Setting Up Audit Automation

This chapter covers the following topics:

Audit Automation in Oracle Internet Expenses

Audit Automation in Oracle Internet Expenses works together with your rate and policy schedule setup to manage the auditing of employee expense reports. Audit Automation helps ensure that expense reports comply with the policies of your company without having to audit all expense report submissions.

The Audit Automation feature lets you automate several processes related to the auditing of expense reports. These include:

The key components of Audit Automation setup are receipt management, audit rule sets, the audit list, and audit list rule sets. Receipt management provides setup to define rules to track missing and overdue receipts and to place holds on expense report payments due to missing or overdue receipts. Audit rules determine the criteria that Internet Expenses uses to select expense reports for audit. You can also make use of audit rules to automatically assign expense reports to auditors based on the paperless audit rules. The audit list is the list of employees whose expense reports are automatically selected for audit. While employees are on the audit list, each expense report that they submit is passed for auditing. Audit list rules determine the criteria that Internet Expenses uses to automatically place employees on the audit list, as well as determining how long employees remain on the audit list.

Use the information in this chapter to set up Internet Expenses for audit automation. For information about auditing expense reports and managing expense report auditors, see: Oracle Audit Management.

Audit Rule Sets

Create one or more audit rule sets to automate the audit selection and auditor assignment of expense reports. An audit rule set contains the selection rules that Internet Expenses uses to select expense reports for audit. Rule sets also contain the paperless audit rules that are used to automatically assign expense reports to auditors.

You can create audit rule sets that reflect the business requirements of each operating unit in your company. Each audit rule set can contain its own audit selection criteria, according to the business needs of each operating unit. You can update the values in an existing audit rule set, and you can delete an audit rule set by applying an end date, if it is not assigned to any operating unit.

After you create audit rule sets, assign them to the operating units in your company. You can, for example, assign the same audit rule set to each operating unit that uses the same business practices.

If an operating unit does not have an audit rule set assignment, then Internet Expenses does not use the Audit Automation feature. All expense report audits are paper-based only, and there is only this limited automatic approval process:

Prerequisites

Before you can set up audit rule sets in Internet Expenses, you must:

Creating an Audit Rule Set

Use the Create Audit Rule Set page to create a new audit rule set or to update an existing audit rule set.

An audit rule set contains four sections of information:

Enter Header Information

Enter an audit rule set name and description. You can optionally enter an end date. Audit Rule Set Name and Description are mandatory fields.

You cannot save an audit rule set that contains header information only. You must choose at least one option from the sections Audit Selection Rules, Paperless Audit, or Confirmation Page Audit Indicator to create an audit rule set. These dependencies apply to the selection of audit rules:

Enter Audit Selection Rules

Choose the audit selection rules that you want for each audit rule set. Internet Expenses chooses expense reports for audit according to the rules you choose.

The audit selection rules do not work in a hierarchical manner. If more than one rule applies to an expense report, then the expense report is selected for audit with all of the audit rules that apply.

Notes on the audit selection rules:

Define Paperless Audit

Use the Paperless Audit section to choose the rules that allow the auditing of expense reports without a receipt package. You must choose at least one rule in the section Audit Selection Rules to use paperless audit.

Internet Expenses first selects expense reports for audit based on the Audit Selection Rules, and then determines the expense reports available for paperless audit based on the paperless audit rules. Internet Expenses assigns each expense report available for paperless audit to an auditor for the designated operating unit. Auditors must be defined to use paperless audit rules. For more information, see: Creating Auditors.

Define Confirmation Page Audit Indicators

Audit Automation divides expense reports into three audit categories:

Use the Confirmation Page Audit Indicator section to create an alphanumeric code for each audit category. If you choose this option, Internet Expenses prints the corresponding code that you create on the confirmation page of each expense report. For example, your code can say simply Receipt-based audit, Paperless audit, Auto-approved, or you can create a code system known only to your AP department. This provides your accounts payable department with a convenient method for sorting receipt packages.

Assigning an Audit Rule Set

After you create audit rule sets, assign an audit rule set to each operating unit in your company. You can assign the same audit rule set to more than one operating unit. When you update an audit rule set, the changes you make apply to all of the assigned operating units.

If you do not assign an audit rule set to an operating unit, then Internet Expenses does not use the Audit Automation feature for this operating unit.

