Corporate Governance - Governance, Risk, and Compliance Topic for Oracle Applications - page 78

In the Managing Records Retention Policies with Content Management Server section, we
demonstrated the best way to organize the storage of documents in the document
management system. We demonstrated the folder structures that best reflect the
sensitivity levels and the access control lists that protect them. We demonstrated
typical document categories and showed reasonable records retention policies
for those document categories given the legislative constraints and discovery
requirements. We showed how the records retention policies are implemented
for each document category for how documents are destroyed at the end of their
retention period. We reinforced the need to ensure that documents can truly not be
discovered at the end of their document retention period.
In the Financial planning and analysis with Hyperion FR section, we turned the strategic
plan into a financial plan. We showed how the assumptions on which the plan
is based are brought into the planning environment, where scenarios are built,
assumptions are tested, and the plan is routed for approval. We showed the analysis
of the actual results against the budget and then finally showed how the results
might be reported.
In the Monitoring Execution with Oracle Business Intelligence section, we examined
how we could trace execution of the strategy that we had laid out in out balanced
scorecard through Business Intelligence. We sat with the Board and showed how the
objectives in the balanced scorecard that we agreed with the investors can become a
Key Performance Indicator on the dashboards that monitor and drive management.
We took a look at just a few of the dashboards that make up the Oracle Business
Intelligence application and showed where the metrics, which they expose, should
be represented in the balanced scorecard.
In the Enterprise Risk Management section, we gave a brief introduction to the topic
of risk management. We explained the overlap between the strategic management
activities and risk management activities. We introduced the Chief Audit Executive
to the Board. We also introduced two of the vehicles that he uses to brief the Board
on the risks to the enterprise: the Risk Assessment and the Audit Plan. We gave a
glance at Oracle's Governance Risk and Compliance Manager as the application in
which this process is run.
In the Whistle-blower protections section, we worked with the Audit committee on their
whistle-blower system. We explained the important provisions of Sarbanes-Oxley
with respect to the need to provide employees with a way to report their concerns
confidentially and without fear of prejudice. We showed how to set up the guest
account in iSupport and showed how to configure a support request template to be
able to capture whistle-blower complaints.
In the next chapter, we examine the next domain of governance—IT Governance.