using oracle grc software to automate and proactively monitor your e business suite
DESCRIPTION
An overview of the Oracle GRC software suite.TRANSCRIPT
Using Oracle’s GRC Software Suite to automate
and proactively monitor your E-Business Suite
Session 9333
Introduction•Brad Storts, AXIA Consulting (
[email protected])•Client: a utility company in the Midwest
•Better controls over the Oracle E-business suite•A tool to manage Sox compliance
•Solution: Oracle GRC software suite
Agenda•GRC controls suite
•Preventative Controls Governor (PCG)•Access Controls Governor (ACG)•Transaction Controls Governor (TCG)•Configuration Controls Governor (CCG)
•GRC Manager / Intelligence
Preventative Controls Governor•Tool to control user viewing and changing of E-Business suite
(EBS) data •Application is embedded in your EBS as a custom application
oNo hardware requiredoHigher risk of adversely impacting your key processing
•Three types of rulesoForm rules: interact directly with an EBS java formoFlow rules: fired from a database trigger or a periodic
scheduleoAudit or change control rules: triggered by EBS table
changes
Form / Flow ControlAudit Track changes in values for the 10 segments of the GL accounting flexfieldForm Prevent a receipt against a 2-Way PO line (will exclude purchase orders created before 8/21/2011)Form Prevention when a PO has a distribution line with a General Ledger liability account Form Prevention when a PO has a distribution line to an asset GL account (1010000 to 1219999) but no project and taskForm Force a a 2-Way PO for services to have a price of $1)Flow Notification when a non-stock PO is closed with remaining dollarsFlow Notification to requisitioner when 80% of a services purchase order total is reachedFlow Notification for unabalanced journals posted during month end closingFlow Notification of HR location changesFlow Department or employee group (union / management) quarterly report on changes Form Hide social security number for HR inquiry users Flow Notification of new supervisors to HRFlow Notification on projects where actual costs are approaching budgeted costsFlow Notification on Missed Payment DiscountsFlow PO terms differ from vendor termsFlow Alert AP when max ship on hold is released as more money added to purchase orderFlow AFUDC Flag set incorrectly for ProjectsForm Stop User from matching a Receipt against a PO they created or approvedFlow Notify WAM Help Desk if purchasing category is created or changedForm Provide form validation new employees missing schedule or rotation plan, earning policy, payroll in OTL based on employee categoryAudit Audit report on certain supplier changesFlow Payment terms changed on an invoice from what was on POFlow Notification to requisitioner when non stock item received
Form rule example
Triggering a flow rule
Sql check for flow rule processing
Flow rule notification
Flow rule notificationFlow rule notification
Preventative Controls Governor Lessons Learned•Requires custom.pll updates – form rules only impact java
forms not HTML•Documentation references applcust.txt, ignore (not used in
R12)•Create a browse only PCG responsibility to be able to browse
rules•Cloning environments works, you just need to add additional
steps to be able to migrate rule changes•When migrating rules, you have to recompile triggers and
re-enter periodic rules as well as audit rules•Watch out for triggers based on dates, triggers may not
handle nulls correctly
Access Controls Governor•Evaluates Oracle access and can prevent or monitor policy
violations•Runs on separate hardware using Oracle Data Integrator to
pull information from the EBS about users, responsibilities, menus, and functions
•Incidents are created and tracked to resolution
Access Controls Governor - Benefits• Moved from manual process to automated process to check for
segregation of duties violations• We found responsibilities that needed changed• We found some users with access they didn’t need• A lot of work on the initial setup and cleanup of false positives,
but very little work to maintain after that
You can visualize the paths, from the user through the responsibility through the menus to the functions that cause the segregation of duties conflict.
Entitlements: elements within the EBS that allow a certain function
Create controls that prevent or monitor uses that have segregation of duties conflicts due to their entitlements:
Access Global Conditions: allow you to turn off certain conditions to remove false positives
Access Path Conditions
Access incidents
Access Controls implementation• Lots of initial work to weed out many false positive
oSystem accounts show up with lots of violationsoSome responsibilities do not really allow function
Some screens allow browse onlyReceiving: organizations not defined
oCleanup can also be time consuming to review all the incidents and try to figure out what the proper course of action is
Access Controls Governor lessons learned• Default is to evaluate access based on email note that several
users can share an email address and can cause lots of confusion so you should change to email + user id (our example: IT support staff id’s created from existing users)
• The ability to forecast conflicts is limited: you can see the impact of modifying a responsibility or menu, but you can’t see the potential impact of giving a responsibility to a user (which is much more common in my opinion)
Transaction Controls Governor• Review EBS transactions to highlight potential issues (fraud, bad
data, policy violations, etc.)oReview manual journal entries posted during certain times of
the monthoReview employee expensesoReview duplicate invoices
Easily create a new model
Easily add filters to fine tune results:
Results of transaction model run for journals entered manually over a certain dollar limit:
Employee Expense Accelerator• Free content / software from Oracle• Requirements:
•Run TCG 8.6.3.4000•EBS: iExpense•Deploy some tables and views on your EBS
Sample models included in Employee Expense Accelerator • Employee Claims Per Diem and Meals • Employees misses receipts consistently indicating Fraud• Employees with large number of round dollar amounts close to the
approval limits• Employees split expenses for a large event • Single or multiple employees submit the same receipt more than one
time• Hotel Expenses without other travel related expenses• Employees delinquent frequently• Employee Expenses Spike • Department Expenses Spike
Transaction Controls Governor review• Good for detective controls, not preventive since you are alerted after
the fact• Designed for non IT personnel to be able to use• Note objects have been developed for some EBS subject areas, but
certainly not all (we ended up using PCG often where content was missing for TCG)
Configuration Controls Governor• Application that monitors changes to key setup values• Compare snapshots of setups from one point in time to another, or
between instances
Configuration Controls Governor Examples Purchasing
•Purchasing options•Receiving options
Accounts Payable•Invoice Payment Terms•Invoice Tolerance levels•Payables Controls Options•Payables system setup
Here a user changes the receiving tolerance in EBS
The CCG user receives a notification that a key setup has been modified via email:
The user can log into CCG and see who made the change, when, what the old value was:
CCG Snapshot: easily create a snapshot of your EBS, and then compare to another instance or to another point in time:
CCG Lessons Learned•Another detective control tool, will not prevent entry•Connecting to a data source takes about 1-2 hours, and every
time you refresh an instance you have to reconnect•No good way to clone / refresh from production to test•Snapshots can run for a long time, and consume lots of EBS
resources – and can be tricky to cancel (terminate button doesn’t show up until you kill the process in EBS)
GRC Manager •Tool to document your business processes, risks associated
with those processes, and controls to mitigate those risks•Designed to manage SOX compliance, or any similar
compliance requirements•Completely separate application from EBS•GRC Intelligence is the reporting solution, using Oracle
Business Intelligence to extract data from GRC Manager
Control Testing
Can create and manage simple surveys:
Can track issues:
GRCI: OBIEE tool to analyze data
GRC Manager and GRC Intelligence• We implemented GRCM 7.8 and GRCI 2.0, there is a new GRC
Manager (“Fusion Edition”) which you would want to review – there is no upgrade path for GRCM 7.8
• GRCM 7.8 is built on Stellent Content Management, GRCI 2.0 is built on OBIEE – a steep learning curve if your organization doesn’t already use these