Where to begin, lets start off with a high level summary of the Oracle Governance, Risk & Compliance Management Suite of modules. There are three groupings in which the modules are organized, they are Risk & Financial Governance, Performance & Financial Controls and Access & Segregation of Duties Controls. Within these three groups you will find the modules that Oracle has developed in the Oracle Fusion Applications, Oracle Governance, Risk & Compliance Management Suite. We will be discussing the Risk & Financial Governance module with the Performance & Financial Controls being discussed next and Access & Segregation after that. Needless to say these modules have all been adopted within the Preliminary Specification.
To the larger issue of compliance and governance and how a firm gets a firm handle on the growing demand for more regulation. Oracle and People, Ideas & Objects have similar ideas as to how to keep ahead in this difficult area. Oracle asks the following.
No one expects that this is the end of new industry and legislative requirements, so business executives continue to struggle with questions such as: How can we stay on top of regulatory demands while controlling costs? Can we better manage risk to prevent business and compliance failures? How do we achieve better performance while ensuring accountability and integrity?
And it is through automation, Information Technologies and the use of specialization and the division of labor that the innovative oil and gas producer can achieve these objectives of getting ahead of the regulations. As we have proposed in the Preliminary Specification, the producer that participates in the user community has the opportunity to shape the software that they will use. People, Ideas & Objects is user defined software based on the Joint Operating Committee. Giving the producer the ability to remake their organization into an innovative, profitable and performance oriented oil and gas producer.
In terms of Oracle’s Risk & Financial Governance module producers will be able to increase the efficiency of compliance processes, improve the reliability of the financial reporting and anticipate and respond to risk. We discussed the element of risk in the Financial Marketplace module and the assessment of all of the investments based on their anticipated returns. Each of the potential investments have to be “risked” in order to bring the return on to comparable terms that considers the risk. It is here that the the two modules, the Oracle Risk & Financial Governance, and the Financial Marketplace modules will have some cross over. It is also at this point that our two firms have similar attitudes, again, with respect to how the producer attains value. Oracle states.
KPMG's Assurance & Advisory Service Center understood early that value and risk go hand in hand and that performance and risk management should converge to create, enhance and protect stakeholder value. In May 2007, the Institute of Management Accounting further characterized Enterprise Risk Management as aligning strategy, processes, technology, and knowledge with the purpose of evaluating and managing the uncertainties the enterprise faces as it creates value. It considers ERM to be a truly holistic, integrated, forward-looking, and process oriented approach to managing all key business risks and opportunities—not just financial ones—with the intent of maximizing stakeholder value as a whole.
This will be a key insight that the user community will be able to build off of the People, Ideas & Objects Financial Marketplace and Oracle’s Risk & Financial Governance modules.
The Oracle Transaction Controls Governor is an application that is designed to continuously monitor key transactions. It also provides monitoring of data and application modifications. In terms of reviewing transactions, much of the application is programmable and can be set to look for certain criteria. This is done through an interface that is intuitive and easy to set up a control to monitor all transactions for certain behavior. Oracle also provides a library of internal controls that can be deployed if the producer finds them of value. People, Ideas & Objects, working on behalf of our subscribing producers, will also provide a library of these controls that are specific to the innovative and profitable oil and gas producer. These controls output can then be directed to the appropriate individual within the firm to have them dealt with.
Oracle’s Configuration Controls Governor is an Oracle Fusion Application that provides Sarbane’s Oxley compliance to the producer for IT infrastructure configuration changes. When there is a change to your IT environment, the who, what, where and when of the change is sent to the appropriate people within your organization. There they can review the changes to ensure that they were carried out in compliance with the companies policies. The Configuration Control Governor also provides the ability to establish tolerances on fields. So if a user entered a number that exceeded the value of the fields tolerance, the transaction would be rejected.
During our discussion of the Compliance & Governance module we discussed the need for more internal controls. And these transaction and configuration controls will bring an element of the internal controls under appropriate governance. That these are automated helps to provide a strong understanding of the appropriateness of the global transaction base the producer firm has based their financial reports upon. However, they are not the whole picture when it comes to internal controls. And that is where the Oracle Preventive Controls Governor comes into play. Using configurable workflows, Oracle Preventive Controls Governor enables the user to design and implement appropriate internal controls for their firm. This tool provides both contextual and intrinsic policy applications to business processes.
We take a look at Oracle Fusion Applications, Governance, Risk & Compliance Suite, Access Controls Governor module. This will be an important element of the Preliminary Specification as segregation of duties (SOD) has taken on an heightened importance in the firm. Whether that is as a result of the regulation or from the need for better governance, SOD offers many advantages to the innovative oil and gas producer. Having multiple people involved in the process from beginning to end ensures that no one individual can manipulate resources of the firm for their own benefit.
Oracle notes the following is also part of the Access Controls Governor modules functionality.
Global regulations are driving organizations to improve the transparency and accountability of financial data, processes, and transactions. Controlling, tracking, and reporting on user activity within the application environment are critical components of compliance.
So apparently big brother needs to be watching. And as good as your internal controls may be, there will always be ways in which the system might be “hacked” in ways that were unknown before. Thankfully Oracle’s Access Controls Governor module is automated and implements the policies based on management's understanding. There is also a library of controls that can be implemented that was developed by Oracle in collaboration with leading audit and consulting firms. As with the libraries that were mentioned, People, Ideas & Objects will maintain a library of these policies for the innovative and profitable oil and gas producer. And the system is not just reporting on violations, it is actively stopping and enforcing SOD when they occur based on those policies. And they can be somewhat dynamic and proactive in their enforcement, stating that no user can be involved in more than two steps of a five step process, and disallowing the user to sign on to another process at the time of assignment.
When preparing policies for implementation the Oracle Access Controls Governor provides a tool for simulating the new policies. Using the historical record of user access as the base of information it can run the new policy against that data to determine what the outcome of that new policy will be. Would there be any new violations, and / or false positives etc? Then they can tune the policy based on the feedback that they get from the tool to ensure that it is catching only the desired situations. Saving costly resources in the future.
From a People, Ideas & Objects perspective the Oracle “Governance” applications that we have discussed help to bring 21st Century internal controls to the Preliminary Specification. When we think of the manner in which the industry will operate with large portions of the existing producers overhead being provided by service providers. And those service providers accessing their work through the People, Ideas & Objects Preliminary Specification. Extension of these internal controls to those individuals will be needed as well. The producer will need to know that these controls are effective in their firm, their Joint Operating Committees and the service providers they hire to maintain their firm.
The
Preliminary Specification provides the oil and gas producer with the most
profitable means of oil and gas operations. People, Ideas & Objects
Revenue Model specifies the means in which investors can participate in these user defined software developments. Users are welcome to join me
here. Together we can begin to meet the future demands for energy.