IT Audit - Governance, Risk, and Compliance Topic for Oracle Applications - page 250

Managing access approval
Once most of the remediation has taken place, and the control owners have mitigated
the access risks to an acceptable level, the AACG Manage Access Approvals feature
is enabled. This feature implements preventive SOD controls—it applies access
controls to users as they are being assigned duties in the Oracle FND Users form or
the PeopleSoft User Profile page. It rejects role assignments that violate a preventive
control, and accepts assignments that violate a monitor control (or no control). If an
assignment violates an approval required control, AACG suspends the assignment
and displays an entry for it in a Manage Access Approvals panel, for review by the
participants designated by the control. If a reviewer approves, the assignment is
allowed; if he rejects, it is disallowed.

In order to enable Access Approvals , you must not only turn it on, but also create
at least one GRCC role that incorporates the Manage Access Approvals permission,
assign that role to users, and for those users (or participant groups to which they
belong) set the Assign Incidents to Yes in Controls .

In order to turn Manage Access Approvals off in Oracle:

1. Log in to Oracle E-Business Suite.

2. Select GRC Controls in your list of Responsibilities . (First, ensure that

the GRC Controls responsibility is available to you).

3. Under the heading Preventive Controls Governor , click on the Form

Rules link.

4. A GRC Controls (Oracle rules) form appears. It provides access to three

Preventive Controls Governor applications. Make sure the Form Rules
tab is selected.

5. In the Rule Name field, query for a rule named User Responsibility

Assignment Rules . (Press the F11 key, type the rule name in the Rule
Name field, and then press Ctrl + F11 ).

6. With the rule loaded in the Form Rules form, clear its Active checkbox.

(Clear the one that applies to the entire rule, nearest to the top of the form.
Ignore Active checkboxes in the Rule Elements section of the form).

7. Save the rule. Click on File in the menu bar, and then on Save in the

File menu.

8. The following screenshot shows the Oracle EBS User security form with

the Actions menu to activate a requested responsibility after the preventive
control is enabled: