Auditable Units

Overview

Copyright © Oracle Corporation, 2007. All rights reserved.

Auditable Units 400912495.doc

Effective 06/28/04 Page 1 of 20 Rev 1
Auditable Units
System References
None

Distribution
R12 Oracle Internal Controls Manager Fundamentals

Ownership
The Job Title [list@YourCompany.com?Subject=EDUxxxxx] is responsible for ensuring that this
document is necessary and that it reflects actual practice.

Copyright © Oracle Corporation, 2007. All rights reserved.

Auditable Units 400912495.doc

Effective 06/28/04 Page 2 of 20 Rev 1
Auditable Units

Copyright © Oracle Corporation, 2007. All rights reserved.

Auditable Units 400912495.doc

Effective 06/28/04 Page 3 of 20 Rev 1
Objectives

Copyright © Oracle Corporation, 2007. All rights reserved.

Auditable Units 400912495.doc

Effective 06/28/04 Page 4 of 20 Rev 1
Agenda

Copyright © Oracle Corporation, 2007. All rights reserved.

Auditable Units 400912495.doc

Effective 06/28/04 Page 5 of 20 Rev 1
OICM Business Flow

Copyright © Oracle Corporation, 2007. All rights reserved.

Auditable Units 400912495.doc

Effective 06/28/04 Page 6 of 20 Rev 1
Organizations and Auditable Units

Organizations and Auditable Units

Set up Auditable Units in Oracle Human Resources
(N) Work Structures > Organizations > Description form

Copyright © Oracle Corporation, 2007. All rights reserved.

Auditable Units 400912495.doc

Effective 06/28/04 Page 7 of 20 Rev 1
Agenda

Copyright © Oracle Corporation, 2007. All rights reserved.

Auditable Units 400912495.doc

Effective 06/28/04 Page 8 of 20 Rev 1
Setup Auditable Units

Set Up Auditable Units

It is important to note that the Auditable Unit goes beyond the concept of a subsidiary. In the
Organization window, your organization (that is now an Auditable Unit) can also be set up with
any other classification like an "Inventory Organization" or a "Legal Entity."
As an example, if you are investigating the internal controls of inventory organizations in your
enterprise, then each of these inventory organizations must also be tagged as an Auditable Unit
and associated with a subsidiary. You can have several organizations like Inventory
Organizations under the same subsidiary. Each of these Auditable Units will also be linked to
this subsidiary.
On the other hand, assume your domain of interest is a Legal Entity that spans multiple
subsidiaries. In this case you need to set up multiple Auditable Units, with one Auditable Unit
for each subsidiary. Each of these Auditable Units will also be tagged as a Legal Entity.
An auditable unit needs to have a company associated. Optionally a LOB can be associated.

Copyright © Oracle Corporation, 2007. All rights reserved.

Auditable Units 400912495.doc

Effective 06/28/04 Page 9 of 20 Rev 1
Auditable Units and Hierarchies

Auditable Units and Hierarchies

You can nominate a hierarchy that you have created with any auditable units in HR to view any
data rollup. OICM seeds two additional hierarchy options, the legal hierarchy and management
hierarchy. To setup these three hierarchy, you must:
• Add the auditable unit classification to any organization that you want to see in OICM
• Setup the profile options listed above
• Oracle recommends that you use the GL subsidiary segment value set for the legal
hierarchy profile option and the value set of the LOB segment of chart of account for the
Management hierarchy
Refer to Practice - Create Auditable Units [LAB2E82Y]

Copyright © Oracle Corporation, 2007. All rights reserved.

Auditable Units 400912495.doc

Effective 06/28/04 Page 10 of 20 Rev 1
Agenda

Copyright © Oracle Corporation, 2007. All rights reserved.

