ERP - Trương Minh Tuấn ď AX2012_ENUS_FINII_A

Appendix A: Audit and Compliance Topics APPENDIX A: AUDIT AND COMPLIANCE TOPICS Objectives The objectives are: • Introduce the Default Controls Library and provide a basic overview of how to manually create new controls • Discuss how to import controls from the default library • Create and view audit policies and policy rule types • Create and view audit cases Introduction One challenge that customers face today is identifying which controls to use to make sure that their business complies with laws, business rules, policies and regulations and audit requirements The Default controls library in Microsoft Dynamics® AX contains many of the most frequently used controls This library provides a resource for customers who are searching for various types of controls that will help meet their needs You can use audit policies to evaluate expense reports, vendor invoices, and purchase orders for compliance with policy rules that you create All of the rules that are associated with an audit policy are run in batch mode according to the schedule that you specify Each policy rule is an instance of a policy rule type For each policy rule type, only one policy rule can be active at a time Microsoft Official Training Materials for Microsoft Dynamics® Your use of this content is subject to your current services agreement Financials II in Microsoft Dynamics® AX 2012 Default Controls Library The Default controls library in Microsoft Dynamics® AX contains many of the most frequently used controls This library provides a resource for customers who are searching for various types of controls that will help meet their needs Customers who have their own control matrix can use the Default controls library to supplement their control matrix by adding controls in the Compliance Center For customers who not have a control matrix, the Default controls library can be repurposed and used as a control matrix from which to select the controls to add to their Compliance Center Entries in the Default controls library can be used as a guide for customers who decide to manually enter controls to the Compliance Center Customers can also use the Import and mapping wizard in Compliance Controls to automate the addition of some or all of the Default controls library controls on the Compliance Center A workbook that contains many common compliance controls is available on the Compliance site in Enterprise Portal You can refer to this library when you manually enter controls on the Compliance site; or, you can use the library as the source file to import controls to the Compliance site Microsoft Official Training Materials for Microsoft Dynamics® Your use of this content is subject to your current services agreement Appendix A: Audit and Compliance Topics Terminology The compliance and internal controls process available in Microsoft Dynamics AX involves several terms and concepts The following table introduces these terms and concepts Term Definition Control matrix Refers to a file, almost universally a Microsoft Office Excel spreadsheet that customers use to list, manage, and keep track of their controls This file can be used as the source file for importing and mapping a compliance environment and importing activities into the Compliance Center Control A means by which users manage identified elements of their business to make sure that the policy, regulation, tenet, or other requirement is followed during normal day to day business operations Control environment The environment that is set up within the Compliance Center to which controls are associated Environments are typically a hierarchical node structure The Default Controls Library contains various controls for Microsoft Dynamics AX users to select from The Default Controls Library Excel spreadsheet is installed and stored in the Compliance Center Compliance Resources document library For additional information on this topic, refer to the Microsoft Dynamics AX application documentation Procedure: Manually Add Controls to the Library To manually add new controls types to the Default Controls Library in the Compliance center, follow these steps: 10 Open the Enterprise Portal website through your web browser Click Compliance Click Compliance resources on the left pane Click the Default Controls Library file and then click Download a copy on the Action pane Enter a Name for the file such as "Default Controls Library" Select a location for the file to be saved to Click Save Browse to the location where the file was saved, and then doubleclick to open it in Microsoft Office Excel Create a new line in the spreadsheet Save the file Microsoft Official Training Materials for Microsoft Dynamics® Your use of this content is subject to your current services agreement Financials II in Microsoft Dynamics® AX 2012 Import and Mapping Wizard The Import and mapping wizard lets you import your internal controls into the Compliance Center from an existing, preformatted control matrix spreadsheet that your company uses Before you use the Import and mapping wizard you must set up the following: • Establish the document templates • Create the control environment When the control environment is set up, users will open the Import and Mapping wizard, open their control matrix, and for every entry they want to import, select two settings Select the compliance environment(s) node that the control should fall under Select the document template that the control will use when it is loaded onto the system This includes mapping template properties to corresponding data in the matrix Procedure: Importing Controls To import controls