1Z0-1058-26 Practice Questions

Perspectives are a fundamental concept in Oracle Risk Management and Compliance used for organizing and securing objects. Their primary purpose is to categorize objects like risks and controls into user-defined, hierarchical structures (B). These hierarchies often represent organizational structures, such as business units or regional breakdowns (C), but can also represent processes or other logical groupings. A key function of perspectives is to enable data security; data security policies are defined against these perspective hierarchies to control which users can view or edit specific sets of GRC objects (D).

A. User privileges are primarily defined by roles. Perspectives are used to scope data access for those privileges, not define the privileges themselves.

E. Functional security, which controls access to application functions, pages, and actions (e.g., the ability to create a control), is managed by job roles, not perspectives.

Oracle Fusion Applications Help, "Using Risk Management and Compliance", Chapter: Introduction to Financial Reporting Compliance, Section: Perspectives. This section explicitly states, "Perspectives are hierarchies of values you can use to categorize objects and to secure access to them."

Oracle Fusion Applications Help, "Implementing Risk Management and Compliance", Chapter: Set Up Financial Reporting Compliance, Section: Manage Module Perspectives. The documentation describes creating perspective hierarchies for categorization and subsequent use in data security policies.

The issue workflow in Oracle Risk Management Cloud proceeds through various states. When an issue is in the "In Remediation" state, the control manager works on a remediation plan. Upon submission, the issue enters an approval workflow. If no validator, reviewer, or approver roles are configured for this workflow in BPM Worklist, the system automatically approves the submission. Consequently, the issue's state transitions directly to "Approved," signifying the completion of the remediation and approval cycle.

A. In Review: This state is used only when a reviewer is configured in the workflow. Since none are configured, this step is skipped.

B. Active: This is a general status for an object that is in use, not a specific state in the issue management workflow process.

C. Reported: This is an initial state that occurs before an issue is accepted and moved into remediation. The workflow does not move backward to this state.

E. In Edit: This is not a formal workflow state but describes an action where a user is actively modifying the issue details before submission.

Oracle Fusion Cloud Risk Management and Financial Reporting Compliance, 24B, "Monitor Issues and Remediations": Chapter 6, Section "Issue Remediation". The documentation describes the lifecycle, and standard BPM workflow behavior dictates that a task with no assignees is automatically completed/approved.

Oracle Fusion Cloud Applications, Using Common Features, 24B, "Using Approval Management": Chapter 10, Section "Approval Task". This guide explains that if an approval stage has no participants, the process advances to the next stage, effectively auto-approving the current one.

Implementing an access control to monitor for a separation-of-duties (SoD) violation involves a multi-step process. First, the specific user access points (privileges) that create the conflict must be defined within separate entitlements. Second, an access model must be created to define the toxic combination by including these entitlements. Finally, a control must be created and deployed, using the newly created model as its basis. This control will then run to identify users who have access to both conflicting entitlements. Option D correctly outlines this complete, required sequence of steps.

A. This option is incomplete. It correctly describes creating entitlements and a model but omits the final, essential step of creating and deploying the control that uses the model.

B. This option is incorrect because it skips the prerequisite steps of defining entitlements and the access model, which are necessary to define the logic the control will enforce.

C. This option is incomplete and uses imprecise terminology. While a model is needed, the process starts with entitlements, and the final step of deploying a control is missing.

E. This option incorrectly attempts to create a control directly from an entitlement, skipping the crucial access model step where the SoD conflict logic is defined.

1. Oracle Fusion Cloud Risk Management and Compliance, Implementing Risk Management Cloud, Release 24B, F91422-03, Chapter 5: Advanced Access Controls, Section: "Create an Access Model," Page 5-10. (Describes creating models from entitlements).

2. Oracle Fusion Cloud Risk Management and Compliance, Implementing Risk Management Cloud, Release 24B, F91422-03, Chapter 5: Advanced Access Controls, Section: "Create a Control," Page 5-14. (Describes creating a control and selecting a model).

3. Oracle Fusion Cloud Risk Management and Compliance, Using Risk Management, Release 24B, F91423-03, Chapter 4: Advanced Access Controls, Section: "Access Models," Page 4-5. (Explains that models "define sets of entitlements that present conflicts of interest").

When an assessor performs an assessment in Financial Reporting Compliance, the "Prior Results" tab provides historical context for the specific control being evaluated. This view is designed to show the outcomes of the most relevant past evaluations to inform the current assessment. It specifically includes the results of previous operational assessments (typically performed by business process owners) and audit tests (typically performed by internal audit). This allows the assessor to understand the control's performance history and any previously identified issues from both a management and audit perspective.

