ERP / HCM Cloud allows users to delegate their workflow approval authority to others. This can be permanent or on a temporary basis, referred to as Vacation Rules. In this video, we will present the four ways Users and an Admin can set workflow delegation rules and the challenges organizations face in implementing their policies in this area.
In this video we will talk about how to properly security Audit Policy configurations. The ability to maintain Audit Policies can be found in three seeded roles as of patch level 20B. It is critical that none of these roles be assigned to anyone in Production in order to properly secure your Audit Policies. If they are assigned in Production to a user(s) that is (are) not authorized to make changes to Audit Policies, lookback procedures should be performed.
In working with our customers on Oracle ERP Cloud projects we have been working hard to enter Service Requests, get Enhancement Requests, and post ideas in the Ideas Lab. The goal is to identify key issues, get consensus with our customers, and drive enhancements before many of our customers enter the end of year external audit.
ERP Cloud allows you to delete a User, even after the account has been used to enter or modify data. In this video, we will explore the impact on the Audit Trail of deleting such as User.
Password controls 101… when setting up a new user or resetting a password for an existing user, the system does NOT require the User to change their password. This is either a bug or a major design flaw. When a user is set up or a password changed by a help desk user or security administrator, typically they provide that password to the user. The user, when logging in, normally MUST change their password. This would be considered a best practice in the design.
Perhaps the most important control organizations implement is the control related to the review and approval of journal entries. Most organizations using ERP Cloud implement the journal approval workflow to help automate the control. The proper configuration of Journal Sources is essential to the design of your controls related to Journal Entries.
Oracle allows some roles to assigned to a User to be delegated to another user without having to go through the approval process. This would allow an assignment of a role that all organizations would require approval for as part of their ITGCs. In this video, we will demonstrate how this is done, how to test for its existence, and how to prevent it from happening in your environment.
All organizations running ERP Cloud should be concerned about fraud. The Association of Certified Fraud Examiners’ 2018 Report to the Nation identifies that 89% of fraud is misappropriation of assets such as fraudulent disbursements. Check and payment tampering represent 12% of all fraud and averages $150,000 per incident. Lack of internal controls, override of existing controls, or lack of management review represents 69% of asset misappropriate fraud cases. Fraud is committed by Managers and Staff Employees in 78% of cases.
Greeley, Colorado, April 9, 2020 – The heart of ERP Armor is the identification and management of risk in a customer’s ERP Solution. ERP Armor blends a proven ERP Risk Architecture with ERP Risk Content developed over 20 years. In 2019 we introduced ERP Armor as a set of rules, Segregation of Duties and Sensitive Access, for assessing risk in an ERP system. We now refer to them as ERP Armor: Rules and today we are introducing ERP Armor: Roles. The Rules and Roles are licensed separately.
The SI industry is stacked against a ‘complete and secure’ ERP implementation? SIs don’t win bids by providing a scope that includes controls and role design. Very little, if any, customization of roles is included in the implementation project plan. Often controls design only happens around the time of UAT, leaving too little time to change business processes if they need to be changed to support controls. After going live, organizations are left with these challenges: