PeopleSoft Enterprise Internal Controls Enforcer 9.1 PeopleBook

Monitoring and Managing Controls

This chapter provides an overview of subprocess management and discusses how to:

Monitor and manage controls.
Manage test plans and action plans.
Monitor sign-off status.

See Also

Understanding Subprocess Management

To monitor critical metrics regarding internal control status, there are several pages that enable key individuals to view control status and subsequently initiate action plans and test plans to ensure internal controls effectiveness in accordance with Section 404 of the Sarbanes-Oxley Act of 2002. By using these pages, individuals can access pertinent detailed information, view the name of the person responsible for a process, test, or action plan, and send a notification to the person responsible should there be a concern. These actions support the overall objective to achieve 100 percent effective internal controls within a specified period of time, and to overcome issues prohibiting 100 percent effectiveness by a required date. This section discusses:

Control status.
Test plans and action plans.
Test packages.

Control Status

The Control Status field indicates the state of a control at a given point in time. Because various actions cause the status to change, this field is dynamic and its value fluctuates over time. Initially when process instances are generated, the system sets the control status for all controls to Not Proven. Subsequently, the following actions can change the status of a control:

Manually updating the control status field.

Subprocess owners can update the control status by using the Control Management page.
Running diagnostics.

When you run diagnostics, if the system determines that the data that a diagnostic retrieves differs from the data retrieved in the previous run, the system automatically sets the status of all control instances associated with that diagnostic that are currently in Proven status to Not Proven.
Initiating a test plan or an action plan.

When a test plan or action plan is initiated for a control that is currently in Proven status, the system automatically changes the control's status to Not Proven.
Generating test plans.

When you generate test plans, either by running the Test Plan Generator Application Engine process (EPQ_TP_GEN) or by generating sign-off sheets, the system sets the status for all included controls that are currently in Proven status to Not Proven.
Generating sign-off sheets.
- When annual sign-off sheets are generated, the system sets the status for all included controls that are currently in Proven status to Not Proven.
- When semiannual or quarterly sign-off sheets are generated, the system sets the status for all included controls whose test frequency is Same as Sign Off that are currently in Proven status to Not Proven.
Updating sign-off worksheets.

When subprocess owners access their sign-off worksheets, if they set either the Changed Since Last Sign Off or the Needs Testing fields to yes, the system automatically changes the associated control’s status to Not Proven if it was in proven status.

Subprocesses can be signed off only if the status of all their associated controls is Proven or Exception.

If an action plan or test plan is associated with a control, the system does not allow the control status to be set to Proven until the test plan is completed and passed (or canceled), and until the action plan is completed (or canceled).

Test Plans and Action Plans

You can initiate test plans and action plans to resolve issues that are preventing controls from being proven effective.

Test Plans

Test plans are initiated to test unproven controls. Test plans can be automatically generated, as well as created manually one by one. Typically, test plans are based on a test plan template, and are generated automatically when you generate sign-off sheets, but that is not a requirement— you can create test plans on demand, with or without out using a template. However, test plan templates— which are associated with a control when you define the control— do provide additional functionality. A test plan template can include a checklist of items to complete during control testing, and therefore only test plans that are based on templates can have checklists.

When you associate test plan templates with a control, you can specify the dependencies of the test plan templates, and therefore also the resulting test plans. Test plans that are automatically created from test plan templates are sequenced according to the order that is specified when the test template is associated with its control. Sequencing is handled by specifying the test plan template that another template is dependent on, rather than a number order. When you create a test plan manually, you can also specify what test plan the new test is dependent on, if any. After a test plan is created, you can re-sequence the test if required, but only if it has not been started. Test plans that are not dependent on other test plans can be executed anytime and in parallel. Test plans that are dependent on the same test plans can also be executed in parallel, but only after the test plan that they are dependent on is completed or canceled.

The following methods can be used to generate test plans:

When you generate sign-off sheets the system automatically creates test plans for all controls that have test plan templates associated with them.

See Establishing Risks and Controls, Establishing Checklists, Template Attributes, and Test Plan Templates.
By running the Test Plan Generator Application Engine process (EPQ_TP_GEN).

See Generating Test Plans on Demand.

The following methods can be used to manually create test plans:

Adding a test plan by using the Test Plan page.

See Maintaining Test Plans.
Adding a test plan by clicking the Create New Test Plan button on the Test Plan Package page.

See Reviewing Test Package Status.

Regardless of the method used to create test plans, the system automatically generates the test plan ID by concatenating the control instance ID, the test template instance ID (if applicable), and a sequentially generated six-digit number, inserting an underscore between each concatenated portion.

Test Plan ID = (Control ID) + “_” + (Test Template Instance ID) + “_” + N , where N equals a sequentially incremented six-digit number starting with 000001.

To update the status of a test plan, access the Test Plan page, and select a value in the Change Status field. The status cannot be changed to Started unless an actual start date has been entered nor set to Completed unless an actual end date has been entered.

Test plans must be set to a status of Completed or Canceled in order to change the control status to Proven or Exception.

When a new test plan is created, the system changes the control status value to Unproven if the current control status value is either Proven, Exception, or Missing.

Action Plans

Action plans represent projects that you initiate to resolve ineffective or missing controls. Like test plans, there can be one or more active action plans at a time for a given control

To create an action plan, click the Create New Action Plan button by using the Control Management page. The status of all action plans that are associated with a control must be Completed or Canceled before you can set the control status to Proven. Action plans may be open or outstanding to set the control status to Exception.

When a new action plan is created, the system changes the control status value to Unproven if the current control status value is Proven. The control status does not change if the current control status value is either Exception or Missing.

Owners

You must specify an owner for test plans and action plans. This individual receives notifications when they are assigned to a test plan or action plan. As a test or action plan progresses, the owner should record the progress and update their status accordingly. When test plans are complete, the owner should indicate the test results, either Passed, Failed, or Undetermined.

Dates

The system keeps track of several dates for test and action plans:

Planned start date.
Planned end date.
Actual start date.
Actual end date.

The system uses these dates to determine whether test plan or action plans have started, and whether they are on time.

