36Application Change Auditing

This chapter contains the following:

Overview of Auditing in Oracle Applications

Auditing is used to monitor user activity and all configuration, security, and data changes that have been made to an application. Auditing involves recording and retrieving information pertaining to the creation, modification, and removal of business objects. All actions performed on the business objects and the modified values are also recorded. The audit information is stored without any intervention of the user or any explicit user action.

Use audit policies to select specific business objects and attributes to be audited. The decision to create policies usually depends on the type of information to be audited and to the level of detail required for reporting.

Enabling Audit Functionality

For Oracle Applications Cloud, you must configure the business objects and select the attributes before enabling audit. If you enable audit without configuring the business objects, auditing remains inactive. By default, auditing is disabled for all applications. To enable and manage audit, ensure that you have a role with the assigned privilege Manage Audit Policies (FND_MANAGE_AUDIT_POLICIES_PRIV). For appropriate assignment of roles and privileges, check with your security administrator.

To enable auditing for Oracle Fusion Middleware products, select one of the levels at which auditing is required for that product. The audit levels are predefined and contain the metadata and events to be audited. For more information, see Audit Events for Oracle Applications Cloud Middleware (Doc ID 2114143.1) on My Oracle Support at https://support.oracle.com.

If you don't want an application to be audited, you can stop the audit process by setting the Audit Level option to None.

To set up auditing for Oracle Applications Cloud, select the Manage Audit Policies task from the Setup and Maintenance work area within your offering. To set up auditing for Oracle Fusion Middleware products, select the level of auditing mapped to a predefined set of metadata and the events that have to be audited. Information about configuring audit for Oracle Fusion Middleware products is provided in Oracle Fusion Middleware guides.

You can also create a configuration file and deploy it to audit a specific Oracle Fusion Middleware product. The configuration details for Oracle Fusion Middleware products are available as audit-specific assets that you can use to create the config.xml configuration file. To get a list of audit-specific assets, see Audit Events for Oracle Applications Cloud Middleware (Doc ID 2114143.1) on My Oracle Support at https://support.oracle.com.

Oracle Fusion Middleware Products

Oracle Fusion Security Products

You can use audit history to view changes to the application data, such as the business objects that were created, updated, and deleted. You must have a role with the assigned privilege View Audit History (FND_VIEW_AUDIT_HISTORY_PRIV) to view the history or to create a report. For appropriate assignment of roles and privileges, check with your security administrator.

To open the Audit History work area, click Navigator > > Audit Reports.

The default search displays a summary of the audit history in the search results table. It includes key data such as date, user, product, event type, business object type, and description. For a detailed report, search again with modified search criteria. You can export the report summary to Microsoft Excel.

This table lists the search parameters used and the outcome of their selection in the detailed report.

Search Parameter Result of Selection

Business Object Type

Note: This parameter is applicable only for the business objects that belong to Oracle Applications Cloud.
  • Narrows the search results to that specific business object within the selected product.

  • Enables the Show Attribute Details check box.

Include Child Objects

Displays all the child objects that were listed for that business object when audit was set up. For example, a sales order object that contains several items as child objects.

Note: Displays the objects at the immediate parent-child level only. You can view the children at subsequent levels, by selecting the child object as the business object type and search again.

Show Impersonator

Displays the details of the impersonator who modified the objects during an impersonation session.

Show Attribute Details

Enables the attribute list so that users can select either all attributes or a specific attribute to view the changes. Based on the selection, the search results indicate whether the attribute is created, updated or deleted, and the corresponding old and replaced values.

Show Additional Object Identifier Columns

Displays the instances (contexts) in which the business object was used. The context values identify the objects and the transactions in which they were used. Each context is unique and assigns a unique description to the business object.

Note: The default report displays a standard set of columns that contain prominent details of the audit history. To view additional details, you can change the display of columns.

Audit enables tracking the change history of particular attributes of a business object. However, those objects and their attributes must be selected for audit and auditing must be enabled for that application. Your configuration settings determine which attributes to audit for a given object, and when the audit starts and ends. Auditing takes into account all the operations performed on an object and its attributes, such as create, update, and delete. To configure audit business object attributes, use the Manage Audit Policies task in the Setup and Maintenance work area.

Selecting an Application

To set up auditing, you must select a web application that contains the required business objects that can be audited. From the list of business objects, select those business objects that you want to audit. Selecting a business object also displays its attributes that are enabled for auditing.