Auditable Units 400912495.doc

Effective 06/28/04 Page 11 of 20 Rev 1
Associate a Process to an Auditable Unit

Associate a Process to an Auditable Unit

When you link processes from the risk library to an organization with an existing hierarchy of
processes, the existing hierarchy is not overridden. Instead, the new processes and sub-
processes are added to the existing process hierarchy in the organization. If the same process
already exists in the process hierarchy, the application adds any risk library objects to those
that already exist.
Synchronizing vs. Associating
Discrepancies between a process in a particular organization and its original form in the
risk library can originate in the following ways:
• You might add or change a risk, control, procedure, account associated with the process
in the risk library. You can also change the process structure itself i.e. add/delete children
in the risk library. These additions and changes are not automatically migrated to the
processes that have been mapped to organizations in the application.
• You can also create a process exception i.e. modify the process in a particular
organization. These changes are not reflected in the process structure within the risk
library.

Copyright © Oracle Corporation, 2007. All rights reserved.

Auditable Units 400912495.doc

Effective 06/28/04 Page 12 of 20 Rev 1
 You can synchronize the process and/or its subprocesses, the process hierarchy and/or its
attributes, associated risks, controls, and audit procedures, as well as people with designated
roles and privileges on the process. Based on the synchronization options followed, specific
changes make in the context of an organization will be deleted.
Note: Only processes that have been approved in the Risk Library can be associated with the
organization. However, once linked to an organization, the process must also be approved in
the organization.
Refer to Practice - Associate Process to Organizations [LAB2E84Y]

Copyright © Oracle Corporation, 2007. All rights reserved.

Auditable Units 400912495.doc

Effective 06/28/04 Page 13 of 20 Rev 1
Agenda

Copyright © Oracle Corporation, 2007. All rights reserved.

Auditable Units 400912495.doc

Effective 06/28/04 Page 14 of 20 Rev 1
Process Exception Management Overview

Process Exception Management Overview

Though processes may be formally standardized across an enterprise, they may still differ in
their execution in different organizations. This holds true even for processes that are designed
as non-standard processes i.e. the non-standard process can be implemented in different ways
in different organizations. The changes can exist to account for legislation, changes in the
environment of the process, etc.
Rather than creating multiple variations of a process/process hierarchy to account for these
differences, Oracle Internal Controls Manager allows you to make changes to processes in
individual organizations of the enterprise. The changes are unique to an organization and not
reflected in others. You can therefore associate a standard process to multiple organizations and
then customize each one independently. This will result in differences between processes in the
risk library and the organizations they are assigned to.
You can add, replace, and remove the following risk library objects as exceptions in individual
organizations:
• Processes
• Risks
• Controls

Copyright © Oracle Corporation, 2007. All rights reserved.

Auditable Units 400912495.doc

Effective 06/28/04 Page 15 of 20 Rev 1
 To create the exception, changes in these risk library objects will typically require justification.
Oracle Internal Controls Manager then initiates a notification to authorized personnel to
approve the exceptions. Requests for the creation of exceptions are submitted for approval to
approvers defined in Oracle Approvals Management.

Copyright © Oracle Corporation, 2007. All rights reserved.

Auditable Units 400912495.doc

Effective 06/28/04 Page 16 of 20 Rev 1
Process Exception Management Benefits

Copyright © Oracle Corporation, 2007. All rights reserved.

Auditable Units 400912495.doc

Effective 06/28/04 Page 17 of 20 Rev 1
Setting up Process Exceptions

Setting up Process Exceptions

• Responsibility: Internal Controls Super User (Forms)
• Navigation: Setup > Profiles

Copyright © Oracle Corporation, 2007. All rights reserved.

Auditable Units 400912495.doc

Effective 06/28/04 Page 18 of 20 Rev 1
Using Exceptions

Using Exceptions
• Responsibility: Internal Auditor
• Navigation: Organizations >
Refer to Practice – Process Exceptions [LAB2E86Y]

Copyright © Oracle Corporation, 2007. All rights reserved.

Auditable Units 400912495.doc

Effective 06/28/04 Page 19 of 20 Rev 1
Summary

Copyright © Oracle Corporation, 2007. All rights reserved.

Auditable Units 400912495.doc

Effective 06/28/04 Page 20 of 20 Rev 1