File Attachments

You can associate file attachments with active test plans and action plans. This enables you to store and access related documents directly with the test or action plans. The system keeps a history of the activity related to the attached files.

Test Plan and Action Plan Status

The following pages enable you to view the status of test and action plans:

Unproven Control Monitor page.

This page shows all missing or not proven controls, and the status of their associated test and action plans.
Control Management component.

This component includes pages that show the current status of a control, and the status of its existing test plans and action plans. You can create new test or action plans by clicking buttons on the pages within this component to access the test plan and action plan definition pages.
View Test/Action Plan page.

This is an inquiry page for viewing test or action plans that meet specified criteria.

Test Packages

A test package is a collection of test plans that are not tied to the control status. A test package enables you to create test plans that do not impact the status of a control, and therefore do not impact the ability to sign off a control. Unlike test plans, creating a test package does not cause a control's status to be set to not proven. Use test packages when you want to periodically test controls “unofficially”, outside of a formal internal controls certification process.

Test packages can be created only by using the Test Plan Generation application engine process. The ID of a test package is automatically generated with the format of “Prefix_Sequence”, where the prefix is specified in the Test Plan Generation run control page. When you run the Test Plan Generation process, if you specify a test package, then the system creates a single test package based on the criteria specified. Test plans within a test package cannot be viewed in the Control Management page because they are not tied to the control status. Instead, you can review them by using the Test Package page.

In the Sign-off Worksheet page, a test package can be associated with a control. Based on a test package's overall status for a control, a subprocess owner can decide whether to set the control status to Proven, Exception, or Not Proven. The overall test result for a test package is based on the worst-case result for the control. If one test within the test package fails, the overall test result is “Failed”. If none of the tests fail, but one is undetermined, the overall test result is “Undetermined.” If all tests pass, the overall test result is “Passed”.

See Also

Generating Test Plans on Demand

Certifying Controls

Prerequisites

Process instances must exist before you can maintain control status.

See Generating and Maintaining Instances.

Common Elements Used in This Chapter

Action Status	Displays the current status of an action plan. Values are: Not Started: Indicates that the action plan has not yet started and that the current date is earlier than the planned start date. Started: Indicates that the action plan has started. Late: Indicates that the action plan has not yet started and that the current date is later than the planned start date. In Progress: Indicates that the action plan has started, and that the current date is later than the planned start date but earlier than the planned end date. Past Due: Indicates that the action plan has started, but the current date is later than the planned end date. Canceled: Indicates that the action plan was canceled. Completed: Indicates that the action plan is complete.
Control Status	Displays the current status of a control. Values are: Missing: Indicates that the control should be in place but is not. This value must be specifically selected by using the Control Management page. The system does not permit subprocess owners to sign off a subprocess if it has any controls that are in this state. Not Proven: Indicates that the control has not been verified. This is the initial control status value. You can specifically select this value, or the system automatically sets the control status to this value under certain conditions. The system does not permit subprocess owners to sign off a subprocess if it has any controls that are in this state. Exception: Indicates that this control is an exception and does not need to be signed off. For example, you might select this option if a control isn't effective but your organization feels that it is not significant enough to prevent sign off. The system does permit subprocess owners to sign off a subprocess if it has any controls that are in this state. It is recommended that comments be entered on the Control Management page to provide a record of why a control was made an exception. Proven: Indicates that the control has been verified. The system permits sign-off for subprocesses that have controls in this state. If there is an action plan or test plan associated with the control, you can't select Proven until the test plan is completed and passed (or canceled), and until the action plan is completed.
Test Status	Displays the current status of a test plan. Values are: Not Started: Indicates that the test has not yet started and that the current date is earlier than the planned start date. Started: Indicates that the test has started. Late: Indicates that the test has not yet started and that the current date is later than the test's planned start date. In Progress: Indicates that the test has started, and that the current date is later than the planned start date but earlier than the planned end date. Past Due: Indicates that the test has started, but the current date is later than the planned end date. Canceled: Indicates that the test was canceled. Completed: Indicates that the action plan is complete.
	Appears for test plans or action plans that have a status of Not Started. Click to access the Action Plan page or the Test Plan page.
	Appears for test plans or action plans that have a status of Late. Click to access the Action Plan page or the Test Plan page.
	Appears for test plans or action plans that have a status of In Progress. Click to access the Action Plan page or the Test Plan page.
	Appears for test plans or action plans that have a status of Past Due. Click to access the Action Plan page or the Test Plan page.
	Appears for test plans or action plans that have a status of Completed. Click to access the Action Plan page or the Test Plan page.
	Appears for test plans or action plans that have a status of canceled. Click to access the Action Plan page or the Test Plan page.
	Appears for controls that have a status of Not Proven. Click to access the Control Management component pages.
	Appears for controls that have a status of Missing. Click to access the Control Management component pages.
	Appears for controls that have a status of Exception. Click to access the Control Management component pages.

Monitoring and Managing Controls

This section discusses how to:

View ineffective controls for a subprocess.
Manage control status.
Review a control's test plan status.
Review a control's action plan status.
Enter comments.
Review comments.

Pages Used to Monitor and Manage Controls

Page Name	Definition Name	Navigation	Usage
Unproven Control Monitor	EPQ_SP_ALRTMNTR	Internal Controls Enforcer, Subprocess Management, Unproven Control Monitor	Review ineffective controls for a subprocess and the status of the associated test plans or action plans.
Control Management	EPQ_BPI_CTL_STATUS	Internal Controls Enforcer, Subprocess Management, Control Management Click a control status on various pages.	Manage a control's status, review the status of its current test plan or action plan, and initiate a new test plan or action plan.
Control Management - Test Plan	EPQ_BPICTL_TESTPLN	Internal Controls Enforcer, Subprocess Management, Control Management, Test Plan Click the value in the Number of Test Plans field on the Unproven Control Monitor page. Click the test plan description on various pages.	Review the status of a control's test plans, and access pages that enable you to create new test plans for the control, or update the status of the test plan.
Control Management - Action Plan	EPQ_BPICTL_ACTNPLN	Internal Controls Enforcer, Subprocess Management, Control Management, Action Plan Click the value in the Number of Action Plans field on the Unproven Control Monitor page. Click the action plan description on various pages.	Review the status of a control's action plans, and access pages that enable you to create new action plans for the control, or update the status of the action plan.
Reviewer Comment	EPQ_ADD_COMMENT	Internal Controls Enforcer, Subprocess Management, Add Reviewer Comments Click the Add Reviewer Comments button on various pages.	Enter notes about action plans or test plans, including reasons for any changes to their status.
View Reviewer Comments	EPQ_VIEW_COMMENT	Internal Controls Enforcer, Subprocess Management, View Reviewer Comments Click the View Reviewer Comments link on various pages.	View existing comments that meet specific criteria.

