Brunswick Access Control System Business Owner and Manager Guidelines

Transcription

1 Brunswick Access Control System Business Owner and Manager Guidelines Creation Date: February 18, 2010 Version: 1.0 Last Updated: April 20, 2010, 2010 Author: Maureen Broman, Controls & Compliance BACS: Business Owner Guidelines Page 1 of 8

2 Guidelines All significant systems, programs, or IT applications should be restricted and managed by a business owner. All Access Requests require the approval of the requestor s manager as identified on their employee HR record. A Business Owner is an individual outside of the Information Technology department that is assigned to manage access to a particular system or program. This individual should be familiar with the business use of specific screens and programs and is responsible for approving or rejecting access to a specific responsibility(s)/role(s). Business Owner assignments will be maintained in the Brunswick Access Control System (BACS) by the BACS System Administrator(s). Any changes in job responsibility that require a change in system business ownership should be immediately directed to the BACS Administrator(s). Managers and Business Owners are involved in the following process: 1. New System Requests The following guidelines should assist in determining whether or not the request should be granted: The requesting individual must provide a legitimate reason for requiring access. Limited access is always a stronger control. Access should be denied unless an individual can demonstrate a valid business reason. Consider if an inquiry screen will meet the need, rather than an update screen. If questionable, suspicious, or unfounded access is requested, it is the Business Owner s responsibility to question the requesting individual. If the Business Owner is unfamiliar with the individual or the individual s responsibility, the Business Owner should seek out additional information before approving the request. Make sure the right individual is seeking access. If the function or task should occur at a managerial level, ensure that the individual is not in a subordinate position. The new requested access must not create a logical segregation of duties violation with respect to established key financial systems. Contact your Business Governance Department or a member of the Controls & Compliance Team if questions remain. All new requests for access will be processed via the electronic Resource Access Request (erar). The system will send an automatic notification to the appropriate manager and Business Owner(s) to approve or deny access to the requested system responsibility(s). BACS: Business Owner Guidelines Page 2 of 8

3 ******************************************************************************** Sample A RAR request is waiting for your approval in BACS. RAR# : 520 Requestor : Todd Mattes Please login to the system to review. Instructions to view requests: Login to above url using your Appprod/BCOne account Select Bus Owner/Pending Requests from the menu Select RAR from the Request Type drop down Please direct any questions or issues to the Solution Center at ********************************************************************************************** Click on the link to access BACS and signon with your BCOne userid and password BACS: Business Owner Guidelines Page 3 of 8

4 A response from the Business Owner is required before any access is granted. If a Manager or Business Owner does not respond within 15 working days, the request will automatically be cancelled and the requestor notified. Business Owners are also involved in the following processes: 2. Job Change Requests When evaluating whether or not an individual s access should be maintained or removed, consider the following guidelines: If the individual s new position does not require the same tasks or functions to occur, access should be removed. If the individual is transferring to a new or different department, continuing access should be questioned. If the individual is being promoted within a business function, evaluate whether access still applies at the new level. Consider removing update access, as the individual may now only need inquiry access. 3. Quarterly Access Reviews When completing the Quarterly Access Review, consider the following guidelines: Terminated employees or employees who have changed jobs should be removed from the access listing. Each username should be assigned to a specific individual. Generic username(s) should be used only with Business Governance or Controls & Compliance approval. Remove any duplicate usernames. Investigate temporary employees, contractors, or any other non-employee individuals who have access. Be sure to validate that their access is still appropriate. Unknown individuals should be questioned, but realize there may be users at other locations using a particular system. The first Quarterly Access Review may call for additional research to learn about the individuals on the existing user list. BACS: Business Owner Guidelines Page 4 of 8

5 4. Segregation of Duties (SOD) When considering access approval, consider the following SOD guidelines: Allowed Not Allowed Sales Sales - Customer order entry/adjustments - Customer order adjustment approvals - Customer Master data update - Accounts Receivable updates - Ship customer order Manufacturing Manufacturing - Cycle Counts - Approvals for Cycle Count, inventory transfers, adjustments, or receipts - Receive or return purchased parts - AP invoice entry - Inventory adjustments Fixed Asset Accounting Fixed Asset Accounting - Asset entry - Physical Inventory transactions - Asset adjustment - AP invoice entry - Oracle Projects update - Purchase order approval Human Resources - Update employee records (add/change) Human Resources - Payroll processing Accounts Payable Accounts Payable - Supplier invoice entry/adjustment - Inventory adjustments - Create customer payments - PO/AP/Bank Payment setups - Approve/cancel payments - Create purchase order - Account Reconciliations Purchasing Purchasing - Purchase order entry/adjustment - Receive or return goods - Purchase order approval - AP invoice entry/adjustment - Supplier Master Data update - Bank account setups - Approve own purchase order General Ledger General Ledger - Create journal entry - Post journal entry - Approve subordinate's journal entry - Approve own journal entry BACS: Business Owner Guidelines Page 5 of 8

6 Job Change Requests When an employee s HR cost center and job title changes, a system generated message from the Brunswick Access Control System will be sent to all Business Owners of systems accessed by the employee. Business Owners must register a response in BACS to either keep or remove each existing access record. If a Business Owner does not respond to the job change request within 15 working days, existing access to the system will automatically be removed. Quarterly Access Review Every quarter, each Business Owner will be required to review access records on the Brunswick Access Control System. Each Business Owner will receive an notification advising them that their Quarterly Access Review has been generated for their respective systems. Each Business Owner will review the current access records list and register a response in BACS. The Business Governance or Controls & Compliance department will monitor that all reviews are completed in a timely manner. Business Owners are required to review existing access records to ensure only active employees and authorized generic username(s) have appropriate access based on the following guidelines: The user is an active employee or contractor Access is appropriate for the user s job responsibilities Access for employees who have transferred jobs is still appropriate The access does not create a logical segregation of duties violation with respect to established key financial systems Generic username(s) falls within the allowed guidelines or have proper approval documented Select Business Owner Pending Requests then Select Request Type Quarterly Review BACS: Business Owner Guidelines Page 6 of 8

7 Select the User Name Select Keep or Remove click on the user name and addition information about the person will pop up. Click on Update and review for that user is complete. BACS: Business Owner Guidelines Page 7 of 8

8 BACS: Business Owner Guidelines Page 8 of 8