Introduction - Governance, Risk, and Compliance Topic for Oracle Applications - page 10

Chief Operating Officer
Many of the controls in the business are part of the processes and procedures
operating in the Business Units themselves. For example, your revenue line
might be unreliable due to side contracts that are made by your salespeople.
Management in the business is responsible for the design of the controls and
certifying their effectiveness.

The Audit and Compliance process
The following figure explains the Audit and Compliance process starting with the
establishment of the program office and ending with certified financial statements:

Author
Business
Processes

Document
Findings

Scope
Audit
Engagements

Establish
Program
Office

Establish
Enterprise
Structure

Test
Internal
Controls

Certify
Business
Processes

Certify
Financial
Statements

Conduct
Assessments

Establish
Risk &
Controls
Library

Implement
Changes

Business
Process
Owner

Internal
Auditor

Signing
Officer

Internal
Auditor

BPO &
Global
Operations
Owner

While there are many processes that support and feed into the audit processes
process, it is important to realize who the players are at the end of top level process.
The process has to make evident to investors and regulators that risks are managed.
Once an Audit and Compliance process is established, it goes through a risk
assessment, audit planning, documentation phase, a testing phase, and a reporting
phase, before the results are combined with the financial disclosures and signed by
the management.