Viewing Ineffective Controls for a Subprocess

Access the Unproven Control Monitor page (Internal Controls Enforcer, Subprocess Management, Unproven Control Monitor).

This page displays all controls for a subprocess that have a status of either Exception, Missing, or Not Proven.

View	Specify which controls to view in the Alert Monitor grid. Options are: All Unproven Controls: Select to view all the controls for this subprocess that have a status of either Exception, Missing or Not Proven, regardless of the status of their associated test plans or action plans. This is the initial selection for this field. Action Alerts: Select to view only controls with late or past due action plans. Test Alerts: Select to view only controls with late or past due test plans.
Internal Control Worksheet	Click to access the Internal Controls Sign-off Worksheet page, where you can update the corresponding worksheet. This link appears only if there is an active internal control sign-off worksheet.
View Test/Action Plan	Click to access the View Test/Action Plan page, where you can review action plans or tests that meet specified criteria.
Risk	The risk description. Click to access the Risk Instance Definition page for the risk, where you can view the risk definition.
Control	The control description. Click to access the Control Instance Definition page for the control, where you can view the control definition.
<control status icon>	This field contains a symbol that represents the current control status. Click to access the Control Management page for this control, where you can change the control status, initiate new test plans and action plans, or view the status of current test and action plans.
Control Status	Displays the current status for the control. Click to access the Control Management page for this control, where you can change the control status, initiate new test plans and action plans, or view the status of current test and action plans.
Number of Action Plans	Lists the number of action plans that exist for the control. For values greater than zero, you can click the value to access the Control Management - Action Plan page, where you can where you can view and maintain the details for this action plan.
<action plan status icon>	This field contains a symbol that represents the overall status of the action plans for this control, using the worst-case result. For example, assume there are three action plans. If one is set to exception, then the system displays the exception icon. If one is set to not started and the other two are started, then the system displays the use the not started icon.
Action Plans Overdue	Lists the number of action plans that have: Not started, and the current date is greater than their planned start dates. Have started, but are not complete and the current date is greater than their planned end dates.
Action Plans Not Started	List the number of action plans that have not yet started.
Action Plans In Progress	Lists the number of action plans that have started, but are not yet complete.
Number of Test Plans	Lists the number of test plans that exist for the control. For values greater than zero, you can click the value to access the Control Management - Test Plan page, where you can where you can view and maintain the details for this test plan.
<test plan status icon>	This field contains a symbol that represents the overall status of the test plans for this control, using the worst-case result. For example, assume there are three test plans. If one is set to exception, then the system displays the exception icon. If one is set to not started and the other two are started, then the system displays the not started icon.
Test Plans Overdue	Lists the number of test plans that have: Not started, and the current date is greater than their planned start dates. Have started, but are not complete and the current date is greater than their planned end dates.
Test Plans Not Started	List the number of test plans that have not yet started.
Test Plans In Progress	Lists the number of test plans that have started, but are not yet complete.

Managing Control Status

Access the Control Management page (Internal Controls Enforcer, Subprocess Management, Control Management).

<control description>

Click to access the Control Instance Definition page for the control, where you can view the details for the control instance.

Current Control Status

Current Status	Displays the current control status value.
Change Status	To change the control status, select a value from the drop-down list box. Values are: Exception, Missing, Not Proven, and Proven.
Manage and View Diagnostics	Click to access the Diagnostic Manager page, where you can view the diagnostic runs, compare to the current benchmark, and set a new benchmark. This link appears only when a diagnostic is associated with the control.
Comments	Enter text to document the reason for the status change.

Test Plan Status

This group box summarizes the following details about the test plans that are associated with this control:

Number of Tests	The total number of test plans that are associated with this control.
Tests in Progress	The total number of the control's test plans that have started, but have not yet completed.
Tests Cancelled	The total number of the control's test plans that have been canceled.
Tests Not Started	The total number of the control's test plans that have not yet started.
Tests Completed	The total number of the control's test plans that have been completed.
Tests Overdue	The total number of the control's test plans that have: Not started, and the current date is greater than their planned start dates. Have started, but are not complete, and the current date is greater than their planned end dates.

Action Plan Status

This group box summarizes the following details about the action plans that are associated with this control:

Number of Action Plans	The total number of action plans that are associated with this control.
Action Plans in Progress	The total number of the control's action plans that have started, but have not yet completed.
Action Plans Cancelled	The total number of the control's action plans that have been canceled.
Action Plans Not Started	The total number of the control's action plans that have not yet started.
Action Plans Completed	The total number of the control's action plans that have been completed.
Action Plans Overdue	The total number of the control's action plans that have: Not started, and the current date is greater than their planned start dates. Have started, but are not complete, and the current date is greater than their planned end dates.

See Also

Common Elements Used in This Chapter

Reviewing a Control's Test Plan Status

Access the Control Management - Test Plan page (Internal Controls Enforcer, Subprocess Management, Control Management, Test Plan).

<control description>

Click to access the Control Instance Definition page for the control, where you can view the details for the control instance.

