Best Practices for Oracle Applications Managing Data Changes

1
Best Practices for Oracle ApplicationsManaging
Data Changes

• Presented by Paul Brunskow

2
Agenda

• Introduction
• Logical Apps Overview
• Control Risks within Oracle ERP
• Logical Apps AppsRules Solutions for Managing
  Data Changes
• Product Demo
• Closing Questions

3
Company Profile

• Founded and Incorporated January, 2000
• Corporate Headquarters Irvine, California
• Employees 55
• Ownership Structure Privately Held
• Client Base Over 100 across industries
• Partnerships and Affiliations Oracle Certified
  Solutions Partner
• Growth Over 60 in 2004
• Profitability Profitable every year since
  inception
• 2005 Roadmap Risk Mitigation, Document
  Management, SAP Solution

4
Over 100 Clients . Across All Industries
5
Logical Apps Strategy Drivers

• Commitment to automate and enforce business
  policies and processes
• Commitment to provide out-of-the-box solutions
  that can be configured - not customized
• Commitment to expand solution set to include all
  control elements Documentation, Prevention,
  Detection

6
Logical Apps Strategy

• Current solution is focused on automated
  enforcement of controls in Oracle Applications
• Prevention vs Detection Approach
• Ensures controls are systemically enforced
• Future solutions will include
• Direct integration with Oracle ICM
• Support for additional ERP solutions

7
Industry Accolades
Logical Apps Recognized on Gartners Business
Rule Magic Quadrant!
Logical Apps recognized on the Software 500 List!
Who is Changing the Rules
Taming the Beast (pre-packaged software, ie.
Oracle Apps)
Improving Oracle Security
Apps Automates Financial Compliance Routines
8
Internal Controls within Oracle ERP

• The majority of organizations DO NOT have
  automated enforcement of their policies and
  procedures
• Compliance relies primarily on
• Standard security available
• Seeded processes
• Trained employees
• Ethical employee behavior
• Results in High Risk and High Costs

9
Automation of Controls - Options

• Customization
• Custom Development
• Custom Workflow Processes
• Create Responsibilities, Menus, Functions
• Customize Data Groups and Request Groups
• Logical Apps Solution
• Configured, Supported, Non-Intrusive Solution for
  Oracle Applications

10
Typical Procure to Pay Process
Change is happening everywhere. How is this
being managed?
Lack of systemic controls increases risk to the
organization!
11
Why CEOs CFOs Are So Concerned The Fear
Factor

• While the first waves of prosecutions and
  litigations are behind us, an honest, but
  disengaged and/or naïve executive may face a
  career-ending nightmare.
• Whistle Blower protection and prosecutions of
  lower level managers will make subordinates
  unlikely to remain silent or cover up wrong
  doing.

Ken Lay faces 175 years in prison and billions
of dollars in litigation. His defense is
ignorance" I didn't know.
12
Sarbanes-Oxley and Your Organization?
Internal Control Environment
13
Application Controls
Controls embedded in business process
applications, such as ERP systems and smaller
best of breed systems, are commonly referred to
as Application Controls. These include

• Authorizations
• Approvals
• Tolerance Levels
• Reconciliations
• Input Edits (Continuous Monitoring)

14
Challenges in a Vanilla Control Environment

• Authorizations
• Seeded Responsibilities have Segregation of
  Duties conflicts
• Master Application data is shared across multiple
  responsibilities
• Customers, Suppliers, Items, Key or Descriptive
  Flexfields
• Approvals
• Most updates to key data do not require approvals
• Credit Limits, Signing Limits, Employee
  Information

15
Challenges in a Vanilla Control Environment

• Tolerance Levels
• Validation is done by data type not the user
  entering information
• No set ranges for Credit Limits or Signing Limits
• Reconciliations
• Stuck Transactions are not routed to correct
  individual
• Various users update/change/delete data to make
  the system work
• Input Edits (Continuous Monitoring)
• No Clear audit history for data changes
• Can not see who changed data at the field level
• Can not validate that SoD policies have been
  followed

16
Oracle ERP Internal Control Resources
Phase 4 Reporting/Monitoring
Logical Apps Approva
Logical Apps 170Systems
Phase 3 Enforce Controls
Oracle ICM Auditor Tools Paisley
Phase 2 Compliance Mgmt
E Y Deloitte KPMG PwC
Phase 1 Identify Risks
17
AppsRules Product Suite
Software Solutions that Automate, Manage, and
Enforce Business Policies and Procedures

• Segregation of Duties
• Change Control and Tracking
• Authorizations / Approval Documentation

18
Solution Architecture

• AppsRules is directly and seamlessly integrated
  with Oracle Applications
• No extra instance is required
• No extra hardware is required
• No database links to maintain
• AppsRules fully leverages from the Oracle
  Architecture, is non-intrusive and fully
  supported by Oracle

19
Bundled Control Libraries

• Over 2500 Controls Bundled with AppsRules
• General Accounting (GL, AR, AP,FA, CM)
• Order-To-Cash (OE, AR, INV)
• Procure-To-Pay (PO, AP, INV, CO)
• System Administration (SA, AOL)

20
Automation of Application Controls
Automated Enforcement of Company Policies and
Procedures for Oracle Applications
21
Product Demo
22
Summary

• Change Control and Tracking
• Complete Audit Trail providing answers to
• WHO
• WHEN
• WHAT
• WHY
• WHO AUTHORIZED
• Preventive and Detective Controls

23
Contact Information

• To Request any Information please contact
• info_at_logicalapps.com
• Solution information, including white paper and
  product documentation may be downloaded from our
  website
• www.logicalapps.com

24
Closing Questions