A. This is too broad. While it may show other types, the primary and most relevant results displayed are operational assessments and audit tests.

C. This is too restrictive. Results from audit tests are highly relevant to an operational assessor and are included in the view.

D. The view is scoped only to the specific control being assessed, not all controls.

E. This is incorrect because the view is limited to the single control under assessment, not all controls.

1. Oracle Fusion Cloud Risk Management and Compliance, Using Risk Management and Compliance, 23D, Chapter 5: Conduct Assessments, Section: Complete an Assessment. The documentation describes the user interface for assessments, noting that the Prior Results tab displays past results for the control, including previous operational assessments and audit tests.

The Inclusive Function filter keeps only those groups that contain ALL of the specified values. To find reports that simultaneously include Taxi, Car Rental, and Mileage lines, group the data by Expense-Report “Report Number” (one group per report) and apply an Inclusive filter on the “Expense Type” attribute with an “IN (Taxi, Car, Mileage)” condition. Any report returned by the filter necessarily contains the suspicious combination.

A – Using “Equals” would look for a single row where Expense Type equals all three values—impossible.

B – Duplicate of D; one option retained.

C – Grouping by Person mixes multiple reports; may flag employees who happened to submit the three types on different reports.

E – Same grouping problem as C.

1. Oracle Risk Management Cloud User Guide 24A, “Use of Inclusive and Exclusive Function Filters”, example 2 (Expense types), paragraphs 1-3.

2. Oracle Risk Management Cloud Tutorial: “Detect Expense-Type Combinations with Inclusive Function” (Oracle Learning Library Video RM-2204).

In Oracle Advanced Access Controls, the standard methodology for implementing Segregation of Duties (SoD) involves creating a single, comprehensive access model for each business process. This model groups all related entitlements that need to be analyzed for conflicts. For the procure-to-pay process described, the entitlements "Create Supplier," "Create Invoice," and "Create Payment" should be consolidated into one model. This model then serves as the foundation upon which specific access controls (the rules defining the conflicts) are built. This approach ensures an efficient and holistic analysis of access risks within the business process.

A. This option describes how individual entitlements are defined using filters, not the overarching structure of models and controls needed to meet the SoD requirements.

B. Creating multiple models for a single business process is inefficient and contrary to best practices. A single model should contain all related entitlements for streamlined analysis.

C. The requirements explicitly state two SoD conflicts, not three. This option incorrectly assumes a third conflict ("Create Supplier & Create Payment") is required.

E. An entitlement represents a single, granular privilege. It is fundamentally incorrect to combine three distinct functions into one entitlement.

1. Oracle Fusion Cloud Financials, Implementing Risk Management and Compliance, Release 24B, Chapter: Advanced Access Controls, Section: Access Models.

Reference: "An access model is a set of entitlements selected for analysis of access risk. Typically, the entitlements in a model are related to a specific business process. For example, a Procure to Pay model might include entitlements that authorize a user to create suppliers, enter invoices, and make payments." This supports creating a single model for the related functions.

2. Oracle Fusion Cloud Financials, Implementing Risk Management and Compliance, Release 24B, Chapter: Advanced Access Controls, Section: Access Controls.

Reference: "A control identifies entitlements whose pairing in a single user's access privileges may constitute a risk. Each control is associated with a model, and is defined by entitlements selected from that model." This confirms that specific conflict rules (controls) are built upon the foundation of a single, comprehensive model.

A Control Owner can initiate assessments for specific controls using two primary methods: impromptu assessments or planned assessments. Impromptu assessments are designed for ad-hoc, unscheduled evaluations of individual controls directly from the control's detail page. Alternatively, the Control Owner can create a planned assessment, which offers a more structured approach. When creating a planned assessment, the scope can be precisely defined to include only the two specific controls required by the auditor, either within a single assessment plan or by creating a separate plan for each control. All three of these options are valid actions the Control Owner can perform to fulfill the auditor's request.

A. This option is incorrect because initiating an assessment for all P2P controls does not meet the specific requirement to assess only the two designated controls.

C. This is an incorrect option because enabling impromptu assessments is a one-time setup and configuration task, typically performed by an Application Implementation Consultant or Administrator, not a routine action performed by a Control Owner to "kick-off" an assessment.

1. Oracle Fusion Cloud Risk Management, Using Risk Management (Release 24A), Chapter 5: Assessments, Section: Impromptu Assessments.

This section states, "You can launch an impromptu assessment of a specific object... from its detail page." This confirms that performing an impromptu assessment (Option B) is a direct action available to a user like a Control Owner for a specific control.

2. Oracle Fusion Cloud Risk Management, Using Risk Management (Release 24A), Chapter 5: Assessments, Section: Create a Plan for a Planned Assessment.

