OTBI Audit Reports

Jeff Rich-Terillium

Description

We need reports for auditing modifications to OTBI reporting components.  Only mod dates show, so we have no visibility into which user made the change or what was changed.  There is finally a set of reports for BI Publisher, but we need this for OTBI as well.  If all the same auditing reports could be available for OTBI, that should give us the info needed.

This idea is very similar to the request for FR Studio/Reports: https://community.oracle.com/customerconnect/discussion/633704

Use Case and Business Need

This severely limits internal/external audit's confidence around OTBI report component change controls.

Original Idea Number: 6769b86383

Jeff Hare CPA CISA CIA

Fully agree with this request. OTBI reports are relied upon in the execution of controls. Therefore, changes to the data model and report need to be changed tracked so external and internal auditors can have this as part of their change management population.

Regards,
Jeff Hare, CPA CIA CISA
CEO and Founder, ERP Risk Advisors

Matt Luscombe

I would also completely agree with this idea. Without these reports it is difficult to provide assurance over the reports that are used for key controls. At the moment it is not possible to know what the change to the report was, nor the history of changes to the report - this means that each report that is used for a key control that has been changed within a month will have to be re-reviewed from scratch.

Matthew Rekers

Agree. We need to look at this from a change management perspective and assurance.

Sarah Martinez

Clients often receive this request during Audits. They need to be able show who made the changes, when the changes were made, and what was changed.

BI reports have a way to audit.
https://www.oracle.com/technetwork/middleware/bi-publisher/wp-fusionbipaudit-5459609.pdf

However, I have not seen a similar solution for OTBI reports.

Youssouf

Agreed.
I am not familiar with BI Published & Sql.
It would be great if I could use otbi for such controls

Donna Curtis

The only other way to ensure there is no way to change a report after creation is to enable it as a privilege and add it to a custom role. The user can run it as a scheduled process and the report cannot be changed.. It is tedious and if the report needs changing ever, a new report (new privilege) needs to be created. Not an idea solution, but keeps the auditors a bit happier..

Jeff Hare CPA CISA CIA

For those of you following this idea, I'd suggest review this post.  

https://cloudcustomerconnect.oracle.com/posts/12825c99f1

The answer provided here 'may' solve the issue posed in this Idea.  We are doing research on the completeness and accuracy of the audit history provided as mentioned.  

Preston Schultz

Yes, this is needed as we have different types of BI Admins. We have those that are contractors who develop reports, we have the system administrators and those that own the reporting catalog. We have found that some users have accidentally moved or altered a report and need to pinpoint who did it so we can work with those users specifically.

blmars02

This is something we need as well. 

Tina Strasenburgh, PMP

Agreed. This is necessary for auditing purposes.