Automating Internal Controls for Oracle

1
Automating Internal Controls for Oracles
E-business Suite Steve Quinton CPA, CISA
Sales Engineer squinton_at_applimation.c
om
2
Applimation Overview
IT Controls Compliance
Company Background
Data Growth Mgmt

• Application Archiving
• Database Subsetting

• Change Management
• SOX Compliance
• Segregation of Duties
• Security Reporting

• Headquartered in NYC
• 300 Customers
• 70 Employees
• Investors JMI Equity Fund Battery Ventures

3
Applimation Lifecycle Management

• Informia ArchiveData archiving and optional
  Reorg and ILM integration for enterprise and
  custom applications
• Informia SubsetCreate smaller, faster, resized
  instances from a copy of your production database

• Integra AppsMonitor, compare, and document
  business rules and configurations
• Integra CodebaseComprehensive, intelligent
  comparison and control of code and objects
• Integra Access View and compare application
  roles and access privileges
• Integra TransactionContinuously monitor key
  accounts and transactions
• Integra FormsProvide field-level validation and
  security without customizing

4
300 Applimation Customers Worldwide
5
Automating Internal Controls for Oracles
E-business Suite

• with Applimation Integra

6
Sarbanes-Oxley Cycles
YEAR 2, 3, 4 TEST ENFORCE Controls Applimatio
n Integra Continuous Monitoring
YEAR 1 DOCUMENT Processes, Risks Controls
7
All Controls are Not the Same

• Prevent Controls
• STOP a transaction or change from occurring
• Detect Controls
• Alert when a sensitive or material transaction or
  change occurs
• Monitoring Controls
• Capture information for a subsequent review.
  This level of reporting is very effective in
  providing information for auditors performing
  quarterly tests of controls.

8
Integra for Controls

• General IT Controls
• Access (Security) controls
• Change management controls
• Application Controls
• Embedded application controls
• Embedded operation controls

• INTEGRA
• Access, Forms
• Apps, Codebase
• Apps, Transaction
• Apps, Transaction

9
Integra - Applied
Sarbanes-Oxley compliance for Section 404
internal controls report
Leading Accounting firms adopt Integra as
standard tool for audits of Oracle
Version control for 11i upgrade and on-going
maintenance
10
Continuous Monitoring in Oracle Applications
Applimation Integra
KEY CONTROLS TRANSACTIONS
CONTINUOUSMONITORING
PREVENTION
Transactions
Oracle Applications environment
Integra Forms
Integra Transaction
Security
Integra Access
Setups
Integra Apps
Code
Integra Codebase
DATABASE
OPERATING SYSTEM
11
Integra Access

• Evaluate User Access Test Segregation of Duties

12
Integra Access Functionality Overview

• Evaluate User Access
• Search by User
• Search by Form/Function

User

• TEST Segregation of Duties
• Identify incompatible Functions Forms

13
Integra Apps

• Continuous monitoring within Oracle

14
Integra Apps Codebase
Integra Apps Setups InstancesSets of
BooksOperating UnitsVersions MonitoringReportin
gAlerting Application Setups
Automated Documentation Comparisons Change
Tracking Migration
Integra Codebase FormsReportsCode EnvironmentsO
racle VersionsCode Versions MonitoringReporting
Alerting Code Promotion
15
Examples of Setups and Key Controls

• Key Controls
• 3-way matching of PO, Invoice and Receipt
• Document spending limits (authorization of PO)
• Security rules access to sensitive transactions
• Employee salaries
• Chart of account values
• Financial statement reports (FSGs)
• Price lists
• Inventory attributes
• Action for late delivery of goods
• Inventory stocking rules
• Rules to create tax on sales orders
• Depreciation methods

• Setup Data
• Application Security
• Document Approvals
• Chart of Accounts
• Profile Options
• Users
• Application Setups
• MRP rules
• Operational Data
• Customers
• Suppliers
• Employees
• Buyers
• Items
• Chart of Account Values
• Category Codes

Setups Key Controls
16
Tough Questions in Oracle

• How do you know key controls are operating
  effectively throughout year?
• Can you report on ALL changes to key controls?
• How do you search for segregation of duties or
  evaluate user access?
• How do you know controls are same for each
  business unit?
• How do you document key controls within systems?