Topics Map > HRS Security > Security

HRS Access Guide - Security

This document provides an overview of the HRS Access Guide - a series of KB documents providing guidance about HRS access for UW-Madison users, including requesting access, finding training, and fulfilling security requirements.

This document discusses security processes involved with HRS, EPM, and UWBI access, including separation of duties (SOD) and annual attestation exercises.

Separation of Duties (SOD)

SOD Conflicts

When setting up HRS access, you must maintain separation of duties (often referred to as "SOD") to the fullest extent possible. There are three main scenarios to avoid in users' HRS access to maintain separation of duties:

  • HR1 - user's access would allow them to:
    • hire, update, or terminate employees and
    • create, edit, or approve timesheets
  • HR2 - user's access would allow them to:
    • hire, update, or terminate employees and
    • create or update direct deposit information
  • PY1 - user's access would allow them to:
    • hire, update, or terminate employees or approve timesheets and
    • create online checks or print or distribute paper checks

Sometimes conflicts are unavoidable based on a work unit's administrative structure. The goal is to minimize conflicts as much as possible so that users can't create SOD errors.

SOD Errors

When a user enters a combination of HRS transactions that match the SOD scenarios above, it creates an SOD error. If it is unavoidable for a user to have access that creates an SOD conflict, the work unit must review its business processes to make sure that users will not create SOD errors. For example, if a user has access to update job data and also supervises another employee, the work unit's business processes must include having someone else update job data or approve timesheets for the employee so that the user doesn't do both and create an SOD error. At least one person for each division has access to view reports of SOD errors in the HRS Workflow Exception Dashboard (WED). Divisions are responsible for checking the WED SOD reports at least once per week and investigating and resolving their SOD errors. If an error remains on a report for 14 days, OHR HRIS will email the division SOD reviewers to make sure the error is investigated and resolved as soon as possible.

SOD Error Resources

Annual Attestation

Once per year, each UW business unit completes a comprehensive review of its users' HRS and EPM access to remove inappropriate access and attest that the remaining access is appropriate. The OHR HRIS team will distribute reports of UW-Madison users' access to division approvers with a specific deadline to review and return.




Keywords:oracle, peoplesoft, human resource system, epm, uwbi, obiee   Doc ID:119673
Owner:Colin S.Group:HR Communities of Practice
Created:2022-07-14 09:39 CSTUpdated:2022-08-10 10:04 CST
Sites:HR Communities of Practice
Feedback:  0   0