The documentation details the process of creating a planned assessment. In the "Define Scope" step, it specifies that a user can "Select specific objects to be included in the assessment." This supports creating a single planned assessment for the two controls (Option D) or two separate assessments (Option E).

3. Oracle Fusion Cloud Risk Management, Implementing Risk Management (Release 24A), Chapter 3: Set Up Financial Reporting Compliance, Section: Task: Manage Financial Reporting Compliance Objects.

This implementation guide describes the setup for objects, including a checkbox to "Enable impromptu assessment." This task is performed in the Setup and Maintenance work area, confirming it is an administrative configuration (making Option C incorrect as an action for a Control Owner).

The approval workflow in Oracle Risk Management is triggered by the assignment of specific duty roles, namely the Risk Reviewer and Risk Approver roles. If no users are assigned to job roles that contain these duty roles, the system has no one to route the approval task to. Consequently, the workflow is bypassed, and the risk is automatically set to an active or approved status upon creation or modification. This is the standard mechanism for disabling the formal review and approval process for an object.

A. Assigning the reviewer role to the creator does not bypass the workflow; it simply makes the creator the reviewer, which may not be allowed depending on setup.

B. Using only the approver role would still initiate a workflow, sending the risk directly for approval rather than bypassing the process entirely.

C. Restricting the reviewer role to upper management limits who can review but does not eliminate the review step itself from the workflow.

1. Oracle Fusion Cloud Risk Management and Compliance, Implementing Risk Management, 23D, Chapter 4: Financial Reporting Compliance, Section: "Manage Objects". The documentation on object workflows explains that workflows are contingent on role assignments. If approver/reviewer roles are not provisioned, the workflow does not initiate.

2. Oracle Fusion Cloud Applications, Securing ERP, 23D, Chapter: Role and User Management, Section: "Security Reference for Financials". This guide details the privileges associated with duty roles like Risk Reviewer, implying their necessity for the review process.

When creating an impromptu assessment in Oracle Risk Management Cloud, the system requires three key pieces of information to define the assessment object itself. The user must provide a unique "Name" for the assessment, select a "Template" which defines the assessment's structure and questions, and specify a "Due Date" by which the assessment must be completed. These fields are mandatory on the creation page to ensure the assessment is properly defined, structured, and scheduled from the outset.

D: A Reviewer is typically assigned after the initial creation or as part of the workflow, and is not always a mandatory field on the creation screen itself.

E: Perspectives are used for categorization and reporting. They are powerful for analysis but are not required fields for the initial creation of an assessment.

F: "Activity" is a generic term and not a standard, required field for creating an impromptu assessment in Oracle Risk Management Cloud.

Oracle Fusion Cloud Risk Management, Using Risk Management and Compliance, 24B, Chapter 5: Assessments, Section: Create an Impromptu Assessment. (This guide details the steps and required fields for creating an assessment).

In Oracle Financial Reporting Compliance, risk assessments are structured around specific activity types that define the purpose of the assessment. The available activity types include "Assess Risk," which is used to evaluate the likelihood and impact of risks associated with a process. "Design Review" is an activity to evaluate the design effectiveness of controls. "Certify" is an activity used for formal attestations, such as those required by Sarbanes-Oxley (SOX) section 302, where individuals certify the accuracy of financial information or the effectiveness of internal controls. These three are distinct, selectable activity types when creating an assessment.

B. Qualitative Analysis: This is a method used within the "Assess Risk" activity to evaluate risk, not a distinct, selectable activity type itself.

C. Quantitative Analysis: Similar to qualitative analysis, this is a technique for evaluating risk during an "Assess Risk" activity, not a separate activity type.

E. Audit: While assessments are part of an audit process, "Audit" is not a specific risk assessment activity type within the Financial Reporting Compliance module itself.

1. Oracle Fusion Cloud Risk Management and Compliance, Using Financial Reporting Compliance, Release 24B, Chapter 4: Assessments, Section: Create an Assessment.

This section details the process of creating an assessment and explicitly lists the available activities. It states, "In a Activity field, select the type of work to be performed. Your selection may be Assess Risk, Certify, Design Review, or Test of Effectiveness." This directly confirms that Assess Risk, Certify, and Design Review are valid activity types.

2. Oracle Fusion Cloud Risk Management and Compliance, Implementing Financial Reporting Compliance, Release 24B, Chapter 4: Set Up Assessments, Section: Assessment Activities.

This implementation guide describes the predefined assessment activities. It notes: "Financial Reporting Compliance provides the following predefined assessment activities: Assess Risk, Certify, Design Review, and Test of Effectiveness." This corroborates that options A, D, and F are correct predefined types.