fileTwo admins, a week, 1,000 a dayGenerated from the order record in one run
Matching a file to an orderRead by eye, so a typo mis-deliveredMatched on the order number, never on spelling
Chasing a missing nameChased by a person, or silently never chasedDetected automatically, and the customer gets their own WhatsApp asking for it
Reading a name that arrived brokenApostrophes and spacing corrupted by the exportRepaired on import, and never guessed at
Splitting a multi-name orderUp to eight names in one box, numbered three waysSplit on entry, type sized so the longest still fits
Sending each certificateOne email per order against a daily mailbox ceilingOne message per order carrying a link, nothing attached
Re-sending after a correctionEvery fix was a second outbound campaignRegenerated at the address the customer already holds
Tracking who repliedReplies scattered, no record of who was still waitingOne enquiry queue, every request in the same place
The one people miss

Row three is the quiet one. Before, a blank or wrong name was only discovered when the customer complained, which meant the ones who did not complain simply received the wrong certificate. Now the system finds it and asks that specific customer for the correct name over WhatsApp, automatically. The chase stopped depending on somebody remembering to chase.

Scope

Three systems, not one project

The certificate platform below is the flagship. It is not the whole engagement.

What was built, and what each one replaced
SystemWhat it replacedMeasured
Certificate platform
This page		Two admins renaming files by hand, then emailing them one order at a time21,850 documents
5,414 orders
Order trackingA Google Sheet acting as the database, edited live by staff2.5–4.3s → ~0.05s
per action
TicketingEnquiries arriving on WhatsApp with no ticket, no owner and no clockSLA measured in
business hours only
The number I nearly left out

The order system ran on a spreadsheet. Every action a staff member took cost 2.5 to 4.3 seconds, measured, because it was a round trip to a Google Sheet. On the rebuilt engine the same action costs about 0.05 seconds. That is not a tuning gain, it is a fifty to eighty times difference, and it is the reason the board became something staff use all day rather than something they avoid.

The part most people stop before

Plenty of people can name a process problem. Fewer can write the requirement. Fewer still design the schema, ship the code, then run a security test against their own build and publish what it found — zero critical, zero high, four raised, two fixed the same day. Then write the staff guide, because a system nobody adopts is a system nobody built.

Method

Three releases, and the shape changed at the second one

The first release made the old process faster. That is why it did not survive contact with the real volume.

The delivery arc
The delivery arc across three releases: rename a supplied batch by hand; generate from the order data and publish a lookup portal; then a correction round where fifty four of sixty three certificates regenerated in place.
Findings

Four questions, answered in order

01Which step is actually costing the time?
SIPOC of the korban certificate process with the naming and notification steps marked as the automation opportunity
SIPOC, with the automation opportunity isolated inside the process
What it showed

The inputs were fine and the output was fine. Two steps in the middle were per-item, in a process counted in thousands of items — and neither of them required a decision from the person doing it.

02Why did it break at this volume and not before?
Fishbone diagram of the certificate issue bottleneck. Six cause categories feed a spine into the effect. Method, Data and Delivery are marked as the categories a rebuild could reach.
Six categories, one effect. Three were reachable, three had to be designed around
What it showed

Method, data and delivery were fixable. People, tooling and volume were not — a religious deadline does not move, and the window is staffed by whoever is available. The constraints had to be designed around, not argued with.

03Eleven options. Which four were worth a first release?
Impact against effort matrix for the eleven options considered. Do first: generate from the order record, send a link rather than attachments, give every certificate a permanent address, match on the order number. Plan it: the self-serve lookup portal with an enquiry queue, and the escalation step for low-confidence names. Fill in: repair corrupted characters, sanitise filenames. Avoid: parallelise the renamer, rebuild the checkout to force structured name fields, two-way sync with the old spreadsheet. The first release did the avoid option, making renaming faster instead of removing renaming.
Impact against effort. The whole matrix exists to catch option 9
What it showed

The expensive-looking options all left the renaming step in place. The previous release had done exactly that — parallelised the renamer so it ran faster, which is real engineering that changes nothing. Faster wrong is still wrong, and it is the most common way a process project spends its budget and ships no result.

04What replaces it, and where does the loop close?
The solution workflow. Order data is extracted, certificates are generated and named by key, published with stable addresses, and one message per order carries a lookup link. Below, the correction loop: an enquiry goes to customer service, the name is corrected, and the certificate is regenerated in place.
One run, then a loop that never needs another send
What it showed

The run is the easy half. The loop underneath it is the half that keeps working after handover — an enquiry arrives from the portal, a person rules on the name, and the certificate regenerates at the address the customer is already holding.

05What does it do when the data is wrong?
The certificate pipeline drawn component by component. Twelve components across five stages: read the order export and reference register; split a numbered name list, repair broken characters, strip illegal symbols; match on the order key, disambiguate duplicates, escalate what cannot be matched; render and assign a stable address; build the index, publish, and dispatch one message per order.
Twelve components. The one that matters most is the one that refuses to guess
What it showed

Names arrive typed by hand at checkout, so they arrive broken: eight in one box, numbered three different ways, apostrophes corrupted by the export, or simply blank. Eleven components clean and match. The twelfth stops and asks a person, because a confidently wrong name is worse than an unanswered one.

The result

How it was proven

The batch had to be right before it was published, because a religious certificate cannot be quietly reissued.

Acceptance checks · every line had to pass before publishing
CheckWhat had to be true
CompletenessEvery paid order produces at least one certificate, and the counts reconcile
Name integrityMulti-name orders split into the right number, in the right order
Character handlingApostrophes and non-standard characters render as typed, not as replacement marks
TypesettingOne name and eight names both fit the plate without overflow
DuplicatesThe same name on different orders resolves to separate certificates
Address stabilityA regenerated certificate keeps the address it was first published at
ExposureA lookup returns only that order, and the full list is not enumerable
RepeatabilityThe same input produces the same output on a re-run
The rule that made the correction round cheap

Regeneration was written to reuse the existing address by default and mint a new one only for a genuinely new certificate. In the July round that split 54 in place against 9 new — which is the whole difference between a quiet fix and a second campaign.

What shipped

What produced each result

Produced the 99%

Matching on the key, and refusing to guess

The order number decides which certificate belongs to whom, so a typo can no longer mis-deliver one. Where the match is not confident the run stops and a person rules on it. Most of last year’s complaints were a name problem, and both changes attack the name problem directly.

Produced the 7 days → 3 hrs

Generation from the order record

The supplier batch stopped being the input. Certificates are rendered from the order data in a single unattended run, with the type sized to fit whatever name arrives, so no file is ever opened to be renamed.

Produced the 99%

The permanent address

Regeneration reuses the address by default. A name corrected after issue updates where the customer is already looking, so the correction never becomes a second outbound send.

Part two of two

How it was actually done

Three releases, twelve components, and a working reconstruction you can click.

!Before you open this

Everything above is the bottom line. If that is what you came for, you already have it.

What follows is the full working: 8 diagrams and 9 sections of working, the analysis behind each decision, and why it went that way instead of the obvious way. It is long on purpose. It is written to be checked, not skimmed.

Only wanted the overview? Stop here. You will not miss a single result — every number is already above this line.

← All work
Back to the portfolio
Also automation →
Retention system for a therapy practice