IT Audit - Governance, Risk, and Compliance Topic for Oracle Applications - page 245

The following reports are the additional reports that are commonly used to help
analyze incidents:
• Incident by Control Summary Extract report : Use this to get a summary
of pending incidents for each control. See the last time the control was run,
any comments associated and use as a general summary level report to help
determine where to focus your remediation on.
• Access Incident Details Extract report : The ability to extract data from the
Manage Incidents screen is for using pivots and filters to slice and dice data
in a variety of ways. Generally, you start with graphs and other summary
reports to understand where you should focus. Once you have determined
the area on which you want to focus for remediation (that is controls, roles,
risks, business areas, users, or a combination of these), go to the Manage
Incidents screen and enter your filter to view the data to extract. Then select
Access Incident Details Extract Report from the drop-down and click
on Extract .
Once you have the data in Excel or a similar application, slice and dice
the data to view conflicts in a way that will help you with the remediation
process. For instance, creating a quick pivot table in Excel is a great way to
see where your conflicts are and what paths are causing the incidents.
• Access Point report : This report can be used to get conflict path information,
which will help lead to access model hierarchies that need to be cleaned up
in the system. For instance, if you find that the Access Violations within a
Single Role report identifies the Vendors and Payment Actions functions
as conflicting access points, you can use the Access Point report to find the
access paths those functions are used in.
Assigning incidents to business owners
When a control is violated, all participants with assigned incident set to Yes are
assigned to the incidents generated. It may be appropriate to reassign incidents to
a business owner who is more directly interested in the incident. When that person
logs on to the Manage Incidents screen, they will automatically be viewing all the
incidents assigned to them.