Decentralized Administrator (DA) Procedures for Performing Annual Audit of Privileges

Transcription

1 Decentralized Administrator (DA) Procedures for Performing Annual Audit of Privileges Annual Audit Steps: (1) Determine Your DA Purview (2) Run Resource Export Report (3) Review Privilege Assignments (4) Resolve Invalid Privilege Assignments (5) Check Center Responsible Person (CRP) for Centers (6) Documentation of Annual Audit (7) DA Checklist & Verification Form (optional) DA Annual Audit Procedures, Page 1

2 1. Determine Your Decentralized Administrator (DA) Purview A. To determine your Decentralized Administrator (DA) purview, first log into the Business Objects InfoviewXI application by clicking HERE or navigating to and selecting it as shown below: Note that when you reach the login dialogue box for InfoviewXI, make certain the Authentication field is set to LDAP, which means you will use your VUnet ID & epassword when signing in. DA Annual Audit Procedures, Page 2

3 B. Once you log in to InfoView, use the navigation menu on the left to locate and click on the PROD REPORTS folder for the Privilege Management universe. To do this, simply left-click in the four locations indicated by the red arrows below: Note: If you do not see the Privilege Management universe folder, you need access to the Privilege Management Business Objects universe. To get this, complete this form and follow the routing instructions on page 2 of the document. C. Once you click on the Prod Reports folder, you will see a variety of reports displayed in alphabetical order, by report name. Locate the one titled Decentralized Administrator (DA) Privilege and click on the report name, as shown below: D. Once you open the report, click the refresh data icon, which appears as in the upper right area of the report window. This will cause the Prompts menu for the report to appear. DA Annual Audit Procedures, Page 3

4 E. On the Prompts menu, enter your VUnet ID in the space shown below. Make certain it is in ALL CAPS or the report will fail. Once entered, click the RUN QUERY button as shown: F. Once refreshed, this report displays all the Resources where your Decentralized Administrator (DA) privilege is granted. This defines your DA purview, or to put it basically, what groups of Centers and/or Home Depts you are authorized to act as the Decentralized Administrator. This is important. You should either print this report or save it as a PDF to your PC, as shown below. Once this is complete, you may close out of this report (but remain logged in to InfoViewXI). DA Annual Audit Procedures, Page 4

5 2. Run Resource Export Report A. Now that you understand your DA purview, the next step is to run the Resource Export Report, which is a special report developed to help Decentralized Administrators perform their annual audit. Similar to the last section, this report is also found online through InfoViewXI. B. If you are not still logged-in, go to and click on the InfoView XI link. C. Once you login, use the navigation menu on the left of your screen to locate and click on the PROD REPORTS folder for the Privilege Management universe. To do this, simply left-click in the four locations indicated by the red arrows below: Note: If you do not see the Privilege Management universe folder, you need access to the Privilege Management Business Objects universe. To get this, complete this form and follow the routing instructions on page 2 of the document. D. Once you click on the Prod Reports folder, you will see a variety of reports displayed in alphabetical order, by report name. Locate the one titled Resource Export Report and click on the report name, as shown below: E. Once you have the report open, click the refresh data icon, which appears as in the upper right area of the report window. This will cause the Prompt menu for the report to appear. DA Annual Audit Procedures, Page 5

6 F. Earlier (step 1) we identified your purview as the DA and made note of the Sumto Center(s) and / or Home Department(s) where it is granted. Whatever your particular DA purview is, now will be the time that information comes into play. On the prompt menu, enter your first Sumto Center (ex: WLAW) in the area provided. Make certain you enter the Resource it in ALL CAPS or the report will not work. For the second part of the prompt menu, we must choose which hierarchy (or tree structure) this Sumto Center appears in. Without getting too involved in what this means, simply refer back to your DA Purview report (Step 1). This report s far-right column tells you exactly which Tree your chosen Resource belongs to and, with this information, you can complete the second part of the prompt menu. DA Annual Audit Procedures, Page 6

7 Simply follow the steps and click where indicated in the illustration above. Using our earlier DA Purview report, we see that WLAW pertains to the Structure 5 Tree, so we select this. IMPORTANT: When completing the second part of the prompt menu, where it asks you to Enter Structure (Tree) Name, you will need to refer back to your DA Purview report you created in Step 1. The far-right column shows you what Tree structure contains your Resource. 3. Review Privilege Assignments It may take a few seconds for the report to finish the query and display results. Once results appear on screen, it is important to save the report on your computer, since InfoView will time-out while you are reviewing the data. To save the report on your computer, simply drop-down the DOCUMENT menu, select SAVE TO MY COMPUTER AS and choose EXCEL format. This is shown below: DA Annual Audit Procedures, Page 7

