IT Audit - Governance, Risk, and Compliance Topic for Oracle Applications - page 239

Analyzing controls
Incident analysis and remediation of control violations is an iterative process. This step
requires participation of appropriate control owners and application administrators.
Once the initial walk-through using the model analysis described in the previous
step is completed, you will have loaded the content as models and reviewed and
updated the entitlement and model definitions to ensure they are applicable to
your company, and you may have even done some initial clean up.
At this point, you should have deleted models that do not make sense for your
company and promote those models that do make sense as controls.
When deploying the models as controls—based on the subject matter expert
workshops and close interaction with the control participants who know and
understand the control and risk—you should have been able to add a priority
and any tags that will help you categorize and prioritize controls.
You are now ready to run control analysis. Your access control objectives will
determine your next steps. If you already know, for instance, that the access
controls in the Procure-to-Pay process are your highest priority, you may choose
to run analysis only on controls with that tag. If you are not sure about where to
focus your efforts first, you may want to run analysis for all controls to view the
incidents by control. Next you can select the controls with the greatest number of
incidents. This may help in giving you the direction that you need to select a focus
area to begin remediation on.
Remediation
Depending on your company's access control objectives, determine focus areas to
begin analyzing.
A focus area is any category of information on which you want to base
your remediation efforts—perhaps business process, or control, or any
other category that produces a large number of incidents.