As a part of system security, user
authentication will be activated by the domain administrator. Users will access
ARCS using their assigned credentials and password. Security within ARCS exists
on several levels such as authentication to the domain (SSO), role assignment,
application access, and workflow. Users can be individually assigned or
assigned as team members to reconciliations. Users that are not assigned to
reconciliations can only see the ARCS workspace page.
User
Provisioning: there are 5 predefined security roles within
the Oracle Cloud environment. They are, in order of access permission:
·
Identity Domain Administrator
(e.g., manages users/passwords if they need to reset their access to ARCS)
·
Service Administrator
·
Power User
·
User
·
Viewer
User could be a Preparer, Reviewer, or a
Commentator. A user can play multiple roles but cannot be a Preparer as well as
a Reviewer for the same reconciliation.
Only three of the above security roles
provide access to Data Management: Service Administrator, Power User, and User.
Only the Identity Domain Administrator
role can add or delete users or change a user’s role. Roles are assigned per individual pod.
ServiceAccount: A “non-personal” user
account (ServiceAccount) will be provisioned to execute automations in the
application. Capgemini recommends using a separate ServiceAccount for
Production and Non-Production environments.
The
ServiceAccount used to execute automations for the Account Reconciliation Cloud
Service will need the following four provisions:
1.
Service Administrator for the
ARCS environment.
2.
System Administrator for the
Automation Host Server (a.k.a. Jump Box, or Automation VM)
3.
Oracle Transactional Business
Intelligence privileges to schedule and monitor reports.
4.
Oracle Financial Applications
Cloud Common Job Roles listed in the following table for all Data Access Set(s)
and Business Unit(s) Security Context(s):
Service Administrators can perform all
tasks within a specified application. LCG will name users requiring
administrator capability within the overall LCG governance guidelines. Some
common administrator tasks are as follows:
- Create application(s)
- Configure application settings.
- Create and manage profiles, reconciliations,
filters, and custom reports.
- Perform data loads.
- Open/Close/Lock periods
- Manage user workflow and overall
user security within the application.
Access
to the ARCS module is dependent on user security roles and the access given to
specific reconciliations.
During
the build phase, Capgemini will provide a security matrix for LCG to populate
that will assign the user by specific role based on the access needed.
The
following provides an overview of the roles within ARCS.
Table – ARCS Roles
|
Role |
Responsibilities |
|
Admin User |
·
Full
access to System Setup, Filters, Attributes, Periods, Reconciliation
Profiles, Reconciliation Instances, rates, and Reporting. ·
Add
and remove their own comments. ·
Remove
comments from reconciliations to accommodate cases where commentary must be
removed, and the commentary was entered by a user who is no longer with the
company. ·
Create
Report Binders |
|
Power
User |
·
Full access to filters,
Reconciliation Profiles, Reconciliation Instances, and Reporting. ·
Add and remove their own comments. ·
Remove commentary from
reconciliations to accommodate cases where commentary must be removed, and
the commentary was entered by a user who is no longer with the company. ·
Create Report Binders |
|
Preparer |
·
Perform
all functions related to preparation, including adding, editing, and removing
transactions; flagging transactions; adding comments; removing comments he
previously added; adding attachments; removing attachments he previously
added; answering Questions; and submitting reconciliations for review. ·
Create
Report Binders for their reconciliations. ·
Create
private filters |
|
Reviewer |
·
Review, including flagging
transactions; adding comments; removing comments he previously added;
rejecting reconciliations; and approving reconciliations. ·
Create Report Binders for their
reconciliations. ·
Create private filters |
|
Commentator |
·
Add
comments to reconciliations and the associated reconciliation transactions.
This access is only to reconciliations assigned with commentator privileges. ·
Create
Report Binders for their reconciliations. ·
Create
private filters |
|
Viewer |
·
Read-only access to reconciliations ·
Create Report Binders for their
reconciliations. ·
Create private filters |
ARCS Preparer & Reviewer
Assignments
An ARCS supports assignment to both
individual users and teams for preparer and reviewer tasks. Assignment to teams
allows flexibility for resource balancing of reconciliation work across
individuals on each team, while individual assignment allows assignment of
backup preparers and reviewers.
LCG prefers to use an individual designated
workflow approach for both preparer and reviewer assignments. No teams will be
configured. LCG will be responsible for providing list of specific users and
provisioning during the build phase. Switching assignments to a team approach
is possible in the future, if desired.
Management of user assignments to the
reconciliations will be kept within the profile template and reviewed by LCG.
ARCS Commentator &
Viewer Assignments
LCG will decide who will be assigned as
commentators and viewers to reconciliations within ARCS. ARCS provides two
methods of assigning viewers and commentators in the system which include:
1.
Global viewer and commentator
access via the Organizational Unit and
2.
Individual assignment to
reconciliations
During the build phase, LCG will provide
the list of users who would require viewer or commentator access, and to which
specific reconciliations. At that time, LCG can decide which configuration
method makes the most sense for their business.
Security
re-assignment can be completed in several ways within ARCS as follows:
1. Backup Preparer and
Reviewer – Backup preparers and reviewers can be
assigned to reconciliations if individual assignment approach is taken. The
primary user’s status must be set to “Unavailable” (in case of PTO, holidays,
etc.) within ARCS for the back-up preparer or reviewer to take over from the
primary user for the reconciliation related tasks. Either the preparer or the
administrator can set the preparer as unavailable.
2. Teams – Teams allow for a group of
people to be assigned to reconciliations for all roles such as preparers,
reviewers, viewers, and commentators. Once a user claims the reconciliation as
a preparer and that same person is also in the reviewer team, the system
revokes that user’s reviewer rights access – the same is true if the person
claims the reconciliation as a reviewer, then their preparer rights are revoked
by the system. This ensures that there is proper segregation of duties.
NOTE: Within a Team, a selected user can
be “Primary User” to have the reconciliations default to a Claimed status with
that user. For example, if Ashley is the Primary User within the Team Preparers,
all reconciliation with status ‘Open with preparer” will be directed to her
first. In case Ashley is unavailable, anyone in the Team can still access the
reconciliation and perform the work.
3. Security Re-assignment
Requests – Reconciliations that do not have teams
and or backups assigned would require the user to submit a Re-assignment
Request in ARCS. This request will then appear within the Application and
Overview card under the Change Requests area. The ARCS administrator can then
review this information and approve and/or reject the request.
To
sum up, team assignment allows the flexibility for resource work across
individuals on each team, while individual assignment allows assignment of
backup preparers and reviewers.
For
any reconciliations that have an individual preparer, LCG can define backup
users (if needed) for each reconciliation.
Comments
Post a Comment