Documenting Your Controls - Governance, Risk, and Compliance Topic for Oracle Applications - page 158

• Oracle GRC Manager includes content management services to manage
business process documents that must be monitored to ensure accurate
risk assessment and control verification. All business processes are linked
to business units (folders) in organization maps. For example, a business
process document can be created for a payroll unit in the organization
map, and the process will contain documented information on assertions,
risks, controls, attachments, and test instructions. The following screenshot
displays the InFission folder structure to maintain documents by process
and maintain folders for each business unit where the process is performed:
The user who creates or owns the business process can specify assertions, risks,
controls, test instructions, and file attachments (flowcharts). Reviewers can review
and approve the information, and testers can test the controls and save the test
results in the business process documentation. All the information is tracked through
the business process, which is linked to a unit in the organization map. When a user
creates a report, the documents stored and tracked for an organization's business
processes are searched to compile the required information.