Introducing Oracle Advanced Financial Controls Cloud Service

Copyright © 2016, Oracle and/or its affiliates. All rights reserved. |
Safe Harbor Statement
The following is intended to outline our general product direction. It is intended for
information purposes only, and may not be incorporated into any contract. It is not a
commitment to deliver any material, code, or functionality, and should not be relied upon
in making purchasing decisions. The development, release, and timing of any features or
functionality described for Oracle’s products remains at the sole discretion of Oracle.
2

Introducing Advanced Financial
Controls to Audit Expenses and
Accounts Payables
CON7291
Dane Roberts
Principal Product Strategy Manager
Oracle Strategy, Risk Management Cloud Development
Sep, 20 2016 || 5:15 || Moscone West 3005
Presented with

Agenda
Panelist Introductions
Risk Management Cloud & Advanced Financial Controls
Panelist Q&A
More Resources
1
2
3
4
4

• Stephen D’Arcy, Director, PWC LinkedIn
– Responsible for the delivery of Oracle audit and advisory services around the
management of systems and process risks, including evaluating information technology
and application-based controls; He has led multiple Oracle GRC Suite implementations in
both Oracle EBS and PeopleSoft environments. Stephen also provides Oracle controls
optimization services for clients with a focus on enhancing their investment in their
Oracle product.
• Kent Spaulding, Software Architect, Oracle LinkedIn
– Software engineer with expertise in identity management, distributed computing,
machine-learning, and object-oriented technologies on a variety of computing platforms
The Java-based platform uses AI, Machine Learning, and Optimization techniques to
reason about risk and compliance, and to detect fraudulent activities.
• Mark Stebelton, Dir Product Management, Oracle LinkedIn
– 10+ years of experience in enterprise software development bringing quality enterprise
software applications to market. Extensive experience in interacting with industry
specialists to define feature set functionality that addresses key market requirements.
5
Today’s Panelists

Agenda
Panelist Q&A
More Resources
1
3
4
6
2

Copyright © 2016, Oracle and/or its affiliates. All rights reserved.Copyright © 2016, Oracle and/or its affiliates. All rights reserved. |
Effective Risk
Management
7
Strengthen
Internal
Controls
Enforce
Financial
Reporting
Integrity
Prevent
Unauthorized
Access
Monitor
Access to
Sensitive
Data
Automate
Detection of
Error, Fraud &
Waste
CFOs & Controllers
CIOs & CISOs
Auditors RISK
MANAGEMENT
CLOUD

Integrated Risk & Compliance
1
2
Streamline risk processes to promote
collaboration, transparency and
accountability
Early detection of potential issues
through automated data collection and
analysis
3
Rapid Deployment with Best Practice,
Pre-built Controls designed for targeted
risk areas
Risk & Compliance Management
Documentation Reviews Assessments Issues
Advanced Controls Monitoring
Audit Analytics
User-Defined
Algorithms
Visualization &
Simulation
Library of Best Practice Controls
Procure-to-Pay
Transactions
Expense
Policies
Assess (SoD)
Rules
8

Roadmap
9
Advanced
Access Controls
(R13)
Restrict Unauthorized Access
& SoD Violations
Advanced
Financial Controls
(R12)
Protect Against Fraud, Error &
Policy Violations
Financial
Reporting Compliance
(R11)
Streamline Internal Controls Processes
Risk
Management
Cloud

Advanced Financial Controls Cloud Service
Protect Against Fraud, Error and Policy Violations
Manage Exceptions
Continuous Monitoring
Configure Best Practice Controls
Author New Audit Rules & Algorithms
10
Link Results to Business RisksLink Results to Business Risks
Stop High Risk Transactions
 Identical Expenses
 Split Purchase Orders
 Duplicate Invoices
 Unusual Invoice Amt.
 Unauthorized Spend
 Blocked Suppliers
 User Creates Supplier &
Pays invoice

Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | 11
Oracle Cloud
Springboard with
AFC icons

Overview page
Oracle Advanced
Controls
All automated Advanced
Control are continuously
monitored with up to date
information across business
processes and users,
providing a real-time system
of record to support audit,
compliance and drive
operational efficiency and
effectiveness through
advance controls monitoring.