Test Plan Fields

Sequence	Displays the system generated sequence number for the test plan.
Test Plan	Displays the test plan ID. Click to access the Test Plan page, where you can maintain the details of the test plan.
Execute After	If populated, this lists the test plan ID upon which the current test plan is dependent. The test plan can only start when this dependent test plan is completed or canceled. If this is blank, then the test plan does not have any dependencies.
<status icon>	This field contains a symbol that represents the current test plan status.
Status	Displays the current status for the test plan.
Planned Start Date, Planned End Date, Actual Start Date, Actual End Date	Lists the various planned and actual (if started or completed) dates associated with the test plan.
Result	Displays the results of the test plan. Values are: Failed, Passed, and Undetermined.
Assigned To	Displays the user ID of the owner assigned to the test plan. Click to access the Send Notification page, where you can compose and send a notification to that individual.
Description	Displays the text of the long description field for the test plan.

Reviewing a Control's Action Plan Status

Access the Control Management - Action Plan page (Internal Controls Enforcer, Subprocess Management, Control Management, Action Plan).

<control description>

Click to access the Control Instance Definition page for the control, where you can view the details for the control instance.

Action Plan Fields

Sequence	Displays the system generated sequence number for the action plan.
Action Plan	Displays the action plan ID. Click to access the Action Plan page, where you can maintain the details of the action plan.
Execute After	If populated, this lists the action plan ID upon which the current action plan is dependent. The action plan can only start when this dependent action plan is completed or canceled. If this is blank, then the action plan does not have any dependencies.
<status icon>	This field contains a symbol that represents the current action plan status.
Status	Displays the current status for the action plan.
Planned Start Date, Planned End Date, Actual Start Date, Actual End Date	Lists the various planned and actual (if started or completed) dates associated with the action plan.
Result	Displays the results of the action plan. Values are: Failed, Passed, and Undetermined.
Assigned To	Displays the user ID of the owner assigned to the action plan. Click to access the Send Notification page, where you can send a notification to that individual.
Description	Displays the test of the long description field for the action plan.

Entering Comments

Access the Reviewer Comment page (Internal Controls Enforcer, Subprocess Management, Add Reviewer Comments).

Comment

Enter comments.

Reviewing Comments

Access the View Reviewer Comments page (Internal Controls Enforcer, Subprocess Management, View Reviewer Comments).

Subject

Select from the drop-down list box which type of comments to view. You can select to view all comments, or only comments entered specifically for an action plan, control definition, risk definition, sign-off sheet, subprocess, subprocess risks, test plan, or test template.

As of Date

Enter the beginning date for which to view comments. The system displays comments that were entered on or after that date.

Refresh

Click to view all comments that meet the specified criteria.

Managing Test Plans and Action Plans

This section discusses how to:

Generate test plans on demand.
Maintain test plans.
Maintain action plans.
Review test packages.
Review test plans or action plans for a subprocess/entity.
Review test plan history.
Review action plan history.
Send notifications about test plans and action plans.
Review test packages.

Note. Test plans can also be generated during sign-off sheet generation.

See Certifying Internal Controls.

Pages Used to Manage Test Plans and Action Plans

Page Name	Definition Name	Navigation	Usage
Test Plan Generation	EPQ_TEST_PLN_RUN	Internal Controls Enforcer, Subprocess Management, Test Plan Generation	Generate test plans on demand.
Test Plan	EPQ_TEST_PLAN	Internal Controls Enforcer, Subprocess Management, Test Plan	Manage a test plan.
Test Plan - Attachments	EPQ_ATTACH_TP	Internal Controls Enforcer, Subprocess Management, Test Plan, Attachments	Manage file attachments for the test plan.
Test Plan - Checklist	EPQ_TP_CHKLST	Internal Controls Enforcer, Subprocess Management, Test Plan, Checklist	Manage the checklist items for a test plan.
Test Plan - Notes	EPQ_TSTPLN_NOTE	Internal Controls Enforcer, Subprocess Management, Test Plan, Notes	Enter notes about a test plan.
Test Plan Attachments History	EPQ_ATTACH_HIST_AP	Click the History button on the Test Plan - Attachments page.	View a history of all activity for file attachments that are associated with an test plan.
Action Plan	EPQ_ACTION_PLAN	Internal Controls Enforcer, Subprocess Management, Action Plan, Action Plan Click Initiate Action Plan by using the Control Management page. Click the action status on the Unproven Control Monitor page. Click the action plan description on various pages.	Create or maintain an action plan for a control.
Action Plan - Attachments	EPQ_ATTACH_AP	Internal Controls Enforcer, Subprocess Management, Action Plan, Attachments	Manage file attachments for the action plan.
Action Plan - Notes	EPQ_TSTPLN_NOTE	Internal Controls Enforcer, Subprocess Management, Test Plan, Notes	Enter notes about an action plan.
Action Plan Attachments History	EPQ_ATTACH_HIST_AP	Click the History button on the Action Plan - Attachments page.	View a history of all activity for file attachments that are associated with an action plan.
Test Plan Package	EPQ_TSTPLN_PKG	Internal Controls Enforcer, Subprocess Management, Test Plan Package	Review the test plans associated with a test package.
View Test/Action Plan	EPQ_VIEW_TEST_ACTN	Internal Controls Enforcer, Subprocess Management, View Test/Action Plan	View test plans or action plans that meet specified search criteria.
Test Plan History	EPQ_TSTPLN_HIST	Internal Controls Enforcer, Subprocess Management, Test Plan History Click the Test Plan History link on the Test Plan page.	Review the status changes to a test plan over time.
Action Plan History	EPQ_ACTPLN_HIST	Internal Controls Enforcer, Subprocess Management, Action Plan History Click the Action Plan History link on the Action Plan page.	Review the status changes to an action plan over time.
Test/Action Plan Alert	EPQ_PLAN_ALRT_RUN	Internal Controls Enforcer, Subprocess Management, Test/Action Plan Alert Run	Send test/action plan notifications.

Generating Test Plans on Demand

Access the Test Plan Generation page (Internal Controls Enforcer, Subprocess Management, Test Plan Generation).

Compliance Project

Specify the compliance project for which to generate test plans.

The default plan end date is relative to the run date, at the specified period of time after the run date. This date will be populated to each test plan’s Planned End Date. The date can be changed, if required, for specific Test Plans after generation in each of the Test Plan pages.

