Security, Audit and Control Features Oracle PeopleSoft, 3rd Edition

Between the covers of this book, readers will find all the details needed to confidently plan and execute a detailed review of risk and controls in a PeopleSoft environment. A lot has changed in terms of new product features, new releases and various regulatory compliance requirements for enterprises since the second edition of this guide was published in 2005. This third edition aims to ensure that the audit programs, risk and controls are functional and relevant with current research for Oracle PeopleSoft HRMS release 9.1. In addition, chapter 12, New Directions for PeopleSoft and ERP Audit, discusses the changing compliance landscape, tools to assist with compliance and Oralce Fusion, and the pathway for PeopleSoft installations.

This publication has been written with the business manager in mind. IT and audit and assurance professionals will also find it highly informative and helpful. Other audiences include security and risk management professionals. Parts of the publication are written for those looking to learn more about how PeopleSoft applications work, as well as the strategic and risk management issues. However, for the most part, the book assumes that the reader has a fundamental working knowledge of PeopleSoft.

Although there are many books that have been written on PeopleSoft, they are more narrowly focused on the implementation, business aspects or how one of the PeopleSoft modules actually works. This publication is unique in that it deals with aspects of risk management, audit, security and control over PeopleSoft. These are important aspects that have not been dealt with previously in a comprehensive manner in one publication. The book is also unique in that it contains audit/assurance programs, audit suggestions and internal control questionnaires (ICQs) for the business cycles addressed within the publication.

This series of technical and risk management reference guides deals with security, audit and control features of ERP systems. The series is intended to be considered collectively; consequently, common business processes and the related risk and control features are not covered in each and every guide.

Oracle's enterprise resource planning (ERP) software is among the biggest business packages ever released. Designed to automate multiple enterprise and corporate operations and processes, Oracle E-Business Suite (EBS) is a very large system of more than 130 integrated business applications and IT infrastructure modules. Many organizations looking for robust and integrated solutions adopt this suite. Security, Audit and Control Features Oracle E-Business Suite, 3rd Edition, as well as its previous editions, is the major published reference covering the security, audit and control points of view and requirements. Business regulatory compliance and the complexity of EBS technology make this publication a practical tool and source of reference for many audiences, including business executives and managers, IT auditors, and security officers. This publication is also a unique reference that covers specific Oracle EBS Release (R) 12 auditing aspects with a formal methodology, an IT audit framework and a risk-control approach.

Two aspects of the book are of particular note. First, there is a balance between techniques and technology on one side and audit framework and methodology on the other. Second, the "popularization" of ERP auditing concepts with a risk-based audit framework is discussed and working tools and adapted templates are provided. These are based on best practices and models (including Committee of Sponsoring Organizations of the Treadway Commission [COSO], COBIT and the Information Technology Assurance Framework [ITAF]) and are provided to assist in conducting practical audit and assurance activities on EBS built-in processes.

The publication aims to adapt existing auditing techniques into an Oracle EBS context to facilitate the audit "contextualization" with an audit framework and practical information on risks, key controls, testing procedures, etc.

The book is a practical introduction to the management of ERP-based operations and risks within Oracle EBS R 12, financial accounting and expenditure business cycles.

The publication discusses newer topics than the second edition. It includes about 150 pages of audit work templates as part of an audit/assurance program. useful templates are provided for EBS business processes including:

• Audit plans for:
• The Financial Accounting Business Cycle
• The Expenditure Business Cycle
• Oracle Security Administration
• A maturity assessment template to help maturity management of related COBIT control practices
• Internal control questionnaire (ICQ) to build on Oracle EBS processes with references to COBIT practices

These appendices extend the practical aspect and usability of this publication.

Security, Audit and Control Features Oracle E-Business Suite, 3rd Edition, provides a very good audit framework, templates, known risks and common key controls for each EBS process (financial scope). In specific operational circumstances and contexts, there may be additional risks not included in this book and others may not apply. Adaptation to specific situations is the auditor's challenge and still requires appropriate judgment.

--Mustapha Benmahbous, Ph.D., CISA, CISM - ISACA Journal, Volume 6, 2010