Introducing Oracle Advanced Financial Controls Cloud Service

Copyright © 2016, Oracle and/or its affiliates. All rights reserved. |

Safe Harbor Statement

The following is intended to outline our general product direction. It is intended for information purposes only, and may not be incorporated into any contract. It is not a commitment to deliver any material, code, or functionality, and should not be relied upon in making purchasing decisions. The development, release, and timing of any features or functionality described for Oracle’s products remains at the sole discretion of Oracle.

2


Introducing Advanced Financial Controls to Audit Expenses and Accounts Payables CON7291

Dane Roberts Principal Product Strategy Manager Oracle Strategy, Risk Management Cloud Development Sep, 20 2016 || 5:15 || Moscone West 3005

Presented with


Agenda

Panelist Introductions

Risk Management Cloud & Advanced Financial Controls

Panelist Q&A

More Resources

1

2

3

4

4


• Stephen D’Arcy, Director, PWC LinkedIn – Responsible for the delivery of Oracle audit and advisory services around the

management of systems and process risks, including evaluating information technology and application-based controls; He has led multiple Oracle GRC Suite implementations in both Oracle EBS and PeopleSoft environments. Stephen also provides Oracle controls optimization services for clients with a focus on enhancing their investment in their Oracle product.

• Kent Spaulding, Software Architect, Oracle LinkedIn – Software engineer with expertise in identity management, distributed computing,

machine-learning, and object-oriented technologies on a variety of computing platforms The Java-based platform uses AI, Machine Learning, and Optimization techniques to reason about risk and compliance, and to detect fraudulent activities.

• Mark Stebelton, Dir Product Management, Oracle LinkedIn – 10+ years of experience in enterprise software development bringing quality enterprise

software applications to market. Extensive experience in interacting with industry specialists to define feature set functionality that addresses key market requirements.

5

Today’s Panelists

https://www.linkedin.com/in/stephen-d-arcy-0a66771

https://www.linkedin.com/in/kentspaulding

https://www.linkedin.com/in/mark-stebelton-cpa-cfe-45786


Agenda



Panelist Q&A

More Resources

1

3

4

6

2

Copyright © 2016, Oracle and/or its affiliates. All rights reserved. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. |

Effective Risk Management

7

Strengthen Internal Controls

Enforce Financial Reporting Integrity

Prevent Unauthorized

Access

Monitor Access to Sensitive

Data

Automate Detection of

Error, Fraud & Waste

CFOs & Controllers

CIOs & CISOs

Auditors RISK MANAGEMENT

CLOUD


Integrated Risk & Compliance

1

2

Streamline risk processes to promote collaboration, transparency and accountability

Early detection of potential issues through automated data collection and analysis

3 Rapid Deployment with Best Practice, Pre-built Controls designed for targeted risk areas

Risk & Compliance Management

Documentation Reviews Assessments Issues

Advanced Controls Monitoring

Audit Analytics User-Defined

Algorithms Visualization &

Simulation

Library of Best Practice Controls

Procure-to-Pay Transactions

Expense Policies

Assess (SoD) Rules

8


Roadmap

9

Advanced Access Controls

(R13) Restrict Unauthorized Access

& SoD Violations

Advanced Financial Controls

(R12) Protect Against Fraud, Error &

Policy Violations

Financial Reporting Compliance

(R11) Streamline Internal Controls Processes

Risk

Management Cloud


Advanced Financial Controls Cloud Service Protect Against Fraud, Error and Policy Violations

Manage Exceptions

Continuous Monitoring

Configure Best Practice Controls

Author New Audit Rules & Algorithms

10

Link Results to Business Risks Link Results to Business Risks

Stop High Risk Transactions Identical Expenses Split Purchase Orders Duplicate Invoices Unusual Invoice Amt. Unauthorized Spend Blocked Suppliers User Creates Supplier &

Pays invoice

Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | 11

Oracle Cloud Springboard with

AFC icons


Overview page Oracle Advanced

Controls

All automated Advanced Control are continuously monitored with up to date information across business processes and users, providing a real-time system of record to support audit, compliance and drive operational efficiency and effectiveness through advance controls monitoring.


Duplicate Invoices Entries Model Oracle Advanced Financial Controls

Advanced Financial Controls R12 is delivered with a set of high-value “models” that can be deployed directly as controls as well as configured and tailored specifically to your organizations requirements. On this page you can see a list of AFC transaction monitoring models and their associated “results count”.


