Oracle Fusion Financial Reporting Compliance Cloud What s New in Release 10 July 2015
TABLE OF CONTENTS OVERVIEW... 3 GIve Us Feedback... 3 RELEASE FEATURE SUMMARY... 3 ORACLE FUSION FINANCIAL REPORTING COMPLIANCE CLOUD... 4 Process... 4 Risk... 5 Control... 6 Assessment... 7 Supporting Tools... 8 REVISION HISTORY... 10. 2
OVERVIEW This guide outlines the information you need to know about new or improved functionality in Oracle Fusion Financial Reporting Compliance Cloud Release 10. Each section includes a brief description of the feature, the steps you need to take to enable or begin using the feature, and may also include tips or considerations that you should keep in mind. GIVE US FEEDBACK We welcome your comments and suggestions to improve the content. Please send us your feedback at oracle_fusion_applications_help_ww_grp@oracle.com. RELEASE FEATURE SUMMARY Some of the new Release 10 features are automatically available to users after the upgrade and some require action from the user, the company administrator, or Oracle. The table below offers a quick view of the actions required to enable each of the Release 10 features. Action Required to Enable Feature Feature Automatically Available End User Action Required Administrator Action Required Oracle Service Request Required Oracle Fusion Financial Reporting Compliance Cloud Service Process Risk Control Assessment Perspective Survey Issue Reports. 3
ORACLE FUSION FINANCIAL REPORTING COMPLIANCE CLOUD Oracle Fusion Financial Reporting Compliance Cloud Service documents your business practices so that you can satisfy financial reporting regulations. Use it to: Define business processes, identify risks to those processes, and formulate controls to address the risks. Evaluate risks, and analyze the impact of controls upon them. Assess objects regularly to determine operational effectiveness accurately and comprehensively, and ultimately to strengthen financial-reporting controls. Financial Reporting Compliance makes its introductory appearance among Fusion Cloud applications in Release 10, so in a sense, everything about it is new. Here, however, are some highlights. PROCESS Define the processes your company follows to meet its goals. For example, a process may enumerate the steps required to complete a year-end closing. Once a process is in place, you can track risks that may affect it, and devise controls to alleviate those risks. A process may be as broadly or tightly defined as you like. You can describe the process in any level of detail as you create it. You can also create action items individual tasks that constitute steps toward the completion of the process. For example, a year-end-closing process might require an action item to verify that certain tax documents are included in the year-end reporting. The management page for a process shows, among other things, a graph that tracks the completion of its action items.. 4
STEPS TO ENABLE Processes require no advance setup. However, an administrator may select among activities that users may complete as they assess processes. RISK A risk defines circumstances that could adversely affect a business process. As you work with a risk, you not only define it, but also: Relate controls to it. By doing so, you indicate that each control plays a part in reducing the risk. You may assign each control a stratification value for example, key or mitigating. Each value defines the role a control plays in dealing with a risk. Also, you may determine that a control has a primary effect upon a risk, or that it is subordinate to another control. Perform analysis to determine both inherent and residual risk the level of threat existing before and after controls are in place to address the risk. Analysis employs a set of three models that interact with one another; you can use seeded models or create your own. Depending on the models you use, analysis is either qualitative or quantitative you may select, and models may return, either labels or numbers to rate elements of the risk and the risk itself. Evaluate a risk to determine whether to accept, monitor, or treat it, based on standard (model-defined) criteria. Evaluation also rates the significance of the risk in comparison with other risks. The models you use for evaluation are distinct from those you use for analysis; once again, you can use seeded models for evaluation or create your own. As you create a risk, you not only name and describe it, but may also select models for analysis and evaluation.. 5
STEPS TO ENABLE Although an administrator can configure certain risk features, it s recommended that you accept the default configuration. Apart from that, an administrator may select among activities that users may complete as they assess risks. CONTROL A control documents measures your company takes to address a risk. It describes actions taken externally to Financial Reporting Compliance, either automatically in other systems or manually. You relate controls directly to risks (as described above). For each control, you can create test plans. These document steps to be followed in determining whether the control is effective. Users execute a test plan while completing an assessment of the control for which the plan is created. A control may have multiple test plans, but no more than one per assessment activity type. Among the data you can track for a control is the cost of implementing it. STEPS TO ENABLE Controls require no advance setup. However, an administrator may select among activities that users may complete as they assess controls.. 6
