Oracle GRC Live Kick Off 4/22/2017 Oracle Governance, Risk and Compliance (GRC) Solutions Training Using Real Business Cases and Live Oracle GRC Controls Suite Oracle GRC Live Kick Off Welcome Welcome to the Kick Off for Oracle GRC Live, which is a series of webinars designed to help the Oracle Governance, Risk and Compliance (GRC) Professionals who have been invited to join the OIC TOP Team of Oracle GRC Functional Professional Contractors. Training with Real World Business Cases with Real World Oracle GRC Solutions

Agenda During this webinar, I will describe: 4/22/2017 Agenda During this webinar, I will describe: My Motivation for Oracle GRC Live Our Objectives for Oracle GRC Live Our Training Schedule and Format Business Case for our Real World Scenario Client’s Objectives Our Proposed Oracle GRC Solution OIC Oracle GRC Implementation Method (GRCIM) Links to Oracle GRC Resources Q&A Session 4/22/2017 Copyright © Oracle Independent Consultants (OIC) LLC, 2011. All rights reserved. Training with Real World Business Cases with Real World Oracle GRC Solutions

Place Highly Talented Oracle GRC Professionals on Oracle GRC Projects 4/22/2017 My Motivation Place Highly Talented Oracle GRC Professionals on Oracle GRC Projects OIC cannot grow without a network of highly talented Oracle GRC, Security and Internal Controls Professionals. We need: Oracle GRC Functional Professionals to Implement and Configure GRC Controls Suite on OIC and 3RD Party Projects Risk Management Professionals to assume leadership positions with the OIC to develop Risk Assessment and Risk Management Solutions, and help companies improve their Financial Closing and Financial Reporting Processes using the Oracle GRC Controls Suite of Applications, Oracle GRC Manager and Hyperion Financial Management. Director of Sales and Marketing / Business Development (Commission) Director of Oracle GRC Internships OIC is a global virtual Oracle Governance, Risk and Compliance (GRC), Security and Internal Controls Practice where Oracle GRC Professionals earn, at least, $80 per hour plus expenses and have an opportunity to share profits and equity. . 4/22/2017 Copyright © Oracle Independent Consultants (OIC) LLC, 2011. All rights reserved. Training with Real World Business Cases with Real World Oracle GRC Solutions

Find the Best, Train the Best, Be the Best 4/22/2017 Objectives Find the Best, Train the Best, Be the Best Find highly motivated and talented Accounting, Auditing, Compliance, GRC, Risk Management and Oracle Financial Professionals Provide opportunity to discuss real world business cases and design Oracle GRC solutions to satisfy requirements for client Business Processes Implement Solution in Oracle GRC Controls Suite using OIC GRC Sandbox, thus gaining valuable hands on experience implementing and using the most current releases of the applications in the Oracle GRC Controls Suite Develop TOP Team of Oracle GRC, Security and Internal Control Professional Contractors that represent the best talent in the industry 4/22/2017 Copyright © Oracle Independent Consultants (OIC) LLC, 2011. All rights reserved. Training with Real World Business Cases with Real World Oracle GRC Solutions

Training Schedule and Format 4/22/2017 Training Schedule and Format Oracle GRC Live – Our Training Schedule Meet Tuesday evenings from 6:30 to 7:30 pm CST to: Review progress on exercises assigned during the Saturday afternoon session Provide Q&A Session Provide Status Update of OIC Meet Saturday afternoons from 1:30 to 3:30 pm CST to: Review your lab exercises that you completed. Provide an Overview of a New Topic Review lab questions Review and demo how to complete lab exercises 4/22/2017 Copyright © Oracle Independent Consultants (OIC) LLC, 2011. All rights reserved. Training with Real World Business Cases with Real World Oracle GRC Solutions

Business Case Scenario for Oracle GRC Live 4/22/2017 Business Case Business Case Scenario for Oracle GRC Live Your client is a US public company with annual revenues of approximately $2.5 Billion Dollars. They operate four different US Legal Entities CORP, CO01, CO02, and CO03. Companies 01, 02 and 03 each operate several processing plants. Each Company (i.e. Legal Entity) uses the same calendar, currency and chart of accounts. Each Company will also be defined as an Operating Unit Client is currently using Oracle Release 11.5.10.2 for Oracle Financials, Oracle Supply Chain, Oracle HR and PR and other Oracle Applications. Client is also currently implementing Oracle Release 12.1.3 for one or more Organizations. Client will have three (3) production instances: US for R 11.5.10.2, US for R 12.1.3 and Brazil for R11.5.10.2 4/22/2017 Copyright © Oracle Independent Consultants (OIC) LLC, 2011. All rights reserved. Training with Real World Business Cases with Real World Oracle GRC Solutions

