ARMI - KN

Despite having been in the Oracle applications space for over 20 years it is still a mystery to me what external auditors do or don’t do in their audit.  Recently on vacation I ran into an IT auditor from a big four firm who specializes in SAP.  I took the opportunity to help me better understand if there were differences in how they audited various ERP systems.  In most ERP systems there are security objects (T-Codes for SAP, privileges for ERP Cloud, Functions for E-Business Suite) that allow a user to bypass workflow approval processes.   If an organization is relying on workflow processes, yet someone can enter a transaction or maintain master data that bypasses the workflow, the IT application control (ITAC) design may not be deemed to be reliable.  For example, if the system has been configured to have all purchase orders (PO) go through a workflow approval process, yet an IT user or end user could upload an approved PO (that isn’t subject to the workflow approval process), then that user would have the ability to bypass the design of the ITAC – effectively undermining the ITAC design.  The same can be true for journal entries, requisitions, suppliers, supplier bank accounts, orders, invoices, etc.

UK Police Department using ERP Cloud given “Significant Deficiency” by Grant Thornton partially due to “Segregation of Duties” issues and system accounts.

ERP / HCM Cloud allows users to delegate their workflow approval authority to others. This can be permanent or on a temporary basis, referred to as Vacation Rules. In this video, we will present the four ways Users and an Admin can set workflow delegation rules and the challenges organizations face in implementing their policies in this area.

In this video we will talk about how to properly security Audit Policy configurations. The ability to maintain Audit Policies can be found in three seeded roles as of patch level 20B. It is critical that none of these roles be assigned to anyone in Production in order to properly secure your Audit Policies. If they are assigned in Production to a user(s) that is (are) not authorized to make changes to Audit Policies, lookback procedures should be performed.

In working with our customers on Oracle ERP Cloud projects we have been working hard to enter Service Requests, get Enhancement Requests, and post ideas in the Ideas Lab.  The goal is to identify key issues, get consensus with our customers, and drive enhancements before many of our customers enter the end of year external audit.

ERP Cloud allows you to delete a User, even after the account has been used to enter or modify data. In this video, we will explore the impact on the Audit Trail of deleting such as User.

Greeley, Colorado, May 21, 2020 – Today, we are introducing ERP Armor: Reports. The heart of ERP Armor is the identification and management of risk in a customer’s ERP Solution. ERP Armor blends a proven ERP Risk Architecture with ERP Risk Content developed over 20 years. In 2019 we introduced ERP Armor as a set of rules, Segregation of Duties and Sensitive Access, for assessing risk in an ERP system. We now refer to our products as ERP Armor: Rules, ERP Armor: Roles, and ERP Armor: Reports.  Although they are a family of products, Rules, Roles, and Reports are licensed separately.

Password controls 101… when setting up a new user or resetting a password for an existing user, the system does NOT require the User to change their password.  This is either a bug or a major design flaw.  When a user is set up or a password changed by a help desk user or security administrator, typically they provide that password to the user.  The user, when logging in, normally MUST change their password.  This would be considered a best practice in the design.

Perhaps the most important control organizations implement is the control related to the review and approval of journal entries.  Most organizations using ERP Cloud implement the journal approval workflow to help automate the control.  The proper configuration of Journal Sources is essential to the design of your controls related to Journal Entries.

Oracle allows some roles to assigned to a User to be delegated to another user without having to go through the approval process.  This would allow an assignment of a role that all organizations would require approval for as part of their ITGCs.  In this video, we will demonstrate how this is done, how to test for its existence, and how to prevent it from happening in your environment.