IT Audit - Governance, Risk, and Compliance Topic for Oracle Applications - page 254

Testing the controls
Once you define the TCG models and controls, you can view the violations of
controls which are called incidents . So that incidents may be resolved, each control
must name one or more participants . Participants are those GRCC users who are
associated with controls either as individuals or as members of participant groups.
At least one participant (either individual or group) is assigned to address incidents
generated by the control. Other participants observe the decisions made by those
who are entitled to act.

If you have defined tags to categorize a TCG model or control, and then assign tag
values to controls, then you will be able to sort displays of controls and the incidents
they generate by tag value. For instance, one might create an Economic Region tag,
and then create values for it, such as America, European Union, Asia Pacific, and so
on. Individual controls that apply to a particular region would then be given its
tag value.

You can select one or more controls in TCG to generate the incidents and analyze
results. In order to begin, choose the controls you want to analyze from the list on the
Manage Controls homepage. In order to select one, click on its row. In order to select
a continuous set of controls, click on the first row, hold down the Shift key, and click
on the last. In order to select a discontinuous set, hold down the Ctrl key as you click
on controls.

Then, do either of the following:

1. Evaluate the selected controls once, immediately. Before doing so, you may

consider synchronizing data from the datasources against which the controls
will run. This would ensure that transaction data is up to date. (You can
synchronize data from the Manage Application Data page, which is opened
from the Administration Management tasks.) In order to evaluate the
controls, select Actions | Run , or click on the Run button. GRCC displays
status of the run at the base of the Manage Controls home page.

2. Create a schedule on which the selected controls run regularly. In order to do

so, select Actions | Schedule , or click on the Schedule button. A Schedule
Parameter dialog will open. In this dialog, enter values that set a name for
the schedule, the date and time at which it starts, the regularity with which
the controls are evaluated, the date and time (if any) on which the schedule
expires, and whether data should be synchronized immediately before each
control evaluation. Then click on the Schedule button.