Ensure Adequate Compliance, Security and Internal Controls 4/22/2017 Client’s Objectives Ensure Adequate Compliance, Security and Internal Controls Comply with Sarbanes-Oxley Act of 2002 (SOX) Remove Material Deficiency for Inadequate SOD Ensure New Implementation Complies with SOX Implement Continuous Controls Monitoring Monitor Differences in Configuration Parameters 4/22/2017 Copyright © Oracle Independent Consultants (OIC) LLC, 2011. All rights reserved. Training with Real World Business Cases with Real World Oracle GRC Solutions

Proposed Oracle GRC Solution 4/22/2017 Proposed Oracle GRC Solution Implement Configuration, SOD, Transaction and Preventive Controls Control Oracle GRC Solution Comments Configuration Management CCG 5.5.1 Take Snapshot of Baseline Configuration Compare Snapshots between Occurrences, Ledgers, Operating Units, and Instances Change Management Define Change Tracking Definitions to track changes for one or more objects defined in the schema for a specific Oracle Application and Instance Define Change Tracking Queries to track changes for one or more objects defined in the schema for one or more Oracle Applications, Instances, Users, and Time Period. Send Notifications to Specific Users when someone changes a parameter. 4/22/2017 Copyright © Oracle Independent Consultants (OIC) LLC, 2011. All rights reserved. Training with Real World Business Cases with Real World Oracle GRC Solutions

Proposed Oracle GRC Solution 4/22/2017 Proposed Oracle GRC Solution Implement Configuration, SOD, Transaction and Preventive Controls Control Oracle GRC Solution Comments Application Access Controls AACG 8.6 Monitor User Access to one or more specific Functions in an Oracle EBS Instance Segregation of Duties Import Oracle Predefined Best Practices Library of Segregation of Duties (SOD) Controls, Templates, and Models. 4/22/2017 Copyright © Oracle Independent Consultants (OIC) LLC, 2011. All rights reserved. Training with Real World Business Cases with Real World Oracle GRC Solutions

Proposed Oracle GRC Solution 4/22/2017 Proposed Oracle GRC Solution Implement Configuration, SOD, Transaction and Preventive Controls Control Oracle GRC Solution Comments Transaction Controls TCG 8.6 Monitor Transactions (as opposed to Configuration Parameters) to mitigate the risk of fraud and material misstatement in Company’s Financial Statements. Preventive Controls PCG 7.3.2 Integrate PCG with AACG 8.6 to implement preventive controls for User Provisioning Limit access to fields, buttons, list of values and other objects on JAVA forms (not HTML forms) 4/22/2017 Copyright © Oracle Independent Consultants (OIC) LLC, 2011. All rights reserved. Training with Real World Business Cases with Real World Oracle GRC Solutions

OIC Oracle GRC Implementation Method (GRCIM) GRCIM leverages Oracle Unified Method (OUM) 5.3 to develop a predefined set of deliverables to support the implementation of Oracle GRC Controls Suite including: Oracle GRC Controls (GRCC) 8.6 Oracle Application Access Controls Governor (AACG) 8.6 Oracle Transaction Controls Governor (TCG) 8.6 Oracle Configuration Controls Governor (CCG) 5.5.1 Oracle Preventive Controls Governor (PCG) 7.3.2 GRCIM also leverages OUM to implement: Oracle GRC Intelligence (GRCI) 3.01 Oracle GRC Manager (GRCM) 8.0 4/22/2017 Copyright © Oracle Independent Consultants (OIC) LLC, 2011. All rights reserved.

Links to Oracle GRC Resources 4/22/2017 Links to Oracle GRC Resources Step Description Results 1 OIC GRC Express Portal System displays the OIC GRC Express Portal, which provides Access to GRC Sandbox, GRC Training Platform, OIC University. 2 OIC Oracle GRC Sandbox You can access the individual Oracle GRC applications. 3 OIC Oracle GRC Training Platform You can access Oracle GRC Manuals and OIC Oracle GRC Training Documents. 4 OIC Requirements for Oracle GRC, Security and Controls Professional You can review our requirements for Oracle GRC, Security and Controls Professionals 5 Oracle GRC Resources I urge you to review the OIC website and links to Oracle GRC Resources 6 OIC Oracle GRC Express Blog I urge you to participant by adding posts, comments, etc. 7 OIC Global Oracle GRC Contractors Network I thought we could use this portal for e-Learning and Chat. 8 OIC YouTube Review the short videos that I have uploaded. 4/22/2017 Copyright © Oracle Independent Consultants (OIC) LLC, 2011. All rights reserved. Training with Real World Business Cases with Real World Oracle GRC Solutions

