Authorized Requestors User Group 9/14/2018 Authorized Requestors User Group Theresa Butler| theresa_butler@harvard.edu |November 3, 2016

Agenda Welcome Yearly Access Review Modernization of Financial Reporting (OBI) Concur QlikView demo Harvard Training Portal ROPPA Miscellaneous updates

9/14/2018

Yearly Access Review (YAR)

9/14/2018 Yearly Access Review Authorized Requestor (AR) responsibility for certification: As stewards of users security information for your tub, Authorized Requestors are responsible for ensuring that systems access is commensurate with a person’s job function. You are certifying that you have reviewed the access rights for appropriateness based on day to day job responsibilities for all users in your Tub for the application(s) you oversee (i.e. Oracle, PeopleSoft, GMAS, Concur and OBI). You are also certifying that you have requested access be revoked or modified for those users where the access is no longer appropriate (requests should be submitted through the normal request process)

Yearly Access Review (continued) You will need to save your supporting evidence of your review and any modifications you make (i.e. list of users that were modified, what was modified and request date of modifications). This will be subject to a review by PWC during the FY17 audit. Run the CREW report associated with the application you are certifying (OBI and Concur are not included in the CREW reports and will need a separate process) Save the report as a PDF Print a copy of the PDF report and make notes of any changes that are made (this will evidence the changes and will be needed for PWC audit as supporting documentation) Provide the CREW Request ID on the certification form Email a copy of your PDF files to: CSRequest@harvard.edu Note in subject line 2016 YAR

Yearly Access Review (continued) OBI and Concur reports will be distributed by Client Services by email to the appropriate Tub/Dept AR on or before Monday November 14, 2016. You will need to save your supporting evidence of your review and any modifications you make (i.e. list of users that were modified, what was modified and request date of modifications). This will be subject to a review by PWC during the FY17 audit. Review the reports sent by Client Services Save your report Print a copy of the report and make notes of any changes that are made (this will evidence the changes and will be needed for PWC audit as supporting documentation) Provide the OBI and/or Concur Request ID (provided with your report) on the certification form Email a copy of your PDF files to: CSRequest@harvard.edu Note in subject line 2016 YAR

Yearly Access Review (continued) Certification in PeopleSoft One AR per application, per tub will be assigned the role to process the certification The certification email will be sent next week and will include all information you will need to certify: Certification instructions A copy of this presentation List of ARs that will be granted the role in PeopleSoft OBI and Concur reports will be sent separately

Yearly Access Review (continued) How do I certify? Once you complete your review and modifications (if applicable) you will need to log into PeopleSoft and complete the certification form Who should certify? One AR per tub, per application should submit the completed certification in PeopleSoft When are certifications due? Certifications are due no later than Tuesday December 20, 2016

Certification Form

Modernization of Financial Reporting (OBI)

Project Update Decommissioning of CREW Grants Management dashboards planned for December 1st Grants Training has been underway since July and will continue monthly through early 2017. We do have users showing up to training without access In August we began distributing a “Monthly Action Plan” to let Engagement Councils know of upcoming tasks where there involvement is needed Project Team has deployed 14 Financials Dashboards to OBI Production with Tub-based access Beginning to build our Financials Super User community – dashboard specific sessions begin on November 7th and will continue until Calendar year-end We will be expanding the pilot in January. Planning a joint LIM and AR meeting to walk through Wave 5 access request form

Data Access Control Timeline DAC 0.1 : TUB Level access for piloting the financial dashboards with a specific group of users from each School / Central. DAC 1.0 : Will include most commonly used access controls, both content and data controls, which would allow the TUBs to expand their pilot across much larger population of their user base. DAC 2.0 : Will tackle any shortcomings of DAC 1.0. Address additional security requirements that the TUBS consider it as pertinent. Also includes building summary to detail drilldowns that will eliminate the need to build granular access control. DAC 3.0 : Will tackle any shortcomings of DAC 1.0/2.0. Address additional security requirements that the TUBS consider it as showstopper to decommission the CREW Financial Reports.

OBI Data Access Controls – Oversight and Decisions Engagement Councils Pilot Users Finance Working Group Inform or Recommend* Executive Committee Advise OBI Finance Sub-committees DAC Advisory Council Project Leadership Group Inform or Recommend* Project Team Advise If FWG and PLG agree on recommendation: Executive Committee is informed of decision. If FWG and PLG do not agree on recommendation: FWG and PLG each recommend their desired approach to the Executive Committee, and the Executive Committee decides. *

Key Dates for Authorized Requestors January 2017 – anticipate asking for submission of Wave 5 pilot access April 2017 – Wave 6 pilot access requests July 2017 – Full-Scale roll-out begins November 2017 – Target Decommission Date for Remaining CREW Financials content Helpful Links for Authorized Requestors OBI Instance - https://obi-prod.cadm.harvard.edu/analytics Engagement Council Monthly Action Plans – https://wiki.harvard.edu/confluence/display/OBIEEProject/MFR+Engagement+Councils DAC 1.0 – https://wiki.harvard.edu/confluence/display/OBIEEProject/DAC+1.0

Data Access Controls Advisory Council 9/14/2018 Data Access Controls Advisory Council Name Organization Kristen Anderson Harvard Divinity School Katie Hope TH Chan School of Public Health Gail Pisapio Faculty of Arts and Sciences Maureen Forrester Office of the Controller Amanda McDonnell Financial Accounting and Reporting Sarah Axelrod Office of Sponsored Programs Mitch Rogers HUIT – Data Management Services Theresa Butler HUIT– Client Services Alison Wellman Smith John Saperia Bill Brickman Raj Mariadoss Karen McInnis MFR Project 16

Concur

Business Process Leverage the existing process and role of the Authorized Requester to coordinate Concur access requests Tubs have been instructed to work with their Authorized Requestors to request access to Concur The form is available on the Concur Website The Concur Access form must be completed and sent to concurhelp@harvard.edu

On Boarding FAS Athletics, Memorial Church, HDS, ART, GSD Concur implementation team works with Tub Finance office to complete onboarding spreadsheet (approvers/exception delegates) Onboarding spreadsheet is sent to concurhelp@harvard.edu by Authorized Requestor Additional Concur access requests must utilize the Concur Request form Live Tubs: HBS (staff), GSE, Harvard University Press, Villa I Tatti, HKS, AAD, FAS Athletics, Memorial Church, HDS, ART, GSD Coming Next: HMS, Chan SPH - (early adopters), HLS, HSDM, CADM (including Campus Services and HUIT)

Concur Access Employee’s in the following PeopleSoft pay group will automatically feed in to Concur as users– MFC, MIP, PFX, POU, PON, SPC, WPT, WRT A Concur Access form must be completed for adding/deleting: Non-employee – individual not in the above pay groups Approver Access Approver – granting access to approve reports (can be combined with Chart of Account approver role) Chart of Account approver– granting access for a specific tub/org(s) combination. Must also have approver access for this role Delegate Exceptions – provides the authority for someone other than the reimburse to submit a report on their behalf. Financial Dean approval must accompany the request

9/14/2018 QlikView Demo (coming soon)

Harvard Training Portal 9/14/2018 Harvard Training Portal

9/14/2018 ROPPA Update

Miscellaneous Updates Vendor Request Enhancement CSRequest email account cannot accept Accellion files Reminder – 1x1 training and refreshers are available to all, Contact Client Services at FSS_Client_Services@harvard.edu to request a 1x1 training

Q&A – Next Steps Questions All of todays materials will be sent to all of you by email and will be posted on the Website