Specify	Select to use a specific value for the planned end date for all the test plans that are generated. Enter the date to use as the planned end date in the adjacent field. The date can be changed, if required, for specific test plans after they are generated.
Scheduled	Select this option to have the planned end date for the generated test plans be a certain number of days, month, or quarters after the run date of the Test Plan Generation engine. Enter a value in the adjacent field and then select either Months, Quarters, or Years to indicate the number of months, quarters, or years after the run date to use as the default value for the planned end date.
Subprocess	Select a subprocess to generate test plans only for the specified subprocess.
Entity ID	Select an entity to generate test plans only for the specified entity.
Control ID	Select a control to generate test plans only for the specified control.
Risk Priority	Specify the priority of risks for which to generate test plans, either All, Primary, or Primary and Secondary.
Control Priority	Specify the priority of controls for which to generate test plans, either All, Primary, or Primary and Secondary.
Template Attribute Type	Indicate the type of template attribute for which to generate test plans. Options are: All: Select to generate test plans without considering the template attribute. Blank: Select to generate test plans only from test plan templates with a blank template attribute field. Specified: Select to generate test plans only from test plan templates that have a specific value for the template attribute field. When you select this option, you must also enter a value in the Template Attribute field.
Template Attribute	Enter the template attribute value for which to generate test plans. This value is used only if the Template Attribute Type fields is set to Specified.
Association	Specify how the generated test plans will be associated. Values are: Control Status: Select to have the generated test plans impact control status and be viewable in the Control Management page. This is the default option. Test Package: Select to have the generated test plans be categorized as a test package. If you select this option, you must also specify the Test Package Prefix.
Test Package Prefix	Specify the prefix to use if generating a test package.
Run	Click to run the process.

Maintaining Test Plans

Access the Test Plan page (Internal Controls Enforcer, Subprocess Management, Test Plan).

Test Plan Template ID and <test plan template description>

If this test plan was based on a template, the template ID and description display. Click the template description to access the Test Template Instance Definition page, and review the details of the template upon which this test plan is based.

Test Plan History

Click to access the Test Plan History page, where you can review a history of the test plan.

Current Test

Status	Displays the current test plan status. Initially the status is Not Started.
Change Status	To change the test plan status, select a value from the drop-down list box. The values differ depending on the current test plan status. Options are Not Started, Started, Completed, and Canceled. This field is unavailable for entry once the test plan status changes to Completed or Canceled.
Assigned To	Specify the individual primarily responsible for the test plan.
Planned Start Date	Enter the expected start date for the test plan. This date must be equal to or greater than the current date.
Planned End Date	Enter the expected finish date for the test plan. This date cannot be earlier than the planned start date.
Actual Start Date	As the test plan progresses, enter the date on which it starts. This field is required if the test plan status is Started or Completed.
Actual End Date	As the test plan progresses, enter the date on which it ends. This date cannot be earlier than the actual start date. This field is required if the test plan status is Completed.
Result	Indicate the results of the current test plan by selecting a value from the drop-down list box. Options are: Failed, Passed, and Undetermined. This field is unavailable for entry once the test plan status is Completed or Canceled. The current test plan must be completed and passed, or canceled, before its associated control can be set to proven.
Add Reviewer Comments	Click to access the Reviewer Comment page, where you can enter new comments about the test plan.
View Reviewer Comments	Click to access the View Reviewer Comments page, where you can review existing comments.

Attachments

Access the Test Plan - Attachments page to manage documents associated with this test plan (Internal Controls Enforcer, Subprocess Management, Test Plan, Attachments). Insert rows within the Attachments grid to add new attachments. Delete rows to inactivate attachments.

Note. If you delete a row in the Attachments grid, the system does not delete the associated file, instead it changes the attachment's status to inactive. You can access inactive documents by viewing all attachments, or by using the Test Plan Attachments History page.

Active Only	Click to view only active attachments within the Attachments grid.
All	Click to view both active and inactive attachments within the Attachments grid.
Description	Enter a description for the attachment.
Attached File	Displays the filename of the attachment.
Attach	Click to browse for and attach a file. This option is unavailable if the test plan status is Completed or Canceled. If a file is already attached, this option enables you to attach a new active file. The system automatically stores the file that was previously attached. Access the History tab to view previous versions of the attachment.
View	Click to launch the attachment.
Last Update User ID and Last Update Date/Time	Displays when and by whom the attachment was last modified.
History	Click to access the Test Plan Attachments History page, where you can review the history for all test plan attachments, including those that are inactive, and view the file associated with each.

Checklist

Access the Test Plan - Checklist page to manage the test plan's checklist items (Internal Controls Enforcer, Subprocess Management, Test Plan, Checklist).

Select the check box in the Checked field to indicate you have completed a checklist item.

Notes

Access the Test Plan - Notes page to enter notes about the test plan (Internal Controls Enforcer, Subprocess Management, Test Plan, Notes).

Maintaining Action Plans

Access the Action Plan page (Internal Controls Enforcer, Subprocess Management, Action Plan, Action Plan).

Action Plan History

Click to access the Action Plan History page, where you can review a history of the action plan.

Current Action Plan

Status	Displays the current action plan status. Initially the status is Not Started.
Change Status	To change the action plan status, select a value from the drop-down list box. The values differ depending on the current action plan status. Options are: Not Started, Started, Completed, and Canceled. This field is unavailable for entry once the action plan status changes to Completed or Canceled. The current action plan's status must be completed (or canceled) before its associated control can be set to proven.
Issue Type	Select the type of control issue that this action plan addresses, either Ineffective Control or Missing Control.
Assigned To	Specify the individual primarily responsible for the action plan.
Planned Start Date	Enter the expected start date for the action plan. This date must be equal to or greater than the current date.
Planned End Date	Enter the expected finish date for the action plan. This date cannot be earlier than the planned start date.
Actual Start Date	As the action plan progresses, enter the date on which it starts. This field is required if the action plan status is Started or Completed.
Actual End Date	As the action plan progresses, enter the date on which it ends. This field is required if the action plan status is Completed.
Resolution Comments	Enter comments to document the results of this action plan.
Add Reviewer Comments	Click to access the Reviewer Comment page, where you can enter new comments about the action plan.
View Reviewer Comments	Click to access the View Reviewer Comments page, where you can review existing comments.