into the Compliance Center, follow these steps: Open the Enterprise Portal website through your web browser Click Compliance Click Import on the left pane, and then click Next NOTE: The wizard cannot be completed unless at least one environment is configured and at least one template exists Select the file to be imported, and then click Next Review the data that is displayed from the selected file, and then click Next NOTE: The file selected must be in the correct format to import Use the Formatting guidelines link on the first page of the wizard for more information about allowed formats Use the Back button to return to the first page of the wizard Select the column that will be used to map the control matrix environment data to the Compliance Center environment, and then click Next Continue mapping each column from the spreadsheet to the corresponding Compliance Center control, and then click Next Select the document template and the template properties (one at a time), and then select the corresponding control matrix When you are finished, click Next Microsoft Official Training Materials for Microsoft Dynamics® Your use of this content is subject to your current services agreement Appendix A: Audit and Compliance Topics Click Import to process the import When the import is complete, the system will display a message; click Finish Audit Policies, Rules and Cases You can use audit policies to evaluate expense reports, vendor invoices, and purchase orders for compliance with policy rules that you create All of the rules that are associated with an audit policy are run in batch mode according to the schedule that you specify Each policy rule is an instance of a policy rule type For each policy rule type, only one policy rule can be active at a time Before you can create an audit policy, you must first define the policy parameters that will be used by all audit policies Procedure: Creating Audit Policies To create audit policies, follow these steps: Click Compliance and internal controls > Common > Policies > Audit policies On the Action Pane, click Parameters to open the Policy parameters form The available organization types are displayed in the Organization types: list Select the organization types to create policies for and then click the Add button Although you must select at least one organization type to use audit policies, you not have to change the order of precedence for those organization types When an audit policy is run, all rules in that policy are run The system does not select which audit policy rules to run based on the order of precedence Policy rule types define the document and query parameters that are used when you develop specific policy rules Procedure: Creating Policy Rule Types To create audit policy rule types complete the following steps: Click Compliance and internal controls > Setup > Audit > Policy rule type Click New to create an audit policy rule type Enter a name and a brief description of the policy rule type Microsoft Official Training Materials for Microsoft Dynamics® Your use of this content is subject to your current services agreement Financials II in Microsoft Dynamics® AX 2012 In the Query name field, select the default Application Object Tree (AOT) query to use as the starting point for developing policy rules for this policy rule type The query indicates the source document that the policy rule type is defined for In the Query type field, select the type of database query that users can build when they create audit policy rules by using this policy rule type In the Document date reference field, select the field in the source document that identifies the date to use when documents are selected for audit Create any additional policy rule types that your organization needs and then close the form Queries and Query Types When you create an audit policy rule, you first select a policy rule type The policy rule type specifies the Application Object Tree (AOT) query to use as the starting point for creating the policy rule It also specifies the query type to use for the policy rule The query determines the source document that the policy rule will evaluate It also specifies the field in the source document that identifies the legal entity and the field that identifies the date to use when documents are selected for audit The query type controls the default fields in the query form and in the Audit policy rule form The following table shows the query types that are available for audit policy rules Query Type Purpose Conditional Evaluate source document attributes against specified values Aggregate Evaluate multiple source documents or source document lines against a policy rule by aggregating numeric values Sampling Randomly select a specified percentage of the source documents to evaluate for policy violations Duplicate Evaluate source documents to determine whether they contain duplicate entries in specified fields List Search Evaluate source documents for specific entities Keyword Search Evaluate source documents to determine whether they contain certain words When you select the Sampling option, the Audit policy rule form includes an option that lets you specify the percentage of documents to randomly select for audit Microsoft Official Training Materials for Microsoft Dynamics® Your use of this content is subject to your current services agreement Appendix A: Audit and Compliance Topics When you select the Duplicate option, the Audit policy rule form includes an additional option that allows you to specify the number of days to add to the start of the document selection date range when documents are evaluated for duplicate