Managing Receipt Notifications

Create one or more notification rule sets to determine when to send notifications to users for overdue or missing receipts. You can create notification rule sets that reflect the business requirements of each operating unit in your company.

The notification rule set assigned to an operating unit works together with the Expenses Overdue Receipts Tracking concurrent program and the Expense Receipts Workflow. The program identifies overdue expense reports, based on criteria from the notification rule set, and invokes the Expense Receipts Workflow. The workflow initiates the process of sending notifications based on the values contained in the active notification rule set. See: Expense Receipts Workflow and Expenses Overdue Receipts Tracking Program, Oracle Payables User Guide for more information.

You need to rerun the Expenses Overdue Receipts Tracking program to identify new overdue expense reports. Previously identified overdue reports are in independent workflow processes and will not be reprocessed by the program. How often you run the program depends on how up-to-date you want to be with sending notifications.

Tip: If you want to notify employees as soon as receipts are considered overdue, as defined in the notification rule set, then run the Expenses Overdue Receipts Tracking program daily. Otherwise, employees might be notified days after the overdue date, depending on when the program runs.

A notification rule set contains these rules and dependencies:

Use the Notification rule set assignments pages to assign the notification rule sets that you created to the operating units that you want. The notification rule set that you assign to an operating unit remains active during the effective period that you specify. If you do not enter an end date, then the notification rule set remains active indefinitely. To change notification behavior for an operating unit, you must apply an end date to the current notification rule set, then assign a new notification rule set.

When a notification rule set is assigned to an operating unit, Internet Expenses compares the expense report submission date to the system date to initially determine if receipts are overdue on an expense report. For all expense reports that have overdue receipts, Internet Expenses initiates the process of sending notifications, according to the notification rules.

You must assign a notification rule set to an operating unit to make use of notification rules. If an operating unit does not have a notification rule set assignment, then the Expenses Overdue Receipts Tracking concurrent program cannot detect overdue or missing receipts, and therefore cannot call the Expense Receipts workflow.

Managing Holds on Expense Reports

Create one or more hold rule sets to determine the behavior for holding expense report payments to users because of overdue or missing receipts. You can create hold rule sets that reflect the business requirements of each operating unit in your company.

The hold rule set assigned to an operating unit works in conjunction with the Expense Holds Workflow. The Expense Holds Workflow manages the process of sending notifications regarding the placing of holds on expense reports and releasing holds on expense reports. See: Expense Holds Workflow for more information.

When you run the Expense Report Export program, the program places holds on expense report payments according to the rules contained in the active hold rule set.

A hold rule set contains these rules and dependencies:

Use the Hold rule set assignments pages to assign the hold rule sets that you created to the operating units that you want. The hold rule set that you assign to an operating unit remains active during the effective period that you specify. If you do not enter an end date, then the hold rule set remains active indefinitely. To change the behavior of holding payments on expense reports for an operating unit, you must apply an end date to the current hold rule set, then assign a new hold rule set.

You can only assign a hold rule set that contains rules for holding credit card payments to an operating unit that uses the Both Pay scenario.

You must assign a hold rule set to an operating unit to make use of hold rules. If an operating unit does not have a hold rule set assignment, then the Expense Holds Workflow cannot initiate the hold process.

Audit List

The audit list contains the names of the employees whose expense reports are automatically audited. While on the audit list, every expense report that the employee submits is passed for audit. The type of audit conducted--receipt-based or paperless--depends on the selection criteria of the active audit rule set.

By default, all operating units can use the audit list and administrators can add employees to the audit list manually. If you want to automate the use of the audit list, you must assign the operating unit an audit rule set with the option “Audit expense reports of employees on the audit list” activated and create an audit list rule set.

Viewing and Maintaining the Audit List

The Audit List page contains a table of all employees currently on the audit list. The table displays employee name, organization, audit reason, and start and end dates. When the system date is later than the end date, Internet Expenses removes the employee from the audit list. From the Audit List page, you can choose options to update existing information for an employee or to add employees manually to the audit list.

Use the Maintain Audit List page to manage audit list information. For each employee, you can update:

You can also use a custom program that accesses the public Audit List API to update employee status information. See: Audit List API.

Adding Employees to the Audit List

You can add employees to the audit list in three ways:

If you have an audit list rule set assigned to an operating unit, Internet Expenses adds employees to the audit list automatically based on the criteria defined in the audit list rule set. See Audit List Rule Sets for more information.