Duplicate Invoices Entries Model

1 of 6

Here is the model configuration page - or workbench – for creating and configuring models that may become formalized as Controls.



2 of 6

The basic components of a Model are displayed here:

1. Name and Description 2. Business Objects (out of the

box and user defined) 3. Model Logic: 4. Result display & attributes



3 of 6

Model Logic: • Standard Filters • Functions • Patterns



4 of 6

Advanced filter options, help to tightly define logic constraints and can also minimize or eliminate false positives results. For instance this advance filter option is ‘date-based’ which not only allows you to specify an exact or a relative date range but to also focus on (or eliminate) certain days of the week and time of day.


Results Overview

View Incidents

Here we can see a secure role-based Overview of Controls and Incidents as well as a workflow of results in the Worklist. Seen here are: •When the Overview page and contents were last refreshed •Number of Pending Incidents and whether they are assigned and remediated •Pending Incidents by Priority •Worklist that list Controls that require Investigation of Results


View Incidents 1 of 2

Navigating to the Results by Control Summary Tab (shown on the left) you can see • Each control •When it was last run •Pending Results Count by control

Select the Pending Results Count to see a listing of incidents by control.


View Incidents 2 of 2

Now we can see specific transactions that were identified as Incidents along with the transaction attributes, fields or properties that we selected to be displayed as part of the model / control design. Some highlights on this page include: •Invoice ID and Number •Invoice Date •Invoice Amount •Supplier Name (not pictured) •Whether the Incident is assigned for further investigation


View Incident Report

AFC comes with pre-defined reports. Result Reports: •Result Summary Extract •Result by Control Summary Extract Control Reports: •Control Detail Extract Here is the Excel formatted file for the Transaction Incident Detail Extract that can be printed and saved for supporting audit evidence and distribution.


DEMOgrounds: Moscone West Level 3 Lobby (M,T,W) ERP Showcase

Workstation WEP-020


Agenda



Panelist Q&A

More Resources

1

2

3

4

24


Panelists Q&A

1. What common activities or use cases do we recommend?

25


Panelists Q&A

2. How can transaction monitoring prevent Errors and Stop Financial Leakage?

26


Areas of High Risk in the PTP process

• Vendor Master File Maintenance

– “The Keys to the Door to the Money”

– Emphasis on having W-9 or equivalent for US Vendors (W-8 for Intl)

• Managing & Processing Vendor Invoices – Includes: timeliness of entering invoices, invoice number ‘Style Guides’, price

differences, copies v originals, routing invoices, Remittance Advice

Source: Institute of Financial Management


Panelists Q&A

3. How does advanced transaction monitoring help with controlling business processes?

28


Panelists Q&A

4. How does advanced transaction monitoring help with monitoring users access?

29


Panelists Q&A

5. What are some Key Metrics that you track with transaction monitoring?

30


Sample Metrics • Productivity – how are you spending resources today?

– Time spend responding to requests for new scripts, reports

– Time spent analyzing and interpreting the output

– Number of hours remediation incidents

• Control Violations by Process & Activity

– Number of Expense Report Violations, double claims for same expense

– Payment Errors - Total Value of Incidents

• Root Cause Metrics – Duplicate entries

– Duplicate suppliers in Master Data

– Missing data (e.g., W-9, remittance information, etc.)

31


Panelists Q&A

6. How is AFC more efficient that other BI reports and systems?

32


Incident Life Cycle

• AFC incidents can be in closed status in three ways:

– By resolving the issue in ERP Cloud and setting the incident status to “Resolved”

– If a filter is part of the control, then it will trigger a system close during the next control run, if the status is modified in ERP Cloud

– If a control is inactivated

Example:

1. The “InFusion: Back Dated PO” control logic includes a filter “Invoices not Cancelled”

2. Control analysis has detected Invoice Id: XYZ as an incident

3. As part of remediation, user cancels Invoice XYZ in Financial Cloud

4. During a subsequent control analysis run the system will find an existing incident for the Invoice Id XYZ, and the incident will automatically be closed.


Incident Process Flow

SYSTEM

SYSTEM

SYSTEM

INGEST JOB GRAPH

CONTROLS LOGIC

INCIDENTS

INVESTIGATOR

ERP CLOUD USER FIXES ISSUE

Example: Cancels duplicate payment

ENGINE AUTOMATICALLY CLOSES INCIDENT(S)


Panelists Q&A

7. Can you give us more information on the technology behind AFC and what ‘skill set’ is required to design AFC Controls and Models?