Attachments

Access the Action Plan - Attachments page to manage documents associated with this action plan (Internal Controls Enforcer, Subprocess Management, Action Plan, Attachments). Insert rows within the Attachments grid to add new attachments. Delete rows to inactivate attachments.

Active Only	Click to view only active attachments within the Attachments grid.
All	Click to view both active and inactive attachments within the Attachments grid.
Description	Enter a description for the attachment.
Attached File	Displays the filename of the attachment.
Attach	Click to browse for and attach a file. This option is unavailable if the action plan status is Completed or Canceled. If a file is already attached, this option enables you to attach a new active file. The system automatically stores the file that was previously attached. Access the History tab to view previous versions of the attachment.
View	Click to launch the attachment.
Last Update User ID and Last Update Date/Time	Displays when and by whom the attachment was last modified.
History	Click to access the Action Plan Attachments History page, where you can review the history for all action plan attachments, including those that are inactive, and view the file associated with each.

Notes

Access the Action Plan - Notes page to enter notes about the action plan (Internal Controls Enforcer, Subprocess Management, Test Plan, Notes).

Reviewing Test Package Status

Access the Test Plan Package page (Internal Controls Enforcer, Subprocess Management, Test Plan Package).

The current status, planned and actual dates, and results appear within the Test Plan grid.

Test Plan	Click to access the test plan page for this test package.
Create New Test Plan	Click to access the Test Plan page, and add a new test plan for this test package.

The overall test result for a test package is based on the worst-case result for the control. If one test within the test package fails, the overall test result is “Failed”. If no test fails but one is undetermined, the overall test result is “Undetermined.” If all tests pass, the overall test result is “Passed”.

Reviewing Test Plans or Action Plans for a Subprocess/Entity

Access the View Test/Action Plan page (Internal Controls Enforcer, Subprocess Management, View Test/Action Plan).

Use this page to specify criteria by which to view test or action plans. The results appear in a grid below the search criteria when you click the Refresh button. The title of the results grid will be Test or Action Plan, depending on whether you specify to view tests or action plans. You can click the Test Plan or Action Plan ID within the results grid to access the Test Plan or Action Plan page, respectively.

Enter criteria to determine which test or action plans to view:

View Type	Specify which type of plan to view. Options are: Test: Select to view only test plans. Action Plan: Select to view only action plans.
Owner	(Optional) Select to view only the test or action plans for which this person is responsible.
Status	(Optional) Select to view only the test or action plans that are currently in this specific state.
Control ID	(Optional) Select to view only the test or action plans for this control.
Test Result	(Optional) Select to view only the test plans with this specific result. This field is unavailable for entry if the view type is Action Plan.
Most Recent	Select to view only the most recent test or action plans.
Range Type	Select to view test or action plans that occur within a specific date range, then select the date type upon which to base the search in the adjacent drop-down list box. Values are: Actual Start Date, Actual End Date, Planned Start Date, and Planned End Date.
From Date and To Date	Select the range of dates to view, if you selected to view by range type.
Refresh	Click to view the results.

Reviewing Test Plan History

Access the Test Plan History page (Internal Controls Enforcer, Subprocess Management, Test Plan History).

Every time a test plan is updated, the previous information for the test plan is saved as history. This page displays all versions of the test plan. Click View to view a version of the test plan at that point in time.

Reviewing Action Plan History

Access the Action Plan History page (Internal Controls Enforcer, Subprocess Management, Action Plan History).

Every time an action plan is updated, the previous information for the action plan is saved as history. This page displays all versions of the test plan. Click View to view a version of the action plan at that point in time.

Sending Notifications About Test Plans and Action Plans

Access the Test/Action Plan Alert page (Internal Controls Enforcer, Subprocess Management, Test/Action Plan Alert Run).

Compliance Project

Specify the compliance project for which to send notifications.

Plan Type

Specify the type of object for which to send notifications. Values are:

All: Select to send notifications only both test plans and action plans.

Test Plan: Select to send notifications only for test plans.

Action Plan: Select to send notifications only for action plans.

Status Type

Specify the type of status for which to send notifications. Values are:

All: Select to send notifications plans that are late or are within a specified number of days from their finish date deadline.

Approaching Deadline: Select to send notifications for plans that are within a specified number of days from their finish date. Use the Deadline Tolerance field to specify the number of days from the deadline to consider.

Late: Select to send notifications for plans that are late.

Plan Status

Specify the status of plans for which to send notifications, either All, Not Started, or Started.

Deadline Tolerance

Enter the number of days away from the deadline to use when sending notifications for plans that are approaching a deadline.

Plan Owner

Select to send notifications to the plan owner.

Subprocess Owner

Select to send notifications to the subprocess owner.

Business Process Owner

Select to send notifications to the business process owner.

Monitoring Sign-Off Status

This section provides an overview of the hierarchical sign-off monitors and discusses how to:

Specify entity tree viewer parameters.
View sign-off status using an entity tree.
View internal control metrics for an entity.
Specify business process tree viewer parameters.
View sign-off status using a business process tree.
View internal control metrics for a process.

See Also

Enterprise PeopleTools 8.50 PeopleBook: PeopleSoft Tree Manager

Understanding the Hierarchical Sign-Off Monitors

The system provides two components that enable you to monitor key sign-off metrics for entities or business processes that are hierarchically related: the Entity Tree Viewer component (EPQ_ENTITY_TREE) and the Business Process Tree Viewer component (EPQ_PROCESS_TREE). These components each use a tree to define the hierarchical relationships that exist among entities or business processes. When you view these components, you are able to navigate through the various levels of the tree to view aggregated percentages for the following information at each level:

Not signed-off.
Ineffective controls.
Unmitigated risks.
Incomplete action plans.

Because these pages use row-level security, users view only the compliance projects or process instances that they have access to, and the percentage totals are calculated using only those objects. When you are viewing results for a detail value on the tree (a tree leaf), you can click on an amount to view the details that contribute to that amount.