entries When you select the List Search option, the root document of the query defines the document that is being audited The query must contain a join with the DirParty table The List Search option can be used only with the following (AOT) queries: • AuditPolicyExpenseList - Expense report monitored employees • AuditPolicyPurchList - Purchase order monitored vendors • AuditPolicyVendInvoiceList - Vendor invoice monitored vendors When you select this option, specify the monitored entities in the Additional options form before you create the policy rule When you select the Keyword Search option, enter the words to look for in the Additional options form before you create the policy rule The Audit policy rule form includes options that allow you to specify the tables and fields to evaluate for the words entered All of the policy rules for a particular audit policy share the same batch parameters and the same document selection date range These parameters are specified in the Additional options form for the policy Before you can define an audit policy, you must create the policy rule types that will define the document and query parameters for the policy rules You must also make sure that the policy parameters have been set up appropriately Procedure: Set Up Policy Parameters To verify or set up policy parameters, follow these steps: Click Compliance and internal controls > Common > Policies > Audit policies On the Action Pane, click Policy to create an audit policy On the General FastTab, enter a name and description for the audit policy Microsoft Official Training Materials for Microsoft Dynamics® Your use of this content is subject to your current services agreement Financials II in Microsoft Dynamics® AX 2012 On the Action Pane, click Additional options o o o o o Enter the starting date and ending date of the document selection date range This range determines which version of a policy rule to use, based on the effective dates of the policy rule It also determines which organization nodes were associated with the policy during that date range If you are creating a policy rule that uses the List search query type to evaluate source documents for specific entities, enter the entities on the Monitored entity FastTab If you are creating a policy rule that uses the Keyword search query type to evaluate source documents to determine whether they contain certain words, enter the words on the Prohibited words FastTab Each audit policy is run in batch mode To verify or change the parameters for the batch job, click the Batch button Click Close to return to the Audit policy form On the Policy organizations FastTab, select an organization type This is the organization type that the audit policy will apply to A single policy can apply to only one organization type The organization nodes that have been created for the selected organization type are shown in the Available organization nodes: list Select the nodes to be affected by this audit policy and then click the Add >> button to move those organization nodes to the Selected organization nodes: list The association of the organization node with the audit policy is effective on the date and time that you add it to the Selected organization nodes: list The association expires when you remove the organization node from the list Policy rules cannot be tested for any dates on which there is no organization node associated with the policy On the Policy rules FastTab, develop the policy rules that are needed for this policy Microsoft Official Training Materials for Microsoft Dynamics® Your use of this content is subject to your current services agreement Appendix A: Audit and Compliance Topics Develop Policy Rules An audit policy rule consists of a database query that is run against source documents The policy rule types define the document and query parameters that are used when you develop policy rules Procedure: Create a Policy Rule To create a policy rule, complete the following: Click Compliance and internal controls > Common > Policies > Audit policies Double-click the policy to create policy rules for On the Policy rules FastTab, select the policy rule type to develop a policy rule for, and then click Create policy rule The fields that are displayed in the Audit policy rule form depend on the selected policy rule type and its associated query In the Effective date and Expiration date fields, enter the date range when this policy rule is effective If you not enter values in these fields, the policy rule will be effective when it is created, and it will never expire Complete other fields as required, depending on the query type that is associated with the policy rule type Click Select to open a query form This button is not available for policy rules that are based on the List search or Keyword search query types Use the query form to specify the criteria to use for this policy rule, and then click OK The fields that were set up by default in the policy rule form will also be set up in the query form After the policy rule is set up, click Test Enter the document selection date range to use for the test The dates that you enter in this form are used only for the test They are not saved, and they not affect the document selection date range that is defined in the Additional options form Click Run test Review the results of the test If the results are not what you expected, modify the database query and repeat the test Microsoft Official Training Materials for Microsoft Dynamics® Your use of this content is subject to your current services agreement Financials II in Microsoft Dynamics® AX 2012 If you still not receive