8 Now that you have saved the report into Excel format on your PC, go ahead and open up your new file in Excel. It is important to familiarize yourself with the layout. There are 3 tabs on this Excel spreadsheet (Assignments At/Below Resource, Hierarchy, and Center Responsible Person). Each row represents a different privilege assignment from the Privilege Management system that is in your purview. Most of the columns are self-explanatory, but there are a few things worth noting. The Deviation column (far left) indicates how many levels down a privilege assignment is from the original resource you entered on the report prompt. In the below example, the column indicates how far down from WLAW these privilege assignments are. Since the assignments shown are granted on WLAW (2 nd column from left), the deviation value is zero. The Resource column (2 nd from left) is where the privilege assignment is granted. In the above excerpt, each row shows a privilege assignment granted directly on the WLAW sumto center, which is also why the Deviation column value is 0. The Type column (3 rd from left) simply tells you what type of resource this is. It will display any of the following, depending on what you entered on the prompt menu of this report: SC (Sumto Center) LC (Low-level Center) SD (Sumto Home Department) LD (Low-level Home Department) Tying this with the above example, the privilege assignments shown on each row are granted directly on WLAW, which is a sumto center that we entered on the prompt menu of this report. NOTE: Only one privilege attribute can appear on each row, so privileges with more than one attribute will appear on sequential rows. In the above example, the last two rows both show that eprocurement Reviewer is assigned to Chris Guthrie on the WLAW sumto center. The reason for this is because eprocurement Reviewer has more than one privilege attribute (Dollar Limit, Fed Indicator, Fund Type), as shown in the last two columns. DA Annual Audit Procedures, Page 8

9 4. Resolve Invalid Privilege Assignments As the Decentralized Administrator for your area, it is now time to review the privilege assignments in your area. What you are looking for are invalid privilege assignments. Examples include any of the following situations: Scan down the User Name or VUnet ID columns (G & H in Excel) for personnel who have terminated from your department and from Vanderbilt altogether. Scan down the User Name or VUnet ID columns (G & H in Excel) for personnel who have transferred out of your department to another area at Vanderbilt and no longer need privileges on centers and home departments in your purview. Anyone you identify who falls into either of the two above scenarios should have the corresponding privileges removed from the Privilege Management (PM) application. As the Decentralized Administrator, you are authorized to do this as part of your annual privilege audit. If the removal involves a high risk assignment, the workflow approval process will be triggered in the PM application. For a list of all privileges, including those which invoke workflow, go HERE or visit and look under Resources. NOTE 1: It is mandatory for DAs to run these reports and perform the aforementioned reviews for each Sumto Center and / or Home Dept that comprise their purview, as stated in the Decentralized Administrator Policy & Procedures documentation. NOTE 2: It is recommended that while performing this annual scrub of privileges, DAs use the opportunity to also review the accuracy of privilege assignments in their purview. This is an optional cleanup to insure the following: Users have consistent or preferred Signature Authority (SigAuth) dollar limit amounts. This is in accordance with any guidance your department provides. Users have unnecessary or duplicate privileges assignments removed. An example of this is a user with a privilege (ex: edog Viewer) granted on a sumto center (ex: WLAW) and the same user also holding the same privilege on one or more 10 digit cost centers that roll up to the sumto center (ex: rolls up to WLAW). In this example, the edog Viewer granted on the cost center is unnecessary since edog Viewer granted on the WLAW sumto automatically gives access to all cost centers underneath WLAW by way of inheritance. DA Annual Audit Procedures, Page 9

10 5. Check CRP for Centers Using the same Excel file you created in Step 3, click on the third worksheet tab on the far right, titled Center Responsible Person. This report tab displays all the 10-digit cost centers that roll-up (directly or indirectly) to the Sumto Center you entered on the prompt menu, but is designed to quickly highlight the Center Responsible Persons (CRPs) each. NOTE: This tab will remain blank if you refresh the report with a Home Dept or SumtoHD, since HDs do not have CRPs. As part of the DA annual review, scroll through the CRPs for each resource in your purview to determine if changes or updates are needed. Should you identify one or more CRPs in need of updating, simply compile that information in an (include Center# with the name of the new CRP) and submit as a request to ofa@vanderbilt.edu. 6. Documentation of Annual Review Decentralized Administrators can retain either paper or electronic copies of their Excel exports used for this audit as proof of its execution and justification for removing invalid or unnecessary privilege assignments. Regardless of how DAs choose to maintain historical records of this activity, it is important to keep these files organized and readily available. In the event of an internal audit or other review of your functional area, this documentation will be of great value. DA Annual Audit Procedures, Page 10

11 7. Checklist and Verification for DA Annual Privilege & CRP Audit DAs can use the complimentary checklist below to help ensure this once yearly task is completed and documented as-needed. Use of this checklist is optional. 1. Determine your DA purview & save copy of report (pgs. 2-4) 2. Run the Resource Export Report in Business Objects (pgs. 5-7) 3. Save local copy of Resource Export Report in Excel (pg. 7) 4. Review & resolve invalid privileges in purview (pg. 8-9) 5. Check Center Responsible Person (CRP) field for centers (pg. 10) 6. Document completion of annual audit (pg. 10) Signature of Decentralized Administrator Date of completion DA Annual Audit Procedures, Page 11