36


Pareto Analysis

Clustering

Fuzzy Matching

Anomaly detection

Automate Data Analysis to Detect Issues Early

Confidential – Oracle Internal/Restricted/Highly Restricted

Security & Transaction Data

Enterprise Data Graph

GR

C O

nto

logy B

ased Po

licy Engin

e

Seman

tic Reaso

nin

g Pattern

Reaso

nin

g

Data Analysis Engine

Grap

hical A

uth

orin

g Wo

rkben

ch

Library o

f User D

efined

Co

ntro

ls

Incidents

SELF-LEARNING FEEDBACK LOOP

37

Benford Analysis

Algorithms Workbench


Procure-to-Pay

• ID Duplicate Invoice Entries

• ID Duplicate Supplier Sites

• ID Back-Dated PO's

• ID high amnt, unpaid Invoices by Supplier

• ID 'one-time-use' supplier; >1 invoices

• ID first time invoices for Suppliers

• ID Invoices from Suppliers on 'watch-lists'

• ID Suppliers & Invoices created by same user

Expense Reporting

• Meals over limit

• Meals & per-diem same day

• Employees frequently missing receipts

• Duplicate expense across reports

• Credit payments claimed as cash pymnts

• Same meal claimed >1 by diff employees

• Split large expense item to get under limit

• Expenses for watch list items or vendors

38

Sample Controls, Rapid ROI


• Expense Entertainment Policy Expense Meals Policy

• Expense Mileage Policy

• Expense Miscellaneous Policy

• Expense Report Attendees

• Expense Report Credit Card Transactions

• Expense Report Credit Cards

• Expense Report Details

• Expense Report Information

• Expense Report Template

• Payables Invoice

• Payables Invoice Batches

• Payables Invoice Details

• Payables Invoice Hold Codes

• Payables Payment Schedule

• Payables Payment Term

• Payables Procurement Card

• Payables Setup: General

• Payables Setup: Invoices

• Payables Setup: Payments

39

Sample Business Objects, Rapid Implementation


• Payment

• Payment Card

• Payment Instruments

• Purchase Order

• Purchasing Approved Supplier

• Purchasing Approved Supplier List Statuses

• Requisition

• User

• Person

• Supplier

• Supplier Site Location

• External Bank Account

• Business (Operating) Unit

40

Sample Business Objects, Rapid Implementation


Panelists Q&A

8. Who owns the control and what is your process for remediating incidents?

41


Panelists Q&A

8. Who owns the control and what is your process for remediating incidents?

42

Management Controls

Internal Control Measures

Process Owners

Financial Controller

Security

Risk Management

Quality

Inspection

Compliance

Internal Audit

SENIOR MANAGEMENT

GOVERNING BODY / AUDIT COMMITTEE

• Owns and Manages Risk • Responsible for Creating,

Operating and Maintaining System of Internal Controls

• Oversees & Monitors Risk and assists Management in the design of controls

• Limited independence from operating management

• Provides Independent Assurance

• Reports to Governing Body

Solution Management Internal Controls Governance Internal Audit

REG

ULATO

R

INTER

NA

L AU

DIT

1st Line of Defense 2nd Line of Defense 3rd Line of Defense


Panelists Q&A

9. Can you think of an event or project where new or updated transaction monitors where deployed?

43


Panelists Q&A

10. What are the best practices considerations for organizations that may not have used this type of solution?

44


Thursday PANEL SESSION Sep 22, 9:30 AM – 10:15 AM| Moscone West 3005

Implement the Best Practice for Oracle Fusion Advanced Financial Controls Cloud Service [CAS7286]

Swarnali Bag, Governance, Risk & Compliance Practice Lead, Oracle Barry Greenhut, Director, Product Strategy, Oracle Christine Doxey, Owner or Partner, “Doxey, Inc” Lakshmi Rajamohan, Principal Product Strategy Manager, Oracle Mark Stebelton, Director, Product Management, Oracle This session provides a detailed walkthrough of Oracle Fusion Financial Controls Cloud Service from an end user’s perspective, and highlights how the product can be configured to automate best practice controls. Oracle Fusion Advanced Financial Controls Cloud Service is designed to meet the common needs of Oracle Financials Cloud subscribers. Based on learning from a decade of customer experience, this session showcases Oracle’s best practice business process for maximum ROI with minimum cost of ongoing operation.