expected results, the following: • Verify that an organization node was associated with the policy during the data selection date range that you specified for the test Policy rules cannot be tested for any dates on which no organization node is associated with the policy • Verify that source document records exist that were created on or after the policy was created Records that existed before the policy was created cannot be audited The only exception is for policy rules that are based on the Duplicate query type, which can audit records up to 180 days in the past Audit Policy Violations and Cases Audit policies are used to identify expense reports, purchase orders, and vendor invoices that not comply with business rules that you define and configure as audit policy rules Audit policies are run in batch mode When you run an audit policy, all the policy rules that are part of that policy are run at the same time Each policy rule evaluates a set of documents and selects those that are in the document selection date range and match the specified criteria For example, one policy rule might select expense reports with meals exceeding 50.00 Another policy rule might select vendor invoices that are payable to a particular vendor For each document in the set that is selected, a violation is generated That violation is a record that a particular document, such as invoice 12345, does not comply with the policy rule Multiple audit violation records are grouped together and associated with audit cases By default, cases for each audit policy are grouped by the audit policy rule If you prefer, you can select other criteria for grouping using the Case grouping criteria form You could, for example, group expense headers by project ID and vendor invoices by vendor account If you were to this, all expense header violations that have the same project ID would be grouped in the same case, and all vendor invoices that have the same vendor account would be grouped in the same case After the audit cases have been generated, they are handled using the typical processes for case management For audit policy rules that are based on a Duplicate query type, violations are not grouped by policy rule or by the criteria specified on the Case grouping criteria form Instead, they are grouped by the criteria that are built into the audit policy rule For example, if a policy rule evaluates expense reports for duplicate expenses of the same amount, merchant ID, and date, all expenses that have the same values in those fields would be one case If other expenses had different values, those would be a separate case 10 Microsoft Official Training Materials for Microsoft Dynamics® Your use of this content is subject to your current services agreement Appendix A: Audit and Compliance Topics When the policy is run, each policy rule selects documents of the specified type that have a date that is in the document selection date range The document selection date range is specified in the Additional options form Many documents have more than one date associated with them The date field that is used by the audit policy rule is specified in the Policy rule type form Document Selection Date Ranges The document selection date range has additional functions for an audit policy • The policy uses the version of each policy rule that is effective on the last day of the document selection date range Effective dates for each policy rule can be seen on the Audit policies list page • The policy uses the organization nodes that are associated with the policy on the last day of the document selection date range Only the organization nodes that are currently associated with the policy are displayed on the Audit policies list page • The policy uses the organization nodes that are associated with the policy on the last day of the document selection date range Only the organization nodes that are currently associated with the policy are displayed on the Audit policies list page • For policy rules that are based on a List search query type, the policy evaluates documents for monitored entities that are effective on the last day of the document selection date range Case Management You can use case management in Microsoft Dynamics AX and in Enterprise Portal for Microsoft Dynamics AX to record, update, track, follow up on, and close issues that are raised by customers, vendors, or employees, or that are created through your audit processes By planning, tracking, and analyzing cases, you can develop efficient resolutions that can be used for similar issues For example, when customer service representatives or human resources generalists create cases, they can find information in knowledge articles about how to work with or resolve a case more efficiently Because you can use case management for customer, vendor, or employee issues, the Cases form is located in Home in Microsoft Dynamics AX Audit cases are always managed in Compliance and internal controls, even when they relate to documents that are created in other modules Case Setup The operations manager wants customer service representatives and human resources generalists to be able to create cases for customers, vendors, and employees Before any one of these cases can be created, he must set up case categories and case processes Microsoft Official Training Materials for Microsoft Dynamics® Your use of this content is subject to your current services agreement 11 Financials II in Microsoft Dynamics® AX 2012 The internal auditor wants audit cases to be generated automatically when the audit policy is run against expense reports Each audit case contains a group of audit policy