If Internet Expenses automatically adds an employee to the audit list who is already on the audit list, then the system updates the end date of the current audit list entry with the system date and creates a new entry. (If the employee's audit reason is Termination or Leave of Absence, then Internet Expenses does not create a new audit list entry.) The employee remains on the audit list according to the value that you set for audit list duration. See Creating an Audit List Rule Set for more information.

You can add employees to the audit list manually at any time. There are two ways to add employees manually to the audit list:

When you add employees to the audit list manually using the Add Employees to Audit List page, Internet Expenses does not refer to the audit list duration setting for these employees. If you do not enter an end date, the employees remain on the audit list indefinitely.

When an auditor adds an employee to the audit list manually using the Always Audit Employee button on the Audit Expense Reports page, Internet Expenses uses the audit list duration setting.

To add employees to the audit list using the Add Employees to Audit List page:

  1. Navigate to the Add Employees to Audit List page.

  2. Use the Search function and the Select list to create a Selected list of employees to add to the audit list.

  3. Enter an audit reason for each employee.

  4. Enter a start date and end date for each employee.

    If you do not add an end date, then the employee remains on the audit list indefinitely.

  5. You can delete employees from the Selected list that you have created until you click Save.

  6. Save your work. Once you click Save, the employees on the Selected list are added to the audit list.

Audit List Rule Sets

Create one or more audit list rule sets to determine how employees are automatically added to the audit list. An audit list rule set contains:

You can update the values in an existing audit list rule set. You can remove an audit list rule set by adding an end date, if it is not assigned to any operating unit. As with audit rule sets, you create one or more audit list rule sets and assign an audit list rule set to each operating unit in your company.

If an audit list rule places an employee on the audit list who is already on the audit list with an indefinite status (that is, no end date), then the new placement does not change the employee's indefinite status.

Creating an Audit List Rule Set

Use the Create Audit List Rule Set page to create a new audit list rule set or to update an existing audit list rule set.

An audit list rule set contains three sections of information:

Enter Header Information

Enter an audit list rule set name and description. You can optionally enter an end date. Both Audit List Rule Set Name and Description are mandatory fields.

You cannot save an audit list rule set that contains header information only. You must at least complete the Audit List Duration section. If you create an audit list rule set that contains only header information and audit list duration, and you assign this audit list rule set to an operating unit, then Internet Expenses will not automatically add employees to the audit list. Internet Expenses will assign the audit list duration value to employees added to the audit list by an auditor using the Always Audit Employee button on the Audit Expense Reports page.

Enter Audit List Criteria

Choose the audit list selection criteria that you want for each audit list rule set. Internet Expenses automatically adds employees to the audit list according to the criteria you choose.

Receipt Package Received Date If you choose the criteria “Receipt package received after the maximum number of days” and set a maximum number of days, you must enter a Receipt Package Received Date on all expense reports. Once you activate and assign the audit list rule set, Internet Expenses automatically places employees on the audit list with:

Submit the Expenses Overdue Receipts Tracking concurrent program to use this rule. The program compares the expense report submit date to the system date, for expense reports that require receipts and the receipts have not been received. See: Expenses Overdue Receipts Tracking Program, Oracle Payables User Guide for more information.

Set Audit List Duration

Enter a value in the “Number of days on the audit list” field. This is a required field.

If an employee that is on the audit list is added to the audit list again, then Internet Expenses creates a new entry for the employee and restarts the count of number of days.

Assigning an Audit List Rule Set

After you create audit list rule sets, assign an audit list rule set to each operating unit in your company that you want to use the audit list. You can assign the same audit list rule set to more than one operating unit. When you update an audit list rule set, the changes you make apply to all of the assigned operating units.

If you assign an audit list rule set to an operating unit, you must ensure that you also assign an audit rule set to the same operating unit that has the option “Audit expense reports of employees on the audit list” activated, in order for Internet Expenses to use the audit list.

If you do not assign an audit list rule set to an operating unit but you do assign an audit rule set that uses the option “Audit expense reports of employees on the audit list”, you can still add employees to the audit list manually. In this case, Internet Expenses does not automatically add employees to the audit list or monitor the audit list duration.

