A lot of new clients have been contacting us recently saying that their auditors have reported that the organisation hasn’t set up auditing on high risk activities in their Oracle EBS system. The organisation has then read scare stories about the impact of auditing on system performance and become worried about how they can address the audit point.
From our experience, auditing when done well has almost no impact on system performance. Auditing in Oracle E-Business Suite (EBS) is like a dimmer switch – you choose how much to turn it on (and it’s already turned on out the box for some of the manufacturing data tables, even if you don’t use these processes). Yes, if you switch it all the way up and start recording high frequency transactions such as the creation of GL Journals or AP Invoices it will very likely impact performance, but I would argue that nobody is going to review every single one of these changes and you’d be better off building other risk-based exception reports such as high value manual GL journals or unmatched, paid AP invoices.
Over the past six months we’ve helped a FTSE 15 organisation and a Local Government organisation to record high risk changes such as those for configuration and key master data. We’ve done this using Oracle’s own Audit Trails solution which is part of the EBS license fee that you’ve already paid for. We’ve then developed an approach that can get us from having the first conversations about auditing to having these high risk changes recorded in 6-8 weeks, with minimal time required from systems and finance staff. We’ve also built our own exception report to consolidate all the audit logs where we’re not expecting changes – for one of our clients this allowed them to see 80 logs I’m one simple report, saving them hours a month to confirm whether there’s been any changes that need investigating.
If this sounds like this would help address your auditor’s challenges, please contact us for more information.
As for our clients – calculating the exact system impact is almost impossible, but as one of our contacts told us “none of the end users has even noticed that we’ve turned it on”.