Selecting Attributes

For each selected business object to be audited, select the corresponding attributes to include in the audit. All attributes that belong to that object are by default selected for audit and appear on the user interface. However, you can add or remove attributes from the list. When you remove an attribute from the list, you stop auditing it even when the parent object is selected for audit. So, if you want an attribute to be audited, you must add it to the list. If the object selected in an audit hierarchy is also a part of several other audit hierarchies, the attribute configuration for that object is applicable to all the hierarchies in that application.

Tip: For business objects based on flexfields, select the Flexfields (Additional Attributes) check box to view and add or remove flexfield attributes, to include or exclude them from the audit.

Starting and Stopping Audit

The business object is ready for audit after you select its attributes and save the configuration changes. However, to start auditing, the audit level for Oracle Applications Cloud must be set to Auditing on the Manage Audit Policies page.

To stop auditing an object, you can deselect the entire object and save the configuration. As a result, all its selected attributes are automatically deselected and aren't audited. To continue to audit the business object with select attributes, deselect those attributes that aren't to be audited. When users view the audit history for an application, they can specify the period for which they want the results. Therefore, make a note of when you start and stop auditing an application.

For example, users intend to view the audit history of an object for the previous week, but auditing for that object was stopped last month. They wouldn't get any audit results for that week, because during the entire month that object wasn't audited. Even if you enable audit for that object today, users can't get the wanted results because audit data until today isn't available.

Auditing the Sales Applications

Use Auditing to Monitor Sales Application Changes

You use auditing to monitor user activity and all configuration, security, and data changes that have been made to an application. You can enable business objects to allow auditing, recording, and retrieving information about when the objects were created, modified, and removed.

Here's a list of sales business objects that you can enable for auditing.

Area Parent Objects Child Objects

Account and Contact Management

Account (Account Profile)

  • Sales Account Profile

    • Sales Account Resource

    • Sales Account Territory

  • Address

    • Address Purpose

  • Phone

  • Email

  • Instant Messaging

  • Web

  • Classification Assignment

  • Additional Account Name

  • Contact Preference

  • Usage Assignment

  • Additional Identifier

  • Source System References

  • Relationship

    • Customer Contact Profile

Account and Contact Management

Contact (Person Profile)

  • Sales Account Profile

    • Sales Account Resource

    • Sales Account Territory

  • Contact Address

    • Address Purpose

  • Phone

  • Email

  • Instant Messaging

  • Web

  • Classification Assignment

  • Additional Contact Name

  • Contact Preference

  • Usage Assignment

  • Additional Identifier

  • Source System References

  • Relationship

    • Customer Contact Profile

Account and Contact Management

Household (Household Profile)

  • Sales Account Profile

    • Sales Account Resource

    • Sales Account Territory

  • Address

    • Address Purpose

  • Phone

  • Email

  • Instant Messaging

  • Web

  • Classification Assignment

  • Additional Household Name

  • Contact Preference

  • Usage Assignment

  • Additional Identifier

  • Source System References

  • Relationship

Account and Contact Management

Resource (Resource Profile)

  • Address

    • Address Purpose

    • Location SDO

  • Phone

  • Email

  • Instant Messaging

  • Web Page

  • Resource Organization Membership

  • Resource Role Assignment

  • Sales Representative Setup

Common Components

Activity

  • Contacts

  • Resources

Contracts

Contract Header

  • Buy Contract Line

  • Project Contract Line

  • Sales Contract Line

  • Service Contract Line

Opportunities

Opportunity

  • Opportunity Revenue

  • Opportunity Split Revenue

  • Opportunity Recurring Revenue

  • Opportunity Revenue Line Set

  • Opportunity Team Member

  • Opportunity Partner

Marketing

Leads

  • Leads Product

  • Leads Resources

  • Leads Contacts

  • Leads Territories

Marketing

Budget

  • Budget Entries

  • Fund Requests

Partner Relationship Management

Partner

  • Classification Assignment

  • Partner Type

  • Customer Contact Profile

  • Partner Certification

  • Expertise

  • Geographies Served

  • Industries Served

  • Product Specialties

  • Account Team

  • Address

  • Phone

  • Web

  • Email

  • Instant Messaging

Partner Relationship Management

Partner Program

  • Program Benefit Details

  • Program Objective Details

  • Program Contract Templates

Partner Relationship Management

Partner Enrollment

  • Enrollment Participants

  • Contract Enrollments

Territory Management

Sales Territory

  • Sales Territory Resource

  • Sales Territory Line of Business

  • Sales Territory Coverage

  • Sales Territory Coverage Dimension

  • Sales Territory Coverage Dimension Value

Territory Management

Sales Territory Proposal

Sales Territory Proposal

Enable Auditing of Activities

To audit Activities, you must enable the following attributes:

  • ACTIVITY_ID

  • ACTIVITY_NUMBER

  • ORIG_ENTITY_CODE

  • ORIG_ENTITY_NUMBER

To enable auditing for Activities:

  1. Sign in as a setup user.

  2. In the Setup and Maintenance area, search for the Manage Audit Policies task.

  3. In the Manage Audit Policies page, click Oracle Fusion Applications.

  4. Click Configure Business Object Attributes.

  5. Select Applications Common components from the drop-down list.

  6. Select Activities from the list of objects in Audit Name.

  7. In the Activity: Audited Attributes area, click the add icon.

    The Select and Add Attributes dialog box opens with the activity attributes selected.

