IT Audit - Governance, Risk, and Compliance Topic for Oracle Applications - page 246

Running simulation
In order to aid in cleanup, Application Access Controls Governor enables you to
simulate graphically how incident generation would change if configuration of the
business management application were altered, and to create remediation plans
from the simulations. Each step in a simulation names an access point that might be
excluded from another access point in Oracle EBS, for example, a function that might
be excluded from a responsibility.

A simulation model enables you to select an access point and display its hierarchy—a
diagram showing how the access point connects to all other access points that relate
to it as parents and children . In the diagram, you select parent-child pairs of access
points and then remove each child from its parent. As you do, the simulation feature
builds a remediation plan, essentially listing, as steps, the child access points and the
parents from which they would be removed. Once you are satisfied with your plan,
you run statistics to determine how the removal of the child access points from their
parents would impact your incidents, roles, controls, and users. You can print the
remediation plan from your computer, in order to refer to it if you choose actually to
implement the plan in your business-management system.

For example, to remove the Supplier maintenance function from Payables Manager,
you can create the following simulation:

1. Analyze incidents in the Manage Incidents page, analyze the visualizations,

and/or various reports.

2. Determine a child access point that you would like to remove from a parent

access point.

3. Create a simulation to see how this would impact your incidents:

° Apply the child access point to a simulation model
° Filter by user and role to limit what is shown in the model to a
readable amount of data
° Add a remediation step
° Run statistics
° Iterate through this process until you are satisfied with
remediation steps