Lab Questions # Question Type of Internal Control Provided 1 4/22/2017 Lab Questions # Question Type of Internal Control Provided 1 What are the GRC applications included in the Oracle GRC Controls Suite? AACG GRCI GRCM CCG PCG TCG Question #1 The correct answer includes 1, 4, 5 and 6. 4/22/2017 Copyright © Oracle Independent Consultants (OIC) LLC, 2011. All rights reserved. Training with Real World Business Cases with Real World Oracle GRC Solutions

Lab Questions # Question Type of Internal Control Provided 1 4/22/2017 Lab Questions # Question Type of Internal Control Provided 1 Map the following Oracle GRC Applications to the Controls Listed TCG GRCI GRCM AACG PCG CCG Segregation of Duties Configuration Management Transaction Controls Change Management Preventive Controls Application Access Controls Question #1 TCG maps to Transaction Controls. GRCI does not map to any of the controls listed. GRCM does not map to any of the controls listed. AACG maps to Application Access Controls PCG maps to Preventive Controls CCG maps to Configuration Controls 4/22/2017 Copyright © Oracle Independent Consultants (OIC) LLC, 2011. All rights reserved. Training with Real World Business Cases with Real World Oracle GRC Solutions

Lab Questions # Question Answer 2 4/22/2017 Lab Questions # Question Answer 2 Can you install Oracle CCG 5.5.1 on a Virtual Server? 3 Can you Configure CCG 5.5.1 with an EBS Instance that uses RAC? 4 What is the GRC Support Matrix? 5 What triggers the generation of the baseline snapshot and baseline change tracking definitions? Question #2 No, Oracle CCG 5.5.1 must be installed on a physical server. Question #3 No, most likely the Configure CCG Process will fail for the instance installed in a RAC environment. Moreover, Oracle may not support the integration with an instance in a RAC environment. Question #4 Identifies the hardward and software requirements to be eligible for Oracle support of the Oracle GRC Applications. Question #5 Oracle CCG automatically generates baseline Snapshot and Change Tracking Definition Templates for each application that you add to the configuration (see Configure CCG) and then you generate the concurrent process called Configure CCG. 4/22/2017 Copyright © Oracle Independent Consultants (OIC) LLC, 2011. All rights reserved. Training with Real World Business Cases with Real World Oracle GRC Solutions

Lab Exercise Step Description Results 1 Log into Oracle CCG 5.5.1. 2 4/22/2017 Lab Exercise Step Description Results 1 Log into Oracle CCG 5.5.1. 2 Log into Oracle GRCC 8.6 3 Log into Oracle R12.1.1 and select GRC Controls Responsibility 4 Log into OracleElearning.com/Moodle 5 Log into all other links provided 4/22/2017 Copyright © Oracle Independent Consultants (OIC) LLC, 2011. All rights reserved. Training with Real World Business Cases with Real World Oracle GRC Solutions

Questions and Answers Session 4/22/2017 Q&A Questions and Answers Session 4/22/2017 Copyright © Oracle Independent Consultants (OIC) LLC, 2011. All rights reserved. Training with Real World Business Cases with Real World Oracle GRC Solutions

Summary During this lesson, you learned: 4/22/2017 Summary During this lesson, you learned: CCG Provides Internal Controls for: Configuration Management Change Management Controls Prerequisites for an Oracle GRC Solution Supported by Oracle Generate Baseline Snapshot and Change Tracking Definitions Edit, Test and Schedule Snapshot Definitions Log into CCG 5.5.1 Display Your Welcome Page Change Your User Profile Appendices include: Appendix I: Course Outline Using CCG 5.5.1 Appendix II: Links to Oracle CCG Manuals 4/22/2017 Copyright © Oracle Independent Consultants (OIC) LLC, 2011. All rights reserved. Training with Real World Business Cases with Real World Oracle GRC Solutions

4/22/2017 Conclusion This concludes this lesson. You are now ready to begin your adventure with Oracle GRC Live with Real World Business Cases and Real World Solutions Using the Oracle GRC Controls Suite of Applications. 4/22/2017 Copyright © Oracle Independent Consultants (OIC) LLC, 2011. All rights reserved. Training with Real World Business Cases with Real World Oracle GRC Solutions

4/22/2017 About OIC OIC (Oracle Independent Consultants LLC) is an Oracle Gold Partner and focuses solely on providing risk and advisory services, installation, implementation and configuration services, training and resources for Oracle Governance, Risk and Compliance (GRC) solutions, which includes Oracle Security and Control solutions. Contact Us to learn more. You can also call me directly at 214-783-0751 or send an email to roger.drolet@theoicllc.com. Roger Drolet, CPA, MBA, CISA, CITP www.theoicllc.com www.oraclegrcexpress.com 4/22/2017 Copyright © Oracle Independent Consultants (OIC) LLC, 2011. All rights reserved. Training with Real World Business Cases with Real World Oracle GRC Solutions