When an assessor is reviewing Prior Results as part of an operational assessment for a control, such as manual AP Invoice entry, they are able to view the results of prior operational assessments specifically for that control. This is because the system is designed to allow assessors to focus on the historical performance and evaluation of the control in question, providing a targeted and relevant overview of its effectiveness and any issues that have been identified in the past.

References:The information provided is based on the Oracle Risk Management documentation, which outlines the processes and capabilities of the system regarding operational assessments and the review of Prior Results1.

To define an IT Compliance Manager job role with the required privileges to manage risks and controls, as well as issues related to them, the following duty roles must be included:

• Seeded Risk Manager Composite: This duty role includes privileges necessary for managing risks.
• Control Manager Composite: This duty role encompasses privileges for managing controls.
• Issue Manager Composite: This duty role contains privileges for managing issues related to risks and controls.

These duty roles collectively provide a comprehensive set of privileges that cover all aspects of risk and control management, as well as issue resolution, which are essential for an IT Compliance Manager job role.

References:

• Oracle documentation on creating risk management roles in the Security Console provides insights into the role creation process and the types of roles that can be created, including job roles and duty roles1.
• The IT Security Manager job role documentation lists the duties and privileges that are inherited by the job role, which is similar to what would be required for an IT Compliance Manager role2.
• The Roles Overview documentation from Oracle outlines various roles available within Oracle Fusion Cloud Financial Reporting Compliance, including the Risk Activities Manager and Risk Administrator, which are related to the management of risks and controls3.

• In a model: You can create a new condition logic filter within a model, select the specific operating unit attribute and its value, and then apply an exclusion through the advanced options checkbox. This method allows you to set up a filter that specifically targets the operating unit you wish to exclude.
• Create Access Global Condition page: By navigating to this page, you can create a new condition logic filter, again selecting the operating unit attribute and its value, and perform an exclusion through the advanced options checkbox. This approach is similar to the first but is done through the global condition page, which may offer a broader scope of application.

References:The information provided here is based on Oracle’s documentation on Risk Management and Compliance, which outlines the procedures for excluding an operating unit in scenarios where there is insufficient personnel to maintain segregation of duties12. For a detailed understanding of these processes, refer to the official Oracle documentation.