Managing Access to Oracle

The integrity and security of data within the Oracle Financials system is essential, requiring regular review of system access, prompt user access changes and a mindfulness of the Segregation of Duties policy.

The process and associated financial controls have been written in support of the Financial Regulations.

The process of managing users on R12 is as follows:

• The Oxford Username (also known as Single Sign On) is needed for access to Oracle R12 and to monitor related workflow emails.
• If a new user has several Oracle R12 roles, access is granted to each role on the system separately as soon as the user completes the necessary training for each one, instead of waiting for access to all assigned roles once training for all those roles is completed.
• It is important to remove users’ access to R12 when they leave or no longer use the system, since not doing so can cause workflow issues, e.g. leaving multiple projects without a person to approve expenditure and holding up related orders. 
• When reviewing the UO User Access Report, authorised signatories may want to be particularly aware of key users who have a major impact on workflow, such as: GL Supervisor (approves other users’ journals); Project Requisition Approver (approves other users’ requisitions when coded to projects); and radiation protection supervisors (a role that exists in some departments for monitoring purposes, where a nominated person is notified when hazardous items are purchased).
• Team names and web links have been updated to reflect the current structure.

Responsibility flags

 indicates steps that require departmental involvement.
 

indicates work that the Financial Systems Support Centre manages.

Where an individual has been newly appointed, a New User service request, should be completed and submitted, if possible, even before they have started. This will ensure that everything is in place for their arrival. Before access to Oracle R12 is requested, all users including temporary staff, MUST be added to CoreHR so that an employee number is available. They must also have an Oxford Username (also known as Single Sign On), which is created in the recruitment process after a University Card is requested.

All users (whether new to the University or not) MUST also attend training before the requested/authorised access is released.

Note: Once provided, access to Oracle Financials will enable the individual to see sensitive and personal data, and the individual must therefore be aware of the requirements for confidentiality in handling University information. The University complies with the requirements of the Data Protection Act, and as part of this, individuals with access to Oracle Financials must ensure they do not contravene these. Financial or personal information must never be divulged to parties who do not need this in the course of ordinary University business.

All staff must also meet the requirements of the University's Financial Regulations and Regulations Relating to the Use of Information Technology Facilities.

The completed New User form should be submitted, via the relevant HEAT Service Request, by the department's authorised signatory indicating their approval for the request.

Review Request

Upon receipt of the New User form, the Support Centre will check the details on the form, match the request to CoreHR records, and if required, contact the department to follow up any queries before creating the new account.

The Training team will then invite users to complete the relevant training course(s).

New User Follow Up

After training is completed, the Financial Systems Customer Services team is informed by the Training team and will contact the new user by email to advise of the access details and help with logging in for the first time, etc. If the user has several Oracle R12 roles, access is granted to each role on the system separately as soon as the user completes the necessary training for each one.

If any changes to access are required once an Oracle Financials user account has been created, then the Change User form should be completed and submitted to the Support Centre by the authorised signatory indicating their approval for the request.

It is important to remove users’ access to Oracle Financials when they leave or no longer use the system, since not doing so can cause issues within the system's workflow. For instance, potentially leaving multiple projects without a person to approve expenditure and holding up related orders.

Note: It is recommended that user access is regularly reviewed to ensure that staff have access and are assigned responsibilities in Oracle Financials appropriate for their role. The UO User Access Report will assist with this. Please also check the Segregation of Duties page for additional information.

Authorised signatories may want to be particularly aware of key users that have a major impact on workflow, such as:

• GL Supervisor (approves other users’ journals)
• Project Requisition Approver (approves’ other users’ requisitions when coded to projects)
• Radiation protection supervisors (a role that exists in some departments for monitoring purposes, where a nominated person is notified when hazardous items are purchased)

The steps below should be taken:

1. When an Oracle Financials user leaves a department;
2. When an Oracle Financials user leaves the University.

The FSSC need to be informed either by the authorised signatory or line manager completing a Change User form to indicate that the user is leaving the department or University, or by the new department (which the user will have joined) completing the same form.

• The controls that are embedded in the Managing Access to Oracle process are listed below. When following the Managing Access to Oracle process, staff should ensure that all of these controls are in place.  Staff responsible for authorising Oracle access requests have been agreed within the department and notified to the Support Centre; these are the so-called authorised signatories and user access reviewers.
   
• Prior to authorising Oracle access for a member of staff, the following are always confirmed:
  • the request for access has been made on the Change User form;
  • the roles requested are necessary for the user’s job;
  • the purchasing approval limit is appropriate to the user's job and the department's budget; and
  • if relevant, the GL journal limit is appropriate.
• The UO User Access Report is reviewed quarterly by the authorised signatory to check the following:
  • purchasing approval limits are appropriate to the user's job and the department's budget;
  • staff who have left the University or the department do not appear on the report; and
  • roles and responsibilities held are appropriate to the user's job.