Duplicate Invoices
Entries ModelOracle Advanced
Financial Controls
Advanced Financial Controls R12 is
delivered with a set of high-value
“models” that can be deployed
directly as controls as well as
configured and tailored specifically
to your organizations
requirements.
On this page you can see a list of
AFC transaction monitoring
models and their associated
“results count”.

Duplicate Invoices
Entries Model
1 of 6
Here is the model
configuration page - or
workbench – for creating and
configuring models that may
become formalized as
Controls.

Duplicate Invoices
Entries Model
2 of 6
The basic components of a Model
are displayed here:
1. Name and Description
2. Business Objects (out of the
box and user defined)
3. Model Logic:
4. Result display & attributes

Duplicate Invoices
Entries Model
3 of 6
Model Logic:
• Standard Filters
• Functions
• Patterns

Duplicate Invoices
Entries Model
4 of 6
Advanced filter options, help to
tightly define logic constraints
and can also minimize or
eliminate false positives results.
For instance this advance filter
option is ‘date-based’ which not
only allows you to specify an
exact or a relative date range but
to also focus on (or eliminate)
certain days of the week and
time of day.

Results Overview
View Incidents
Here we can see a secure role-based
Overview of Controls and Incidents as
well as a workflow of results in the
Worklist.
Seen here are:
•When the Overview page and contents
were last refreshed
•Number of Pending Incidents and
whether they are assigned and
remediated
•Pending Incidents by Priority
•Worklist that list Controls that require
Investigation of Results

View Incidents
1 of 2
Navigating to the Results by Control
Summary Tab (shown on the left) you
can see
• Each control
•When it was last run
•Pending Results Count by control
Select the Pending Results Count to see
a listing of incidents by control.

View Incidents
2 of 2
Now we can see specific transactions that were
identified as Incidents along with the transaction
attributes, fields or properties that we selected to
be displayed as part of the model / control
design.
Some highlights on this page include:
•Invoice ID and Number
•Invoice Date
•Invoice Amount
•Supplier Name (not pictured)
•Whether the Incident is assigned for further
investigation

View Incident
Report
AFC comes with pre-defined reports.
Result Reports:
•Result Summary Extract
•Result by Control Summary Extract
Control Reports:
•Control Detail Extract
Here is the Excel formatted file for the
Transaction Incident Detail Extract that can be
printed and saved for supporting audit
evidence and distribution.

DEMOgrounds: Moscone West Level 3 Lobby (M,T,W)
ERP Showcase
Workstation
WEP-020

Agenda
Panelist Q&A
More Resources
1
2
3
4
24

Panelists Q&A
1. What common activities or use cases do we recommend?
25

Panelists Q&A
2. How can transaction monitoring prevent Errors and Stop Financial
Leakage?
26

Areas of High Risk in the PTP process
• Vendor Master File Maintenance
– “The Keys to the Door to the Money”
– Emphasis on having W-9 or equivalent for US Vendors (W-8 for Intl)
• Managing & Processing Vendor Invoices
– Includes: timeliness of entering invoices, invoice number ‘Style Guides’, price
differences, copies v originals, routing invoices, Remittance Advice
Source: Institute of Financial Management

Panelists Q&A
3. How does advanced transaction monitoring help with controlling
business processes?
28

Panelists Q&A
4. How does advanced transaction monitoring help with monitoring users
access?
29

Panelists Q&A
5. What are some Key Metrics that you track with transaction monitoring?
30

Sample Metrics
• Productivity – how are you spending resources today?
– Time spend responding to requests for new scripts, reports
– Time spent analyzing and interpreting the output
– Number of hours remediation incidents
• Control Violations by Process & Activity
– Number of Expense Report Violations, double claims for same expense
– Payment Errors - Total Value of Incidents
• Root Cause Metrics
– Duplicate entries
– Duplicate suppliers in Master Data
– Missing data (e.g., W-9, remittance information, etc.)
31

Panelists Q&A
6. How is AFC more efficient that other BI reports and systems?
32

Incident Life Cycle
• AFC incidents can be in closed status in three ways:
– By resolving the issue in ERP Cloud and setting the incident status to “Resolved”
– If a filter is part of the control, then it will trigger a system close during the next control
run, if the status is modified in ERP Cloud
– If a control is inactivated
Example:
1. The “InFusion: Back Dated PO” control logic includes a filter “Invoices not Cancelled”
2. Control analysis has detected Invoice Id: XYZ as an incident
3. As part of remediation, user cancels Invoice XYZ in Financial Cloud
4. During a subsequent control analysis run the system will find an existing incident for the
Invoice Id XYZ, and the incident will automatically be closed.

Incident Process Flow
SYSTEM
SYSTEM
SYSTEM
INGEST JOB GRAPH
CONTROLS LOGIC
INCIDENTS
INVESTIGATOR
ERP CLOUD USER
FIXES ISSUE
Example:
Cancels duplicate
payment
ENGINE AUTOMATICALLY
CLOSES INCIDENT(S)

Panelists Q&A
7. Can you give us more information on the technology behind AFC and
what ‘skill set’ is required to design AFC Controls and Models?
36

Pareto Analysis
Clustering
Fuzzy Matching
Anomaly detection
Automate Data Analysis to Detect Issues Early
Confidential – Oracle Internal/Restricted/Highly Restricted
Security &
Transaction Data
Enterprise
Data Graph
GRCOntologyBasedPolicyEngine
SemanticReasoningPatternReasoning
Data Analysis
Engine
GraphicalAuthoringWorkbench
LibraryofUserDefinedControls
Incidents
SELF-LEARNING
FEEDBACK LOOP
37
Benford Analysis
Algorithms Workbench

Procure-to-Pay
• ID Duplicate Invoice Entries
• ID Duplicate Supplier Sites
• ID Back-Dated PO's
• ID high amnt, unpaid Invoices by Supplier
• ID 'one-time-use' supplier; >1 invoices
• ID first time invoices for Suppliers
• ID Invoices from Suppliers on 'watch-lists'
• ID Suppliers & Invoices created by same
user
Expense Reporting
• Meals over limit
• Meals & per-diem same day
• Employees frequently missing receipts
• Duplicate expense across reports
• Credit payments claimed as cash pymnts
• Same meal claimed >1 by diff employees
• Split large expense item to get under limit
• Expenses for watch list items or vendors
38
Sample Controls, Rapid ROI

• Expense Entertainment Policy Expense
Meals Policy
• Expense Mileage Policy
• Expense Miscellaneous Policy
• Expense Report Attendees
• Expense Report Credit Card Transactions
• Expense Report Credit Cards
• Expense Report Details
• Expense Report Information
• Expense Report Template
• Payables Invoice
• Payables Invoice Batches
• Payables Invoice Details
• Payables Invoice Hold Codes
• Payables Payment Schedule
• Payables Payment Term
• Payables Procurement Card
• Payables Setup: General
• Payables Setup: Invoices
• Payables Setup: Payments
39
Sample Business Objects, Rapid Implementation

• Payment
• Payment Card
• Payment Instruments
• Purchase Order
• Purchasing Approved Supplier
• Purchasing Approved Supplier List
Statuses
• Requisition
• User
• Person
• Supplier
• Supplier Site Location
• External Bank Account
• Business (Operating) Unit
40
Sample Business Objects, Rapid Implementation

Panelists Q&A
8. Who owns the control and what is your process for remediating
incidents?
41

Panelists Q&A
8. Who owns the control and what is your process for remediating
incidents?
42
Management Controls
Internal Control Measures
Process Owners
Financial Controller
Security
Risk Management
Quality
Inspection
Compliance
Internal Audit
SENIOR MANAGEMENT
GOVERNING BODY / AUDIT COMMITTEE
• Owns and Manages Risk
• Responsible for Creating,
Operating and Maintaining
System of Internal Controls
• Oversees & Monitors Risk and
assists Management in the
design of controls
• Limited independence from
operating management
• Provides Independent
Assurance
• Reports to Governing Body
Solution Management Internal Controls Governance Internal Audit
REGULATOR
INTERNALAUDIT
1st Line of Defense 2nd Line of Defense 3rd Line of Defense

Panelists Q&A
9. Can you think of an event or project where new or updated transaction
monitors where deployed?
43

Panelists Q&A
10. What are the best practices considerations for organizations that may not
have used this type of solution?
44