45


Selecting Controls

• Select controls that have failed during past audit cycles

• If you are using Financial Reporting Compliance

– Identify from your documented controls, which high-risk payables and expenses controls you would like to automate that can be leveraged from the pre-built AFC controls

• If you are not using Financial Reporting Compliance

– Identify from your list of internal controls library, which high-risk payables and expenses controls you would like to automate that can be leveraged from the pre-built AFC controls

46


Advanced Financial Controls Best Practice Solution Methodology

Configure

Use

47

Review Incidents Remediate

issues

Review Incident Reports

Reassess controls

Gather configuration data

Configure Pre-built Models

Test and Refine

Models

Deploy Advanced Controls


Best Practice Solution: Implementation Outline

48

Admin

Internal Auditor

Business Analyst

Process Owner

1. Gather configuration

data

2. Configure AFC (general, roles,

users)

3. Import Pre-built Models

4. Test & Refine

Models

5. Review Results &

Remediate

6. Define Advanced Controls

7. Schedule Sync & Control Analysis

8. Review Incidents & Remediate

9. Review Incident Reports


Agenda



Panelist Q&A

More Resources

1

2

3

4

49


Risk Management Cloud Customers

….and more!

50


Go-To Partners

Success requires experience and expertise

– get both from our Go-To Partners:

• Guide process owners & participants

through adoption of Best Practice Processes

• Configure software for effective long-term

success: Minimum cost of operation,

Maximum flexibility to adapt to change

To learn more and get connected, contact

your Oracle Success Manager

Current Go-To Partners: KPMG USA, Oracle Consulting USA, FulcrumWay, OneGlobe, PricewaterhouseCoopers USA

51

mailto:[email protected]


For subscribers and partners

To Learn More

Cloud Portal Release Readiness User Documentation Modern Best Practice

Oracle University Success Managers Get Started Customer Connect

52

https://cloud.oracle.com/risk-management-cloud

https://cloud.oracle.com/en_US/saasreadiness/erp?readinessRID=1445273094171

http://docs.oracle.com/cloud/latest/riskcs_gs/docs.htm

http://modernbestpractice.com/

http://education.oracle.com/pls/web_prod-plq-dad/db_pages.getpage?page_id=225

https://www.oracle.com/cloud/customer-success-managers.html

https://support.oracle.com/cloud/faces/DocumentDisplay?_afrLoop=299159892333731&_afrWindowMode=0&id=2120557.1&_adf.ctrl-state=12knj1gdd6_4

https://appsconnect.oracle.com/resources/081926cc0a/summary

Copyright © 2016, Oracle and/or its affiliates. All rights reserved. Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | 53 53

Join our LinkedIn Group For the latest Updates and Presentations .


Tuesday GENERAL SESSION Sep 20, 12:15 PM – 1:00PM | Moscone West 3005

Oracle Risk Management Cloud – Strategy Roadmap [GEN7198]

Sid Sinha, Head of Product, Oracle Risk Management Cloud Corey West, Oracle EVP Corporate Controller and Chief Accounting Officer, Oracle Brian Jensen, Director, KPMG LLP Timothy Reese, Pennsylvania State Treasurer, Commonwealth of Pennsylvania This general session provides the latest update on the product strategy, release roadmap, and best practices for Oracle Risk Management Cloud.

PANEL SESSION Sep 20, 4:00 PM – 4:45 PM | Moscone West 3005

Introducing Oracle Financial Reporting Compliance Cloud (Risk Cloud) [CON7293]

Aman Desouza, Director, Risk Cloud Strategy, Oracle Adil Khan, Managing Director, FulcrumWay, Michael Mann, Director, Caesars Entertainment This session provides an overview of Oracle Financial Reporting Compliance Cloud and how it automates certifications, assessments, and related manual tasks for regulations such as Sarbanes-Oxley Act. It includes a guided tour of the product, the features and benefits, and describes how audit teams can transform compliance with automation using this unique risk management service.