  8. Select Activity ID, Activity Number, OrigEntityCode, and OrigEntityNumber.

    Note: You must enable OrigEntityCode, and OrigEntityNumber when you create, update or delete records in a batch.
  9. Click OK.

    The attributes are displayed in the Activity: Audited Attributes area.

  10. Click Save and Close.

For more information about how to configure auditing, the see Implementation Concepts for Audit Policies section in this chapter.

Salespeople can see a record's change history without having to leave the record, provided that you make the Change History subtab visible. You can display the Change History subtab for company-defined objects, and also for a set of standard objects, in Application Composer. Before you display this subtab, be sure to configure your audit policies using the Manage Audit Policies task in Setup and Maintenance.

You can allow the Change History subtab for these objects:

  • Accounts

  • Contacts

  • Opportunities

  • Leads

  • Activities

  • Deal Registration

  • Company-defined Objects

The steps to display the Change History subtab are the same for all objects. Here's a procedure with the Account object as an example.

To make the Change History subtab visible:

  1. Sign in as the sales administrator.

  2. Create a sandbox and make it active.

  3. Click Navigator > Configuration > Application Composer.

  4. In the navigation tree, select the Sales check box, expand Standard Objects > Accounts, and click Pages.

  5. Ensure that the Simplified Pages tab is selected.

  6. Create a new custom layout for the details page, or edit an existing custom layout.

  7. On the Details Layout page for the custom layout, click the add icon in the Subtabs Region, then click the Common component check box.

    Note: If both the Notes and Change History subtabs are already allowed, then you can't select the Common component check box.
  8. Click Next.

  9. Select the Change History check box.

    Note: If you can't select a check box, then that common component is already allowed for use in this custom layout.
  10. Click Save and Close.

  11. Test the changes: Navigate to Sales > Accounts as a salesperson. Edit an account and ensure you can see the Change History subtab in the Edit Account page.

  12. Publish the sandbox.

Provide Privileges and Verify the Change History Subtab is Displayed

If you have added the Change History subtab to a standard object, then make sure salespeople have the right privileges to view the new subtab. Provide corresponding security privileges to view the Change History subtab for the object. Here's a list of objects and their privileges.

Objects Privileges

Accounts

ZCM_VIEW_ACCOUNT_CHANGE_HISTORY_PRIV

Contacts

ZCM_VIEW_CONTACT_CHANGE_HISTORY_PRIV

Opportunities

MOO_VIEW_OPPORTUNITY_CHANGE_HISTORY_PRIV

Leads

MKL_VIEW_DEAL_LEAD_CHANGE_HISTORY_PRIV

Activities

ZMM_VIEW_ACTIVITY_CHANGE_HISTORY_PRIV

Deal Registration

MKL_VIEW_DEAL_REGISTRATION_CHANGE_HISTORY_PRIV

Here's how to grant salespeople the privilege to view the audit history in the Change History subtab, for company-defined objects.

  1. In Application Composer, go to the company-defined object and open its Security node.

  2. On the Define Policies page, in the Roles section, click the Change History check box for the Custom Objects Administration role.

    You can also reach this page from the Role Security link in the Common Setup region.

FAQs for Change Auditing

Can I display the Change History subtab for custom objects?

Yes, you can display the Change History tab on the pages of custom objects. Simply add the Change History subtab to the details page of the object.

Can I audit and view changes in custom fields on standards objects?

Yes. You can add custom fields to the list of attributes available for audit.

Can I modify the search-related fields on the Change History subtab?

No, you can't modify the search fields.

Can I audit the history of attachments?

No. The application doesn't support auditing attachments.

Does the audit begin only after the Change History subtab is visible?

Yes. The Change History subtab presents the audit information in the context of the record only if audit has been allowed for the object.

How is the performance on the Change History subtab?

The Change History subtab is faster than the central or fundamental audit reports because only a single record's history is audited at one time. However, it takes more time than the normal clicks to complete a business action on the UI.