Thursday
PANEL SESSION
Sep 22, 9:30 AM – 10:15 AM| Moscone West 3005
Implement the Best Practice for Oracle Fusion Advanced Financial
Controls Cloud Service
[CAS7286]
Swarnali Bag, Governance, Risk & Compliance Practice Lead, Oracle
Barry Greenhut, Director, Product Strategy, Oracle
Christine Doxey, Owner or Partner, “Doxey, Inc”
Lakshmi Rajamohan, Principal Product Strategy Manager, Oracle
Mark Stebelton, Director, Product Management, Oracle
This session provides a detailed walkthrough of Oracle Fusion Financial Controls Cloud Service
from an end user’s perspective, and highlights how the product can be configured to automate
best practice controls. Oracle Fusion Advanced Financial Controls Cloud Service is designed to
meet the common needs of Oracle Financials Cloud subscribers. Based on learning from a decade
of customer experience, this session showcases Oracle’s best practice business process for
maximum ROI with minimum cost of ongoing operation.
45

Selecting Controls
• Select controls that have failed during past audit cycles
• If you are using Financial Reporting Compliance
– Identify from your documented controls, which high-risk payables and expenses
controls you would like to automate that can be leveraged from the pre-built AFC
controls
• If you are not using Financial Reporting Compliance
– Identify from your list of internal controls library, which high-risk payables and
expenses controls you would like to automate that can be leveraged from the pre-
built AFC controls
46

Advanced Financial Controls Best Practice Solution
Methodology
Configure
Use
47
Review Incidents
Remediate
issues
Review
Incident
Reports
Reassess
controls
Gather
configuration data
Configure
Pre-built
Models
Test and
Refine
Models
Deploy
Advanced
Controls

Best Practice Solution: Implementation Outline
48
Admin
Internal
Auditor
Business
Analyst
Process
Owner
1. Gather
configuration
data
2. Configure AFC
(general, roles,
users)
3. Import
Pre-built
Models
4. Test &
Refine
Models
5. Review
Results &
Remediate
6. Define
Advanced
Controls
7. Schedule Sync &
Control
Analysis
8. Review
Incidents &
Remediate
9. Review
Incident
Reports

Agenda
Panelist Q&A
More Resources
1
2
3
4
49

Risk Management Cloud Customers
….and more!
50

Go-To Partners
Success requires experience and expertise
– get both from our Go-To Partners:
• Guide process owners & participants
through adoption of Best Practice Processes
• Configure software for effective long-term
success: Minimum cost of operation,
Maximum flexibility to adapt to change
To learn more and get connected, contact
your Oracle Success Manager
Current Go-To Partners: KPMG USA, Oracle Consulting USA, FulcrumWay, OneGlobe, PricewaterhouseCoopers USA
51

 For subscribers and partners
To Learn More
Cloud Portal Release Readiness User Documentation Modern Best Practice
Oracle University Success Managers  Get Started  Customer Connect 
52

Copyright © 2016, Oracle and/or its affiliates. All rights reserved.Copyright © 2016, Oracle and/or its affiliates. All rights reserved. | 5353
Join our LinkedIn Group
For the latest Updates and Presentations .

Tuesday
GENERAL SESSION
Sep 20, 12:15 PM – 1:00PM | Moscone West 3005
Oracle Risk Management Cloud –
Strategy Roadmap
[GEN7198]
Sid Sinha, Head of Product, Oracle Risk Management Cloud
Corey West, Oracle EVP Corporate Controller and Chief
Accounting Officer, Oracle
Brian Jensen, Director, KPMG LLP
Timothy Reese, Pennsylvania State Treasurer,
Commonwealth of Pennsylvania
This general session provides the latest update on the product
strategy, release roadmap, and best practices for Oracle Risk
Management Cloud.
PANEL SESSION
Sep 20, 4:00 PM – 4:45 PM | Moscone West 3005
Introducing Oracle Financial Reporting
Compliance Cloud (Risk Cloud) [CON7293]
Aman Desouza, Director, Risk Cloud Strategy, Oracle
Adil Khan, Managing Director, FulcrumWay,
Michael Mann, Director, Caesars Entertainment
This session provides an overview of Oracle Financial
Reporting Compliance Cloud and how it automates
certifications, assessments, and related manual tasks for
regulations such as Sarbanes-Oxley Act. It includes a guided
tour of the product, the features and benefits, and describes
how audit teams can transform compliance with automation
using this unique risk management service.
PANEL SESSION
Sep 20, 5:15 PM = 6:00 PM | Moscone West 3005
Introducing Advanced Financial Controls
to Audit Expenses & Accounts Payable
[CON7291]
Kent Spaulding, Software Architect, Oracle
Dane Roberts, Principal Product Strategy Manager, Oracle
Stephen D’Arcy, Director, PwC
This session provides an overview of Oracle Fusion Advanced
Financial Controls Cloud Service to continuously audit
expenses, accounts payable, and other sensitive financial
transactions. It includes a product tour, features and benefits
and shows how expense managers, controllers, and auditors
can use advanced data analysis to prevent fraud and error
and ensure compliance with policy .
54

