Ensure BPM Approval Rule and Workflow Configuration Changes Are Audited

高级别 2人工审核oracle-saas

说明

Enable and monitor auditing for changes to BPM (Business Process Management) approval rules and SOA workflow configurations within Oracle Fusion Applications. These rules determine the routing and approval hierarchy for critical business transactions (e.g., expense approvals, journal entries, purchase orders, HR ... Approval rules define key authorization paths that enforce financial and operational controls. Unauthorized or untracked changes can enable fraudulent approvals, insider threats, or policy violations. Reported as a manual review item: these Fusion/EPM/OCI IAM settings are reviewed in the Oracle SaaS and OCI consoles or reports.

检查方式

审计方法: 人工审核

此项建议无法自动检查。当您传入 --include-manual 时，扫描结果会列出该项并附带这些说明。

1. Access Setup and Maintenance → Manage Audit Policies → Audit Configuration. 2. Confirm that Audit for SOA/BPM Changes is Enabled (refer to Doc ID 2053746.1). Review Fusion Applications SOA Audit (Doc ID 2053746.1) 3. Verify that audit data is available through Audit Report / REST API. 4. Check for regular export or forwarding of BPM audit logs to the central logging system (OCI Logging / SIEM) for retention and correlation. 5. Review samples of recent approval rule modifications and confirm they match authorized change requests.

修复方式

修复方法: 操作指南或基础设施补丁

1. Enable auditing for SOA/BPM components in Fusion's audit configuration as per Doc ID 2053746.1. 2. Ensure all BPM rule changes are routed through change management or governance workflow. 3. Configure scheduled extraction of BPM audit logs for integration with centralized audit monitoring (OCI Logging, SIEM, or Analytics). 4. Implement periodic review (monthly/quarterly) of approval rule changes by business process owners and security administrators. 5. Set up alerts or dashboards for critical workflow-change events.

属性

操作系统: 任意
标签: oracle-saaslogging
参考: CIS Oracle SaaS Cloud Applications Benchmark v1.0.0 - 3.4 Ensure BPM Approval Rule and Workflow Configuration Changes Are Audited