Entity Tree Viewer

The Entity Tree Viewer component enables you to view sign-off metrics for the entities within your organization for a particular compliance project. You must use Tree Manager to create the entity tree before using this component. The tree you create must use the EPQ_ENTITY_TREE structure ID. The tree can be organized in any way that you wish to see the metrics summarized. For example, you could arrange them geographically, like the tree shown in the following graphic:

Entity tree example, arranged geographically

The leaves of the tree represent entities, and can be either individual entities, such as US001, or ranges, such as US001–US002. The entities that you use in the tree must be defined by using the Entity Definition page.

See Defining Entities.

Business Process Tree Viewer

The Business Process Tree Viewer component enables you to view sign-off metrics for the hierarchy of business processes within your organization for a particular compliance project. You must use Tree Manager to create the business process tree before using this component. The tree you create must use the EPQ_PROCESS_TREE structure ID. The nodes of the tree represent your organization's major business processes, and the leaves of the tree represent subprocesses. The leaves can be individual processes, such as SBP001, or ranges, such as SBP001-SBP005. Use the nodes to group processes in logical levels that represent relationships among your subprocesses. The leaves that you use must be processes instances that are defined by using the Business Process Manager page.

See Establishing Business Processes and Subprocesses.

The following graphic provides an example of a business process tree, with the highest levels being accounts payable, accounts receivable, and financial statement close.

Business process tree example

Navigation

When you first access either tree viewer page, the tree is collapsed and the first row of the grid contains totals for the entire tree while subsequent rows contain subtotals for each top-level node, as shown in the following example.

To view details for a node, click the tree node description to select and expand the node. The grid displays the totals for the selected node in the first row, while the remaining rows include the levels subordinate to the selected node and their associated subtotals, or the detail values if you've reached the lowest level. You can continue to navigate through the tree in this manner to access node levels that contain detail values, as shown in the following example:

Click a percentage value to access either the Internal Controls by Entity page or the Internal Controls by Business Process page, where you can review the status of the internal controls for that entity or business process.

Prerequisites

You must create an entity tree and business process tree before you use these pages, and sign-off sheets must exist.

Common Elements Used in this Section

	Click to expand the tree node.
	Click to collapse the tree node.
<node description>	Click to expand and select the tree node.
View My Access	Click to access the View My Access component, where you can review the compliance projects and process instances to which you have been granted access. See Reviewing Security.

Pages Used to Monitor Sign-Off Status

Page Name	Definition Name	Navigation	Usage
Tree Manager	PSTREEMGR	Tree Manager, Tree Manager	Create an entity tree or business process tree.
Entity Tree Selection	EPQ_ENTREE_SELECT	Internal Controls Enforcer, Tree Viewer, Entity Tree Viewer	Specify the compliance project and tree to use for the Entity Tree Viewer page.
Entity Tree Viewer	EPQ_ENTITY_TREE	Click Go on the Entity Tree Selection page.	Review sign-off metrics for a compliance project summarized by entity.
Internal Controls by Entity	EPQ_ENT_BPDETAIL	Click a detail value on the Entity Tree Viewer page.	Review internal control metrics for the processes associated with an entity.
Business Process Tree Selection	EPQ_BPTREE_SELECT	Internal Controls Enforcer, Tree Viewer, Business Process Tree Viewer.	Specify the compliance project, entity, and tree to use for the Business Process Tree Viewer page.
Business Process Tree Viewer	EPQ_PROCESS_TREE	Click Go on the Business Process Tree Selection page.	Review sign-off metrics for a compliance project summarized by business process.
Internal Controls by Business Process	EPQ_BPTREE_DTL EPQ_BP_SBPDETAIL	Click a detail value on the Business Process Tree Viewer page.	Review internal control metrics for processes and subprocesses.

Specify Entity Tree Viewer Parameters

Access the Entity Tree Selection page (Internal Controls Enforcer, Tree Viewer, Entity Tree Viewer).

Compliance Project

Select the compliance project for which to view sign-off status.

Tree Name

Select the entity tree by which sign-off metrics are summarized. Only trees that use the EPQ_ENTITY_TREE structure are valid.

Go

Click to access the Entity Tree Viewer page, using the specified parameters.

Viewing Sign-Off Status Using An Entity Tree

Access the Entity Tree Viewer page (click the Go button on the Entity Tree Selection page).

Return to Selection Page

Click to access the Entity Tree Selection page.

Entity Tree

Select the tree node for which to view results in the Internal Control State grid.

Internal Control State

This grid contains rows that display the sign-off metric percentages for the entities associated with the currently selected tree node.

Entity Owner	Displays the description of the individual that is assigned as the owner of the entity. Click to access the Send Notification page, where you can compose and send them a notification.
Not Signed Off	Displays the percentage of controls that are not signed off. Click an amount to access the Internal Controls by Entity page, where you can review internal control metrics for the processes associated with the entity.
Unmitigated Risks	Displays the percentage of risks that are still problematic. Click an amount to access the Internal Controls by Entity page, where you can review internal control metrics for the processes associated with the entity.
Ineffective Controls	Displays the percentage of controls that are not adequate. Click an amount to access the Internal Controls by Entity page, where you can review internal control metrics for the processes associated with the entity.
Incomplete Action Plan	Displays the percentage of action plans that are not finished. Click an amount to access the Internal Controls by Entity page, where you can review internal control metrics for the processes associated with the entity.

Access the Internal Controls by Entity page (click a detail value on the Entity Tree Viewer page).

This page enables users with overall responsibility for corporate compliance to view metrics on the state of internal controls certification for an entity by business process.

Entity Owner and Owner	Click the name of any of the various owners (entity owner, business process owner, or subprocess owner) to access the Send Notification page, where you can send a notification to that individual.
Sign Offs	Click this link to view the percentages of subprocesses not signed off for each business process associated with this entity.
Risks	Click this link to view metrics about the unmitigated risks for each business process associated with this entity, analyzed by primary, secondary, and tertiary risks.
Controls	Click this link to view metrics about ineffective controls for each business process associated with this entity, classified by primary, secondary, and tertiary controls.
Action Plans	Click this link to view metrics about the action plans for each business process associated with this entity.
Business Process	Click to access the Internal Controls by Business Process page, where you can view metrics for the subprocesses within that business process. See Viewing Internal Control Metrics for a Process.