Wednesday
CUSTOMER CASE STUDY
Securing ERP: Application Compliance
and Controls Implementation
[CAS7689]
Gautham Ramkumar: Director, Advisory Services, KMPG LLP
Chuck Devore, Director, Finance Transformation, ADM
Kenneth Kobia, Risk & Controls Lead, Archer Daniels Midland
Organizations have successfully transformed their business
operations by leveraging Oracle ERP technologies. Yet they
continue to struggle to balance the two divergent needs of
empowering ERP business users, while protecting sensitive
data and transactions. In this session KPMG and Archer
Daniels Midland detail how they took advantage of Oracle’s
ERP security and controls capabilities, to support ADM’s
initiative to deploy Oracle ERP .
PANEL SEESION
Sep 21, 1:30 PM – 2:15PM | Moscone West 3005
Introducing Oracle Fusion Advanced
Access Controls to Strengthen Security
[CON7290]
Katrina Johnson, VP Risk Assurance, Service Corp
International
Nicholas Seeman, Director, Advisory Services, KMPG LLP
This session provides an overview of Oracle Fusion Advanced
Access Controls to continuously detect segregation of duties
violations, manage exceptions, and fix unauthorized access to
sensitive functions and data. Compliance managers and
auditors can use Oracle Fusion Advanced Access Controls to
ensure strong access controls across ERP, HCM and SCM
cloud applications.
PANEL SESSION
Implement the Best Practice for Oracle
Financial Reporting Compliance Cloud
[CON7291]
Swarnali Bag, Governance, Risk & Compliance Practice Lead,
Oracle
Barry Greenhut, Director, Product Strategy , Oracle
Lakshmi Rajamohan, Principal Product Strategy Mgr., Oracle
This session provides a more detailed walkthrough of Oracle
Financial Reporting Compliance from an end user’s
perspective, and highlights how the product can be
configured to automate the best practice process. Based on
learning from a decade of customer experience, it showcases
the shortest and most cost-effective path to go live and
streamline operations.
55

Thursday
PANEL SESSION
Implement the Best Practice for Oracle Fusion Advanced Financial
Controls Cloud Service
[CAS7286]
Swarnali Bag, Governance, Risk & Compliance Practice Lead, Oracle
Christine Doxey, Owner or Partner, “Doxey, Inc”
This session provides a detailed walkthrough of Oracle Fusion Financial Controls Cloud Service
from an end user’s perspective, and highlights how the product can be configured to automate
best practice controls. Oracle Fusion Advanced Financial Controls Cloud Service is designed to
meet the common needs of Oracle Financials Cloud subscribers. Based on learning from a decade
of customer experience, this session showcases Oracle’s best practice business process for
maximum ROI with minimum cost of ongoing operation.
PANEL SESSION
Get Started with Financial Reporting Compliance and Advanced
Financial Controls
[CON7284]
Joel Alvarado, Customer Success Manager, Oracle
This session provides you with the most effective project plan to implement Oracle Financial
Reporting Compliance or Oracle Fusion Advanced Financial Controls Cloud Service. Participants
will learn the shortest and most cost-effective path to success using Oracle’s customer and
partner-tested “get started” process. Learn how to plan and adopt these cloud services, and then
sustain your use through growth and change. Learn how to get the experience and expertise
needed to succeed.
56

Introducing Oracle Advanced Financial Controls Cloud Service

More Related Content

What's hot (20)

Similar to Introducing Oracle Advanced Financial Controls Cloud Service (20)

Recently uploaded (20)

Introducing Oracle Advanced Financial Controls Cloud Service