Documenting Your Controls - Governance, Risk, and Compliance Topic for Oracle Applications - page 173

The following list summarizes the workflow steps:
1. A user with rights to a business process, usually an administrator (or
someone in the audit department), initiates data collection.
2. An e-mail notification is sent to the assigned process owner, notifying the
owner to enter the system and check their Inbox . The e-mail notification
includes a link to the system that takes the user to the application login page.
3. The process owner opens the business process and contributes data for
assertion, risk, control, test instruction, and attachment documentation. Then
the owner either approves the process or rejects the process, which is shown
in the following screenshot.
4. If the process is approved, it is removed from the process owner's Inbox and
sent to the next step.
5. If the process is rejected, an e-mail is sent to the user who initiated the data
collection, notifying them of the reason for rejection. The initiator can then
choose to restart the workflow or delete the workflow.
6. An e-mail notification is sent to the assigned reviewer(s) who are responsible
for reviewing data for assertion, risk, control, test instruction, and attachment
documentation for the business process. The e-mail notification includes a
link to the system that takes users to the application login page.
7. The users review each assertion, risk, control, test instruction, and attachment
document. When finished, reviewers either approve or reject the process.
8. If the process is approved, it is removed from the reviewer's Inbox and sent
to the next step.
9. If the process is rejected, the reviewer enters a message explaining why the
process was rejected, and the message is sent to the process owner to modify
the process documentation.
10. An e-mail notification is sent to the workflow initiator (usually an
administrator or someone in the audit group), notifying the user to enter the
system and check their inbox. The e-mail notification includes a link to the
system that takes the user to the application login page.
11. The workflow initiator is the final reviewer. The user reviews the assertion,
risk, control, test instruction, and attachment documentation, and approves
or rejects the business process. The user can change any of the documentation
to ensure its integrity and validity.