ASSESSMENT An assessment is the review of a risk, control, or process, run periodically to ensure that the object is defined correctly or that its definition remains appropriate over time. Business stakeholders, internal and external auditors, and other users may be invited to participate in an assessment. An assessment may be planned or ad hoc. A planned assessment is initiated from a plan, which in turn is developed from a template; it may specify any number of activities that assessors are to complete; it may incorporate tools such as surveys and test plans; and it may focus on any number of objects (although users assess each of these objects individually). An ad hoc assessment is simpler, focusing on a single instance of an object and a single activity. One step in initiating a planned assessment is to set criteria for selecting the objects to be assessed. STEPS TO ENABLE For each assessable object (process, risk, or control), an administrator must select the activities that may be included in an assessment. For each activity, the administrator may edit guidance text and an activity question. The former is a broad statement of purpose a user may consult while completing the assessment activity. The user s response to the latter determines whether the object passes its assessment.. 7
SUPPORTING TOOLS The following tools support the creation, maintenance, and assessment of processes, risks, and controls. PERSPECTIVE A perspective is a set of related, hierarchically organized values. The root value may be organization, region, regulatory code, or any other concept you determine to be meaningful. Users assign individual perspective values to individual processes, risks, or controls, establishing a context in which these objects exist. Perspectives play an important part in securing Financial Reporting Compliance. Users are assigned job roles. One component of a job role is the data security policy, which defines a set of data to which the role grants access. A data security policy may specify perspective values; if so, it grants access only to data concerning objects associated with the same perspective values. In addition, perspectives are useful as filtering values in Financial Reporting Compliance objectmanagement pages and in reports. SURVEY A survey is a configured set of questions, together with instructions for answering them. A question may be in any of nine formats, for most of which you can create choice sets of possible answers. A survey may be attached to an assessment plan. If so, users would answer survey questions while completing assessments developed from the plan. Or, a survey may be distributed independently of assessments, its questions pertaining to a designated Financial Compliance Reporting object or perspective. ISSUE An issue is a perceived defect in a Financial Reporting Compliance object, or in an assessment or other activity performed against an object. For example, a user may raise an issue against a control because no test plan has been created for it, and so the user feels that an assessment of the control cannot be meaningful. The resolution of an issue involves a determination (by a user other than the one who created it) that the issue is valid and, if so, the creation and completion of a remediation plan. An issue may be closed if it is found to be invalid, if its remediation plan is successfully completed, of if an attempt at remediation shows that the issue cannot be resolved. REPORTS Seeded Financial Reporting Compliance reports provide information about processes, risks, controls, assessments, and issues. You can run reports on demand, or schedule them to run at regular intervals.. 8
Some reports are intended to be viewed within the application, and other extract reports are for export to a tool like Excel, where you can manipulate and analyze results. STEPS TO ENABLE These tools require no advance setup. TIPS AND CONSIDERATIONS Although you can create or modify perspective hierarchies at any point, you may want to define an essential set of perspectives before working in other areas of the application, so that perspective values are available to be selected for processes, risks, controls, and data security policies.. 9
REVISION HISTORY This document will continue to evolve as existing sections change and new information is added. All updates are logged below, with the most recent updates at the top. Date What s Changed Notes. 10
Copyright 2015, Oracle and/or its affiliates. All rights reserved. This document is provided for information purposes only, and the contents hereof are subject to change without notice. This document is not warranted to be error-free, nor subject to any other warranties or conditions, whether expressed orally or implied in law, including implied warranties and conditions of merchantability or fitness for a particular purpose. We specifically disclaim any liability with respect to this document, and no contractual obligations are formed either directly or indirectly by this document. This document may not be reproduced or transmitted in any form or by any means, electronic or mechanical, for any purpose, without our prior written permission. Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners. Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. UNIX is a registered trademark of The Open Group.