1.2 Enterprise and Financial Reporting Structures & the Data Security Model
Key Takeaways
A primary ledger is defined by its chart of accounts, accounting calendar, ledger currency and subledger accounting method.
A business unit only processes Payables and Expenses transactions when it has the Payables Invoicing, Payables Payment or Expense Management business function it needs.
A payment business unit can process payments for the invoice business units it services through a service provider relationship (centralized payment processing).
Payables grants data access by business unit through Manage Data Access for Users, while General Ledger users are secured by data access sets.
A job role such as Accounts Payable Specialist gives page access, but the user sees no invoices until a Business Unit security context is assigned for that role.
Every hands-on question about invoices, payments or expenses happens inside an enterprise structure. If you can't tell which business unit owns an invoice, which ledger it accounts to and which legal entity owns the bank account, you won't be able to predict defaults, approvals or accounting. This section covers the first two objectives of the common-configurations area: enterprise and financial reporting structure components, and the data security model.
Enterprise structure components
| Component | What it represents | Why it matters for Payables and Expenses |
|---|---|---|
| Enterprise | The top-level organization for the deployment | Holds global setups shared by all entities |
| Legal entity | A registered body that can own assets, sign contracts and incur liabilities | Owns internal bank accounts, is the first party for tax, and is recorded on invoices and payments |
| Legal reporting unit | The lowest level at which statutory reporting happens | Carries tax registrations used by Oracle Fusion Tax |
| Ledger | The accounting book: chart of accounts, calendar, currency, accounting method | All Payables and Expenses accounting lands in a primary ledger, and optionally in secondary ledgers or reporting currencies |
| Business unit (BU) | The unit that performs business functions and owns transactions | Invoices, payments, expense reports and most setups (invoice options, payment options) are business-unit specific |
| Department / cost center | An organization usually represented by a cost center segment value | Feeds default expense accounts for employees and cost center owner approvals |
The ledger and its four defining attributes
A primary ledger is defined by four things, sometimes called the "4 Cs":
- Chart of accounts: the accounting key flexfield and its segments.
- Accounting calendar: the periods.
- Ledger currency.
- Accounting convention: the subledger accounting method, such as Standard Accrual.
A secondary ledger can differ in any of these four. A reporting currency changes only the currency. Section 5.3 explains how one Payables event produces journals for both a primary and a secondary ledger.
Financial reporting structure components
The financial reporting structure is the set of objects that shape how accounting appears in reports:
- Chart of accounts segments and segment labels. The primary balancing segment identifies the company or fund. Other labels are the cost center, natural account and intercompany segments.
- Value sets and values. Natural account values carry an account type and an optional financial category. Payables reconciliation depends on the financial category: Oracle requires you to assign the Accounts Payable financial category to every liability natural account value you want on the Payables to Ledger Reconciliation report (section 8.2).
- Account hierarchies (trees) used for reporting roll-ups and for some approval and security rules.
- Cross-validation rules, which stop invalid account combinations. When a derived account breaks a rule, Payables raises an account hold or an accounting error.
Business functions and service provider relationships
A business unit only performs the work its business functions allow. For this exam, three functions matter most:
- Payables Invoicing: enter, match, validate and approve supplier invoices.
- Payables Payment: pay installments and own payment processing.
- Expense Management: process employee expense reports.
Business units can also act as service providers:
- A Procurement BU can serve one or more requisitioning business units.
- In Payables, a payment business unit can service several invoice business units. This is centralized payment processing.
When you submit a payment process request (PPR) for a payment business unit, the selection finds installments for every invoice BU that the payment BU services. Two other places this matters: if you implement centralized payment processing, you reconcile Payables to the general ledger by ledger rather than by business unit; and payment templates list only the invoice groups you can reach through those relationships.
The data security model
Oracle Fusion security has two layers. Exam scenarios often test the gap between them.
Layer 1: function security (what you can do)
Job roles such as Accounts Payable Specialist, Accounts Payable Supervisor, Accounts Payable Manager, Cash Manager, Expense Manager and Financial Application Administrator inherit duty roles. Duty roles in turn carry privileges. Oracle's Payables documentation names several privileges you should recognize:
| Privilege | What it allows |
|---|---|
Create Payables Invoice (AP_CREATE_PAYABLES_INVOICE_PRIV) | Create invoices and complete incomplete scanned invoices |
Edit Payables Invoice (AP_EDIT_PAYABLES_INVOICE_PRIV) | Update invoices, including those in the imaging repository |
Force Approve Payables Invoice (AP_FORCE_APPROVE_PAYABLES_INVOICE_PRIV) | Use the Force Approve action when invoice options allow it |
View Scanned Payables Invoice (AP_VIEW_SCANNED_PAYABLES_INVOICES_PRIV_OBI) | Receive routed incomplete scanned invoices |
Manage Bank Account Security (CE_MANAGE_BANK_ACCOUNT_SECURITY_PRIV) | Change the user-and-role security on internal bank accounts |
You manage roles in the Security Console. If a custom role is missing a privilege, the user sees odd behavior. Oracle's example: an approver who clicks View Invoice in a notification gets a blank page if the role lacks View Payables Invoice, Manage Payables Invoices and Manage Payables Invoices Activities.
Layer 2: data security (which records you can see)
A role alone doesn't expose any transactions. Payables limits access to invoices and payments by business unit, and the permission must be granted explicitly to each user. You do this on Manage Data Access for Users with four values:
- User name
- Role (for example, Accounts Payable Specialist)
- Security context, such as Business Unit
- Security context value, such as US1 Business Unit
Other modules secure data differently:
- General Ledger users are secured by data access sets, which are built on ledgers or primary balancing segment values.
- Cash Management can optionally secure bank account setup by legal entity, using the Legal Entity-Based Data Access for Bank Account Setup feature.
- Internal bank accounts have their own business unit access and user-and-role security (section 2.3).
The reconciliation report shows the difference clearly. GL users see GL data for the balancing segment values in their data access set, plus Payables and SLA data for all business units linked to the ledger. Payables users see Payables and SLA data for their business units, plus GL data for the whole ledger.
A new accounts payable clerk has the Accounts Payable Specialist job role. The clerk can open the Invoices work area but can't find any invoices or choose a business unit when creating one. What must the security administrator do?
Open the accounting period for the clerk's ledger so invoice data becomes visible
Add the clerk to a General Ledger data access set for the ledger's primary balancing segment
Give the role a Business Unit security context and value in Manage Data Access for Users
Grant the Force Approve Payables Invoice privilege so the clerk can see unapproved invoices
An implementer runs Prepare Payables to General Ledger Reconciliation and the process fails. No natural account values in the chart of accounts carry a particular financial reporting structure attribute. Which attribute is missing?
The Third-Party Control Account attribute on the natural account values
The Accounts Payable financial category on the liability natural account values
The Intercompany segment label on the chart of accounts structure
A cross-validation rule that links liability accounts to the balancing segment
A company wants one shared-services business unit to run payment process requests for invoices entered in five regional business units. Which enterprise structure setup makes this possible?
Assign all six business units to the same reference data set for Payables Payment Terms
Give the shared-services business unit the Payables Invoicing business function only
Create one ledger per regional business unit and enable automatic offsets in Common Options
Make it the Payables Payment service provider for the five invoice business units
Sections you finish are checked off in the contents.