Audit List API

Use the Audit List API to develop your own custom solution to maintaining the audit list. You can create programs to add employees to the audit list, update information for existing audit list entries, delete audit list entries, and extend the use of an existing audit rule set. For example:

The AP_WEB_AUDIT_LIST_PUB package is created to database using the code residing in the audit list API files: apwpalas.pls, apwpalab.pls, apwvalvs.pls, and apwvalvb.pls. The audit list API files are located in the directory:

$AP_TOP/patch115/sql-

Rules for Audit List Entries

To identify an individual employee, the AUDIT_EMPLOYEE procedure in AP_WEB_AUDIT_LIST_PUB requires the employee's business group name and a value for at least one of these parameters:

Rules for creating an audit list entry

Rules for deleting an audit list entry

Sample Entries and Updates

The examples in this section use tables to illustrate the use of the Audit List API with new and updated entries.

Example 1

Existing entry:

Employee Start Date End Date Audit Reason
JFrost 01-MAY-2004 30-JUN-2004 Receipts Late

New entry:

Employee Start Date End Date Audit Reason
JFrost 01-JUN-2004 30-JUN-2004 Leave of Absence

Result: Because the audit reason Leave of Absence has the higher priority, it overrides the existing Receipts Late entry, and ensures that the entries do not overlap. After the update, the audit list contains these entries:

Employee Start Date End Date Audit Reason
JFrost 01-MAY-2004 31-MAY-2004 Receipts Late
JFrost 01-JUN-2004 30-JUN-2004 Leave of Absence

Example 2

Existing entry:

Employee Start Date End Date Audit Reason
JFrost 01-MAY-2004   Termination

New entry:

Employee Start Date End Date Audit Reason
JFrost 01-JUN-2004 30-JUN-2004 Leave of Absence

Result: The existing Termination entry overrides the new Leave of Absence entry. After the update, the audit list contains this entry:

Employee Start Date End Date Audit Reason
JFrost 01-MAY-2004   Termination

Example 3

Existing entry:

Employee Start Date End Date Audit Reason
JFrost 01-MAY-2004 30-JUN-2004 Receipts Late

New entry:

Employee Start Date End Date Audit Reason
JFrost 01-JUN-2004 15-JUN-2004 Leave of Absence

Result: The Leave of Absence entry overrides the Receipts Late entry. After the update, the audit list contains these entries:

Employee Start Date End Date Audit Reason
JFrost 01-MAY-2004 31-MAY-2004 Receipts Late
JFrost 01-JUN-2004 15-JUN-2004 Leave of Absence
JFrost 16-JUN-2004 30-JUN-2004 Receipts Late

Example 4

Existing entry:

Employee Start Date End Date Audit Reason
JFrost 01-MAY-2004 30-JUN-2004 Receipts Late

New entry:

Employee Start Date End Date Audit Reason
JFrost 01-JUN-2004 15-JUN-2004 Policy Violations

Result: Because the audit reasons have equal priority, the new entry overrides the existing entry. After the update, the audit list contains these entries:

Employee Start Date End Date Audit Reason
JFrost 01-MAY-2004 31-MAY-2004 Receipts Late
JFrost 01-JUN-2004 15-JUN-2004 Policy Violations
JFrost 16-JUN-2004 30-JUN-2004 Receipts Late

Example 5

Existing entry:

Employee Start Date End Date Audit Reason
JFrost 01-MAY-2004   User-defined Reason

New entry:

Employee Start Date End Date Audit Reason
JFrost 01-JUN-2004 15-JUN-2004 Policy Violations

Result: Because the audit reasons have equal priority, and because the existing entry does not have an end date, the new entry is inserted according to its start and end dates, ensuring that the employee remains on the audit list. After the update, the audit list contains these entries:

Employee Start Date End Date Audit Reason
JFrost 01-MAY-2004 31-MAY-2004 User-defined Reason
JFrost 01-JUN-2004 15-JUN-2004 Policy Violations
JFrost 16-JUN-2004   User-defined Reason

Example 6

Existing entry:

Employee Start Date End Date Audit Reason
JFrost 01-MAY-2004   User-defined Reason

New entry:

Employee Start Date End Date Audit Reason
JFrost 01-JUN-2004 15-JUN-2004 Leave of Absence

Result: Because the Leave of Absence entry has a higher priority than the existing User-defined Reason entry, the new entry is inserted according to its start and end dates, and then the existing entry continues without an end date. After the update, the audit list contains these entries:

Employee Start Date End Date Audit Reason
JFrost 01-MAY-2004 31-MAY-2004 User-defined Reason
JFrost 01-JUN-2004 15-JUN-2004 Leave of Absence
JFrost 16-JUN-2004   User-defined Reason

Example 7

Existing entry:

Employee Start Date End Date Audit Reason
JFrost 01-MAY-2004 30-JUN-2004 Leave of Absence

New entry:

Employee Start Date End Date Audit Reason
JFrost 01-JUN-2004 31-JUL-2004 Leave of Absence

Result: Because the new entry and the existing entry have the same audit reason, the entries are merged. After the update, the audit list contains this entry:

Employee Start Date End Date Audit Reason
JFrost 01-MAY-2004 31-JUL-2004 Leave of Absence

Example 8

JFrost is on the audit list from 01-MAY-2004 to 30-JUN-2004 due to Receipts Late. He requests a Leave of Absence for the future-dated period 01-AUG-2004 to 31-OCT-2004. The request is approved. After the update, the audit list contains these entries:

Employee Start Date End Date Audit Reason
JFrost 01-MAY-2004 30-JUN-2004 Receipts Late
JFrost 01-AUG-2004 31-OCT-2004 Leave of Absence

On 15-JUL-2004 JFrost resigns. The audit list is updated with the employee's Termination and the API automatically deletes the overlapping Leave of Absence entry. After the update, the audit list contains these entries:

Employee Start Date End Date Audit Reason
JFrost 01-MAY-2004 30-JUN-2004 Receipts Late
JFrost 15-JUL-2004   Termination

The system administrator wants to keep the audit list clean and deletes the audit list entries for terminated employees. After the delete procedure, the audit list does not contain any audit list entries for JFrost:

Employee Start Date End Date
JFrost    

Example 9

According to company policy, all Finance department employees are on the audit list indefinitely. This ensures that their expense reports are always audited. The process owner has created a custom audit list reason called Finance Personnel for this purpose. KJones joined the department on 01-MAY-2003. The audit list entry for KJones is:

Employee Start Date End Date Audit Reason
KJones 01-MAY-2003   Finance Personnel

Since KJones is intended to stay on the audit list as long as she works for the Finance department, any new audit list entries with same level of priority are inserted according to their start and end dates, ensuring that the employee remains on the audit list. For example, this entry:

Employee Start Date End Date Audit Reason
KJones 01-SEP-2003 31-OCT-2003 Policy Violations

updates the audit list in this way:

Employee Start Date End Date Audit Reason
KJones 01-MAY-2003 31-AUG-2003 Finance Personnel
KJones 01-SEP-2003 31-OCT-2003 Policy Violations
KJones 01-NOV-2003   Finance Personnel

Between 01-OCT-2003 and 31-DEC-2003, KJones is on a leave of absence. After the update, the audit list contains these entries:

Employee Start Date End Date Audit Reason
KJones 01-MAY-2003 31-AUG-2003 Finance Personnel
KJones 01-SEP-2003 30-SEP-2003 Policy Violations
KJones 01-OCT-2003 31-DEC-2003 Leave of Absence
KJones 01-JAN-2004   Finance Personnel

31-MAY-2004 is the last day that KJones works in the Finance Department. This means that after this date the employee should not be permanently assigned to the audit list. After the update, the audit list contains these entries:

Employee Start Date End Date Audit Reason
KJones 01-MAY-2003 31-AUG-2003 Finance Personnel
KJones 01-SEP-2003 30-SEP-2003 Policy Violations
KJones 01-OCT-2003 31-DEC-2003 Leave of Absence
KJones 01-JAN-2004 31-MAY-2004 Finance Personnel

Audit Reasons API

Use the Audit Reasons API to create customized reasons for selecting expense reports for audit using the audit_expense report procedure in the AP_WEB_AUDIT_HOOK package. Your customized logic can either provide additional audit checks, or it can override the logic that Internet Expenses provides.

The AP_WEB_AUDIT_HOOK package resides in the files apwaudhs.pls and apwaudhb.pls in the directory:

$AP_TOP/patch115/sql-

If you introduce customized logic into the audit selection process, you may also need to define new audit reasons to appear on expense reports. You add these new audit reasons to the OIE_AUDIT_REASONS lookup type. See: Defining Payables Lookups for Oracle Internet Expenses.