EPM Auditor: the audit. Quarter end, and every pull in between.
Walk into the SOX audit with the evidence already assembled.
SOX audit readiness for Oracle EPM Cloud: user access review campaigns, segregation of duties, change management and evidence.
What it is
EPM Auditor runs the quarterly user access review end to end (exports, approvals, remediation, reconciliation), checks every user against your segregation-of-duties policies on every pull, and ties every object change to its ticket, with the evidence for all three in one governed repository with signed attestations.
Why it matters
Three controls, every quarter
For public companies, consolidation, planning and reconciliation applications sit inside SOX ITGC scope. The access review, the SoD check and the change log are the three controls auditors test every quarter.
Weeks of spreadsheets become a campaign
Today the access review is weeks of exports, lookups and spreadsheets by business unit, approvals chased in email, removals made by hand and proved by re-export. A campaign replaces all of it, and nobody can approve their own access.
Conflicts and changes caught as they happen
SoD conflicts surface after the fact, and change evidence is rebuilt from tickets and screenshots. EPM Auditor finds conflicts on every pull and ties each change to its ticket as it happens.
What it does
Access review campaigns
- Scheduled pull from Oracle identity domains and application security: ARCS users, groups, teams and preparer or reviewer flags; Task Manager; Shared Services exports for on-prem
- Active Directory enrichment: title, location, manager, status; terminated accounts proposed for removal, dormant accounts flagged
- Group-naming parser per application resolves business unit, property, role and access level; direct assignments and service accounts handled by rule
- Versioned approver matrix by business unit, or routing to each user's manager from the directory extract; one-click quarterly campaign per application, sliced by approver, with reminders, escalation and a completion dashboard
- Reviewer workbench: keep, remove or change with comment, bulk-keep, what changed since last review; self-approval blocked; signed, timestamped attestations
- Remediation worklist executed through identity-domain and application APIs; automatic re-pull and reconciliation before quarter end
Segregation of duties
- Policy import from AuditBoard (Optro) and Excel, versioned with effective dates; the GRC tool stays the system of record
- Role-to-capability mapping for Planning, FCCS, ARCS, EDMCS, Task Manager, Data Integration and on-prem HFM
- Continuous conflict detection on every pull, naming the exact roles or groups behind each conflict, with severity; ARCS preparer-reviewer pairs included
- Preventive check on proposed grants, callable from the ServiceNow access-request workflow
- Resolution workflow: remove, accept with a mitigating control, or exception with expiry and re-certification; two-approver sign-off
- Elevated-access register for Service Administrators and power users, with justification and periodic re-certification
Change management and evidence
- ServiceNow connector: tickets, approvals, CAB decisions, implementation dates
- Object change detection from EPM audit logs and snapshot diffs (forms, rules, metadata, security, Task Manager, data maps, reports) with before and after values
- Automatic and manual change-to-ticket matching; unauthorized-change report for anything without an approved ticket; developer-not-promoter check
- Promotion evidence: Migration and LCM between Test and Production, who and when, linked to the ticket and to EPM TestMate regression evidence
- Evidence packs per control and per campaign, in the form audit requests ask for: report runs with parameters and timestamps, every reviewer's response, removals, admin and native-account listings, before and after snapshots, reconciliation, exceptions; exportable, retained per period
- Point-in-time access snapshots, full application audit trail, and a read-only auditor workspace in place of emailed files
Connectors: Oracle identity domains, Active Directory and Entra ID, ServiceNow, AuditBoard (Optro), EPM Cloud (REST and EPM Automate, including ARCS and Task Manager), Shared Services and DRM exports; or start on flat-file loads of the same extracts and connect later.
is what a quarterly user access review costs an EPM administrator today, in exports, lookups, follow-ups, manual removals and re-exports. A campaign is launched in a day, tracked to completion, and reconciles itself.
How to start
Load one quarter's extracts, or connect one identity domain and one application. Run one campaign alongside your current process, or run your next quarterly review in EPM Auditor, and compare the evidence packs.
Request a proof of conceptDownload the one-pager (PDF) to share with your team.
With the rest of the suite
Release governance in EPM Auditor links directly to EPM TestMate's patch evidence, so the change-management loop closes by itself; the controls and owners it tracks are the same ones the EPM CoE Portal publishes.