Specifying Business Process Tree Viewer Parameters

Access the Business Process Tree Selection page (Internal Controls Enforcer, Tree Viewer, Business Process Tree Viewer).

Compliance Project

Select the compliance project for which to view sign-off status.

Entity ID

Optionally, select an entity if you want to limit the results that you view to only a specific entity. To view the results for all entities, leave this field blank.

Tree Name

Select the entity tree by which sign-off metrics are summarized. Only trees that use the EPQ_PROCESS_TREE structure are valid.

Go

Click to access the Entity Tree Viewer page, using the specified parameters.

Viewing Sign-Off Status Using A Business Process Tree

Access the Business Process Tree Viewer page (click the Go button on the Business Process Tree Selection page).

Return to Selection Page

Click to access the Business Process Tree Selection page.

Business Process Tree

Select the tree node for which to view results in the Internal Control State grid.

Internal Control State

This grid contains rows that display the sign-off metric percentages for the entities associated with the currently selected tree node.

Not Signed Off	Displays the percentage of controls that are not signed off. Click an amount to access the Internal Controls by Business Process page, where you can view details for the business process.
Unmitigated Risks	Displays the percentage of risks that are still problematic.
Ineffective Controls	Displays the percentage of controls that are not adequate.
Incomplete Action Plan	Displays the percentage of action plans that are not finished.

Viewing Internal Control Metrics for a Process

Access the Internal Controls by Business Process page (click a detail value on the Business Process Tree Viewer page).

Process Owner and Owner

Click on the name of any of the various owners (business process owner, or subprocess owner) to access the Send Notification page, where you can send a notification to that individual.

Sign Offs

Click this link to view the process priority and sign of status for each subprocess associated with this business process.

Risks

Click this link to view metrics about the unmitigated risks for each subprocess associated with this business process, classified by primary, secondary, and tertiary risks.

Controls

Click this link to view metrics about ineffective controls for each subprocess associated with this business process, classified by primary, secondary, and tertiary controls.

Action Plans

Click this link to view metrics about the action plans for each subprocess associated with this business process.

Subprocess

Click on a subprocess description to access the Process Definition page, where you can view the details for the subprocess definition.

Subject	Select from the drop-down list box which type of comments to view. You can select to view all comments, or only comments entered specifically for an action plan, control definition, risk definition, sign-off sheet, subprocess, subprocess risks, test plan, or test template.
As of Date	Enter the beginning date for which to view comments. The system displays comments that were entered on or after that date.
Refresh	Click to view all comments that meet the specified criteria.

Test Plan Template ID and <test plan template description>	If this test plan was based on a template, the template ID and description display. Click the template description to access the Test Template Instance Definition page, and review the details of the template upon which this test plan is based.
Test Plan History	Click to access the Test Plan History page, where you can review a history of the test plan.

Compliance Project	Specify the compliance project for which to send notifications.
Plan Type	Specify the type of object for which to send notifications. Values are: All: Select to send notifications only both test plans and action plans. Test Plan: Select to send notifications only for test plans. Action Plan: Select to send notifications only for action plans.
Status Type	Specify the type of status for which to send notifications. Values are: All: Select to send notifications plans that are late or are within a specified number of days from their finish date deadline. Approaching Deadline: Select to send notifications for plans that are within a specified number of days from their finish date. Use the Deadline Tolerance field to specify the number of days from the deadline to consider. Late: Select to send notifications for plans that are late.
Plan Status	Specify the status of plans for which to send notifications, either All, Not Started, or Started.
Deadline Tolerance	Enter the number of days away from the deadline to use when sending notifications for plans that are approaching a deadline.
Plan Owner	Select to send notifications to the plan owner.
Subprocess Owner	Select to send notifications to the subprocess owner.
Business Process Owner	Select to send notifications to the business process owner.

Compliance Project	Select the compliance project for which to view sign-off status.
Tree Name	Select the entity tree by which sign-off metrics are summarized. Only trees that use the EPQ_ENTITY_TREE structure are valid.
Go	Click to access the Entity Tree Viewer page, using the specified parameters.

Process Owner and Owner	Click on the name of any of the various owners (business process owner, or subprocess owner) to access the Send Notification page, where you can send a notification to that individual.
Sign Offs	Click this link to view the process priority and sign of status for each subprocess associated with this business process.
Risks	Click this link to view metrics about the unmitigated risks for each subprocess associated with this business process, classified by primary, secondary, and tertiary risks.
Controls	Click this link to view metrics about ineffective controls for each subprocess associated with this business process, classified by primary, secondary, and tertiary controls.
Action Plans	Click this link to view metrics about the action plans for each subprocess associated with this business process.
Subprocess	Click on a subprocess description to access the Process Definition page, where you can view the details for the subprocess definition.

Monitoring and Managing Controls

Understanding Subprocess Management

Control Status

Test Plans and Action Plans

Test Packages

Prerequisites

Common Elements Used in This Chapter

Monitoring and Managing Controls

Pages Used to Monitor and Manage Controls

Viewing Ineffective Controls for a Subprocess

Managing Control Status

Reviewing a Control's Test Plan Status

Reviewing a Control's Action Plan Status

Entering Comments

Reviewing Comments

Managing Test Plans and Action Plans

Pages Used to Manage Test Plans and Action Plans

Generating Test Plans on Demand

Maintaining Test Plans

Maintaining Action Plans

Reviewing Test Package Status

Reviewing Test Plans or Action Plans for a Subprocess/Entity

Reviewing Test Plan History

Reviewing Action Plan History

Sending Notifications About Test Plans and Action Plans

Monitoring Sign-Off Status

Understanding the Hierarchical Sign-Off Monitors

Prerequisites

Common Elements Used in this Section

Pages Used to Monitor Sign-Off Status

Specify Entity Tree Viewer Parameters

Viewing Sign-Off Status Using An Entity Tree

Viewing Internal Control Metrics for an Entity

Specifying Business Process Tree Viewer Parameters

Viewing Sign-Off Status Using A Business Process Tree

Viewing Internal Control Metrics for a Process