For the purpose of the discussion, let me define the sales process as a sequence of all those events a sales person or the sales management would be interested in. Any company that intends to use the sales module probably has a direct, indirect or a dealer sales channel to sell their products to customers. The sales person by some mechanism gets a lot of leads telling him that all these could be potential customers. He/She pursues some of these leads, and finds that a few of these customers are actually considering buying a product or service that his organization offers. In Oracle 11i we call that Opportunity. The sales person converts the lead into an opportunity and rates the likelihood of it closing. All the opportunities a sales person is working on appear on his forecast. A sales manager can see the total forecasted sales of all his sub ordinates and in a similar fashion the sales vice president can see the rolled up forecast of all the sales managers.
To address this opportunity, the sales person submits a quote. There will probably be a negotiation process and the sales person might have to take approval to give the customer a special price on the quote, and assuming a successful outcome the quote will be converted into an order. Well the sales person's interest might not end there. The order needs to be shipped, invoiced and the sales person commission needs to be paid. So the sales person/sales management are probably interested until the order gets shipped or invoiced (based on which event triggers the commission payout), commission gets calculated and the commission information is sent to the Payroll or Accounts Payable depending on whether the sales person is an employee or a dealer.
Let us look at the first part of the sales process which in Oracle jargon is called the Lead to Opportunity. Assuming that the sales person gets a set of leads, probably imported by an automated means or manually entered by the sales person himself. He will have to enter the organization (person) details, the product details and qualify the lead. He finds out that the customer is interested in buying one of the products in the second quarter of this year. He contacts the customer reviews the opportunity and when he is certain that it is truly an opportunity he creates one within oracle.
He will then assess the situation, provide a solution, provide marketing collateral etc, and when the customer seems to be really interested he gives the customer a quote. And if the customer agrees to the quote he converts it into an order, or else there might be a negotiation involved which will lead to modifying the quote. Modifying the prices on the quote might have to be approved by some one with the appropriate level of authority, and if the quote gets approved it is resubmitted to the client, and the client either accepts the quote and places the order, or goes with a competitor. The sales person will then log the order by converting the approved quote (so there is no need for a second approval, provided the quote is still valid) into an order or if he lost the order he will provide reasons why the opportunity failed to convert into an order. The lead to opportunity process can happen in a Call center environment or in a field sales situation. Depending on the environment the customer might go in for Tele-Sales or Sales Online or both of these modules
Apart from not meeting the business/strategic objectives the issue of fraud and the possibility that issue of data integrity is a concern for auditors. Security auditors usually look at the business processes and of course the access controls. So in this article I will try to put in perspective what would be a security auditor’s concern regarding Incentive Compensation. We will look more at the process aspect of security in this article and look at the technology portion (audit trails and how audit works within Oracle 11i) in greater detail in a later article. Flaws in the process can be as dangerous as security holes n the operating system or software. Internal controls and security are especially essential when the module deals with payments. Setting up audit trails and having a robust process that prevents unauthorized changes to the production data is as important as plugging security holes and applying patches.
In the case of Incentive Compensation, though the commission payments are not directly paid from the Incentive compensation, but flow through to AP or Payroll, the actual amounts to be paid are calculated within Incentive compensation.
How do we ensure security or to be more specific the commission calculation setup is unchanged, and whether the integrity of the data regarding commission has been compromised? These are valid concerns and to address these one needs to look at both the process and the access controls within Oracle.
We will look at these two areas wearing the glasses of an IS auditor
Note: Factors that affect the commission amount are all the elements that are used in calculation: rate tables, expressions, plan elements, formulas and revenue classes.
Process part of security
Change management process is robust. Changes made to the system, such as changes to the rate tables, expressions, plan elements, formulas etc, are first tested in the development instance and signed off. Only then should the changes be migrated to the Production instance.
Manual commission override and split should go through an approval process. This is a usual occurrence in some organizations when the sales manager would prefer to split the commission to two sales reps even though the account belongs to one territory, or in some cases the sales manager may opt to give commission to a different sales person than the one who is listed on the account.
Technical part of security
Responsibilities and menus have been modified so that setup related options are not accessible to users. Setup responsibility should preferably be given to only one individual (or at least one for each ORG).
If necessary auditing can also be setup to monitor certain accounts, ones that have the setup responsibilities. Audit trails should be enabled for certain tables holding the setup related information.
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.