violations She also wants to have the option to create audit cases manually For these cases, she can use the categories that are created when an audit policy is run, or she can create special categories to use for cases that are manually created For more information about how to create case processes and categories, see the Create case processes and categories topic in Microsoft Dynamics AX product documentation Case Grouping and Categories The first step is to determine how audit violations should be grouped into cases By default, each audit case contains all of the audit violations that were created for a particular document type and audit policy rule You can specify other case grouping criteria if necessary The first thing the operations manager must is create categories for cases Case categories provide the ability to group similar case types together For example, the operations manager might create categories for sales, employee benefits, or deliveries He might also create child categories that group the cases at a more detailed level For example, under a sales category, he could add child categories for pre-sale issues and post-sale issues The internal auditor can decide to create categories for cases that are created manually She does not have to create categories for audit cases that are created automatically Every case must be assigned to a case category Grouping cases by category can help employees identify known solutions, such as knowledge articles, if similar issues occur over time Working with Cases After setup is complete, employees with the appropriate permissions can create cases as issues are raised Cases can be created in Microsoft Dynamics AX and in Enterprise Portal The following table describes tasks that employees can perform when they work with case management 12 Task Description Create a case Create a new case record for a customer, vendor, or employee, or for the results of an audit of business documents Add details to a case Add detailed information such as activities to a case Close a case Change the status of an open case to Closed to indicate that the issue has been resolved Microsoft Official Training Materials for Microsoft Dynamics® Your use of this content is subject to your current services agreement Appendix A: Audit and Compliance Topics Task Description Store a knowledge article Create and store a knowledge article that includes tips, solutions, and other important information about an issue Rank a knowledge article Rate a knowledge article to indicate if it was successful in helping to close a case After you create a case, you can add activities, dependent cases, associations, case log information, documents, and responsibilities to the case You can add these details when you first create the case or you can add them later as needed Procedure: Add Details to a Case To add details to a case complete the following steps: Click Home > Common > Cases > All cases Double-click the case that you want to update Select the tab that corresponds to the information that you want to add to the case Use the following information to complete this task: • Case log tab - Click Add to create a new case log information line and enter the appropriate information Click Details to open the Source type form to view source types for lead and opportunity records • Associations tab - Click Add to create a new line and add information about an entity that is associated with the case that you are currently working on • Knowledge article tab - Click Add to add knowledge article information to the case Click Details to open the Knowledge article form When a case has been resolved, either internally with an employee or externally with a customer or vendor, you can close the case The case record is saved, but the record is removed from the case list Microsoft Official Training Materials for Microsoft Dynamics® Your use of this content is subject to your current services agreement 13 Financials II in Microsoft Dynamics® AX 2012 Procedure: Close a Case To close a case, complete the following steps: Click Home > Common > Cases > All cases In the list, select the case that you want to resolve In the Maintain group, click the Change status button and select Closed When you close a case, the service level agreement (SLA) associated with the case is also closed If a follow up activity is required for the case, an activity is created and you will receive a prompt to complete the activity Summary This appendix provides some basic information about a few of the Microsoft Dynamics AX audit and control features To learn more about these topics and any additional audit and compliance related topics, refer to the Microsoft Dynamics product documentation The topics discussed in this appendix included: 14 • The control library • Manually create new controls • How to Import controls from the default library • Audit policies and policy rule types • Audit cases Microsoft Official Training Materials for Microsoft Dynamics® Your use of this content is subject to your current services agreement ... queries: • AuditPolicyExpenseList - Expense report monitored employees • AuditPolicyPurchList - Purchase order monitored vendors • AuditPolicyVendInvoiceList - Vendor invoice monitored vendors... detailed level For example, under a sales category, he could add child categories for pre-sale issues and post-sale issues The internal auditor can decide to create categories for cases that are... Associations tab - Click Add to create a new line and add information about an entity that is associated with the case that you are currently working on • Knowledge article tab - Click Add to add