Oracle IT Audit Software Consulting

The PCAOB's audit approach is layered: application controls (segregation of duties, approval workflows, three-way match) are only as reliable as the ITGCs that protect the systems running them. If access provisioning is uncontrolled, a user can be granted — and quietly have removed after testing — the exact combination of duties that would otherwise be flagged by Advanced Access Controls. If change management is uncontrolled, a configuration change can silently disable an approval threshold between one testing cycle and the next. An auditor who finds an ITGC deficiency typically has to expand testing on every application control downstream of it, which is why ITGC failures are disproportionately expensive relative to their apparent scope.

IT audit software exists to make ITGC testing systematic rather than ad hoc: pulling access logs, provisioning/deprovisioning records, change tickets, and system configuration snapshots into a structured testing workflow with defined attributes, sample sizes, and sign-off — the same workpaper discipline application controls get, applied to the infrastructure layer.

Fusion Cloud ERP is Oracle-managed SaaS, which means physical security, database administration, patching cadence, and infrastructure change management for the underlying platform are Oracle's responsibility, typically evidenced through Oracle's own SOC 1 Type II report rather than customer-performed testing. The customer's ITGC scope narrows to what the customer actually controls: user access provisioning and deprovisioning within Fusion's security console, configuration changes to customer-owned setup (approval hierarchies, flexfields, tax rules, security roles), and monitoring of the Application Audit Trail for those objects. IT audit software for a Fusion-only environment is largely testing customer-side access and configuration-change controls, with Oracle's SOC 1 report substituting for infrastructure-level ITGC testing the customer would otherwise have to perform itself.

E-Business Suite, run on customer-managed or customer-controlled infrastructure (on-premises or IaaS-hosted), keeps essentially the full ITGC scope with the customer: database access, patch management, backup and recovery, job scheduling, and change promotion between environments, in addition to the same application-level access and configuration controls Fusion also requires. IT audit software for an EBS environment has to cover this wider infrastructure surface, typically pulling from database access logs, DBA activity logs, and the patch/migration tracking system rather than relying on a vendor SOC report to cover any of it.

Across both Fusion and EBS, the single most common ITGC deficiency in practice is deprovisioning — access removed late or not at all when an employee changes roles or leaves. Oracle's role-based access model (job role/duty role/data role in Fusion, responsibility-based in EBS) makes provisioning relatively easy to test because it is a discrete, logged event tied to a request. Deprovisioning is harder because it depends on an HR trigger reaching IT reliably, and Oracle's own tools do not enforce that a termination in HR actually results in account deactivation in the ERP unless that integration has been explicitly built and tested.

IT audit software that tests this control well pulls a population of terminations or role changes from HR data, matches it against the Fusion or EBS access-removal timestamp, and flags any gap beyond the organization's defined SLA — typically a small number of business days. Testing that instead samples only active users and checks whether their current access looks reasonable misses this failure mode entirely, because it never examines whether access was removed on time for people who no longer need it.