Monday, September 20, 2004
Oracle OpenWorld DEMOgrounds visit – Internal Controls Manager
On Tuesday 7th September 2004 I paid a visit to DemoGrounds at Oracle OpenWorld and took a look at Oracle Internal Controls Manager, here’s a summary of my findings.
I have to say I quite like this product as well as the idea and concept behind it. Internal Controls Manager (ICM) has been developed so that it can assist organisations that are trying to ensure they comply with the new requirements of the Sarbanes-Oxley Act of 2002 as well as increased adoption of International Accounting Standards (IAS). Internal Controls Manager comes standard with 11i10 but not 11i9 (you have to patch up a standard 11.5.9 install to get ICM working).
According to the demonstrator there are only about 160 people implementing it and most of those customers are in the USA. The various brochures, fact sheets and documentation I was given to read indicated that Oracle was one of the first ERP Vendors to come out with a product like this. A product flash leaflet I was given at the DEMOgrounds entitled An Ounce of Prevention - Oracle Internal Controls Manager by Scott Tiazkun of IDC had the following to say: -
The product of work with customers and design partners PricewaterhouseCoopers and Deloitte and Touche to give it that user-tested and partner-approved feel, the Oracle application is aimed specifically at facilitating compliance with Sections 302 and 404 of Sarbanes-Oxley. Section 302 requires particular employees to state that their internal controls are effective. Section 404 requires them to attest that a company attains standards similar to those set by The Committee of Sponsoring Organizations of the Treadway Commission (COSO), a Congressional commission subcommittee on internal controls. This is in addition to the external auditors certification and review of the same issues.
Oracle ICM is used in conjunction with Oracle Workflow, a modelling tool already in the E-Business Suite that allows users to design internal business processes and store them in a repository. Oracle ICM monitors these processes to ensure they are performed as designed. If deviations occur, automatic alerts are sent to designated personnel. Oracle ICM allows users to catalog and track risk factors that might impact financial statements and includes Oracle Tutor to document policies and procedures. The product also uses iSurvey as a mechanism to conduct questionairre-based assessments and also to support anonymous feedback to provide "whistleblower" support. The application provides users with an auditing portal-type work screen, where users can submit audit findings and issue audit reports, manage process documentation, document business process variations, and review compliance status of financial statements, reconciliation status and overall enterprise compliance status.
The Oracle Internal Controls Manager Home Page
In a nutshell the Controls Manager allows you to take a look at the processes within your organisation, determine the risks at each point within a process and specify controls which should mitigate the risks. Oracle has integrated ICM very well into the E-Business Suite and this is the beauty of the product. Firstly ICM links with Oracle Projects so that if you are going to conduct an audit you can treat it as a project which is appropriately costed and allocated the right resources. Secondly it integrates with Tutor in a manner that allows you to import your Oracle Tutor process documentation into the module. Lastly, where you don’t have any process documentation prepared in Tutor, an interface is available with Web ADI that provides you with templates where you can capture process, risk and control information for subsequent import into ICM.
I’m hoping to have a chance to implement this product in the future and would certainly be interested in receiving contributions from readers or implementor’s relating to this module.