PANEL SESSION Sep 20, 5:15 PM = 6:00 PM | Moscone West 3005

Introducing Advanced Financial Controls to Audit Expenses & Accounts Payable [CON7291]

Kent Spaulding, Software Architect, Oracle Dane Roberts, Principal Product Strategy Manager, Oracle Mark Stebelton, Director, Product Management, Oracle Stephen D’Arcy, Director, PwC This session provides an overview of Oracle Fusion Advanced Financial Controls Cloud Service to continuously audit expenses, accounts payable, and other sensitive financial transactions. It includes a product tour, features and benefits and shows how expense managers, controllers, and auditors can use advanced data analysis to prevent fraud and error and ensure compliance with policy .

54


Wednesday CUSTOMER CASE STUDY Sep 21, 11:00 AM – 11:45 AM| Moscone West 3005

Securing ERP: Application Compliance and Controls Implementation [CAS7689]

Gautham Ramkumar: Director, Advisory Services, KMPG LLP Chuck Devore, Director, Finance Transformation, ADM Kenneth Kobia, Risk & Controls Lead, Archer Daniels Midland Organizations have successfully transformed their business operations by leveraging Oracle ERP technologies. Yet they continue to struggle to balance the two divergent needs of empowering ERP business users, while protecting sensitive data and transactions. In this session KPMG and Archer Daniels Midland detail how they took advantage of Oracle’s ERP security and controls capabilities, to support ADM’s initiative to deploy Oracle ERP .

PANEL SEESION Sep 21, 1:30 PM – 2:15PM | Moscone West 3005

Introducing Oracle Fusion Advanced Access Controls to Strengthen Security [CON7290]

Katrina Johnson, VP Risk Assurance, Service Corp International Nicholas Seeman, Director, Advisory Services, KMPG LLP Barry Greenhut, Director, Product Strategy, Oracle Mark Stebelton, Director, Product Management, Oracle This session provides an overview of Oracle Fusion Advanced Access Controls to continuously detect segregation of duties violations, manage exceptions, and fix unauthorized access to sensitive functions and data. Compliance managers and auditors can use Oracle Fusion Advanced Access Controls to ensure strong access controls across ERP, HCM and SCM cloud applications.


Implement the Best Practice for Oracle Financial Reporting Compliance Cloud [CON7291]

Swarnali Bag, Governance, Risk & Compliance Practice Lead, Oracle Barry Greenhut, Director, Product Strategy , Oracle Lakshmi Rajamohan, Principal Product Strategy Mgr., Oracle Mark Stebelton, Director, Product Management, Oracle This session provides a more detailed walkthrough of Oracle Financial Reporting Compliance from an end user’s perspective, and highlights how the product can be configured to automate the best practice process. Based on learning from a decade of customer experience, it showcases the shortest and most cost-effective path to go live and streamline operations.

55


Thursday PANEL SESSION Sep 22, 9:30 AM – 10:15 AM| Moscone West 3005

Implement the Best Practice for Oracle Fusion Advanced Financial Controls Cloud Service [CAS7286]

Swarnali Bag, Governance, Risk & Compliance Practice Lead, Oracle Barry Greenhut, Director, Product Strategy, Oracle Christine Doxey, Owner or Partner, “Doxey, Inc” Lakshmi Rajamohan, Principal Product Strategy Manager, Oracle Mark Stebelton, Director, Product Management, Oracle This session provides a detailed walkthrough of Oracle Fusion Financial Controls Cloud Service from an end user’s perspective, and highlights how the product can be configured to automate best practice controls. Oracle Fusion Advanced Financial Controls Cloud Service is designed to meet the common needs of Oracle Financials Cloud subscribers. Based on learning from a decade of customer experience, this session showcases Oracle’s best practice business process for maximum ROI with minimum cost of ongoing operation.


Get Started with Financial Reporting Compliance and Advanced Financial Controls [CON7284]

Barry Greenhut, Director, Product Strategy, Oracle Lakshmi Rajamohan, Principal Product Strategy Manager, Oracle Joel Alvarado, Customer Success Manager, Oracle This session provides you with the most effective project plan to implement Oracle Financial Reporting Compliance or Oracle Fusion Advanced Financial Controls Cloud Service. Participants will learn the shortest and most cost-effective path to success using Oracle’s customer and partner-tested “get started” process. Learn how to plan and adopt these cloud services, and then sustain your use through growth and change. Learn how to get the experience and expertise needed to succeed.

56

Introducing Oracle Advanced Financial Controls Cloud Service

Business

Transcript of Introducing Oracle Advanced Financial Controls Cloud Service