The EPM Cloud Audit Report is Oracle EPM Cloud’s native activity logging capability — capturing and retaining a structured record of significant system events: user logins and logouts, data modifications (who changed a value in a planning form, in which cell, at what time, from what prior value to what new value), business rule executions (which rule ran, who triggered it, when, and whether it completed successfully), security changes (user provisioning, role assignments, security filter modifications), and administrative operations (data imports, exports, application snapshot actions, metadata changes). The audit report is accessed through the EPM Cloud System Settings and Oracle EPM Cloud Activity Reports, and can be exported to flat files for external analysis or long-term retention. For GCC enterprises where IT general controls audits require evidence of who accessed financial planning data and who made changes during the period-end close, the EPM Cloud Audit Report is the primary data source for the IT audit response.
EPM Cloud Audit Report Coverage by Application
| EPM Application | Audit Events Captured |
|---|---|
| Oracle PBCS / EPBCS | Data cell changes (account, entity, period, scenario, prior value, new value, user, timestamp); business rule execution log; user login/logout; form access; security changes |
| Oracle FCCS | Journal posting (user, journal ID, affected accounts, amount, timestamp); consolidation run log; period lock/unlock; workflow status changes; user access events |
| Oracle ARCS | Reconciliation status changes; preparer submission; reviewer approval/rejection; transaction match/unmatch events |
| Oracle Narrative Reporting | Report package creation/modification; workflow status changes; sign-off events; document access |
Data Change Audit in Oracle PBCS/EPBCS
Oracle PBCS/EPBCS’s data change audit is the most operationally significant audit capability for the close cycle and the budget process. When a user modifies a value in a planning form, the EPM application records the prior value and the new value alongside the user’s identity, the exact cell coordinates (account, entity, period, scenario, version, and any other dimension members), and the modification timestamp. This audit trail enables investigation of close cycle data anomalies — if a planning value changed unexpectedly between the draft board pack and the final pack, the audit report can identify who changed it, when, and from what to what. The audit trail is retained for a period defined by Oracle’s platform retention policy; clients who require longer retention must export the audit data to an external store before Oracle’s retention period expires.
EPM Cloud Audit Report and GCC Regulatory Compliance
The EPM Cloud Audit Report satisfies several GCC enterprise IT general controls requirements. For SAMA-regulated Saudi financial institutions, the IT general controls framework requires evidence that access to financial systems is logged and that privileged access is monitored — the EPM Cloud security change audit (recording user provisioning and role assignment changes) provides this evidence. For CMA-listed companies in Saudi Arabia and ADX/DFM-listed companies in UAE, the audit committee’s oversight of the financial reporting process is supported by the EPM Cloud data change audit — demonstrating that the numbers in the consolidated financial statements are traceable to specific user inputs with identifiable authors and timestamps.
What Goes Wrong in Practice
The most common EPM Cloud Audit Report operational failure is the absence of a regular export process — allowing Oracle’s platform retention period to pass without the audit data being extracted and stored externally. When an IT general controls audit requires audit evidence for a period that predates the EPM platform’s retention window, the audit data is no longer available from Oracle’s system, and the audit evidence request cannot be fulfilled. EPM Cloud audit data should be exported monthly to an external, governed repository with a retention period aligned to the organisation’s regulatory requirements — which in Saudi Arabia is 10 years for financial records.
How Loop Wise Solutions Implements EPM Audit
We configure EPM Cloud audit export automation — scheduled EPM Automate jobs that export the monthly audit activity log to a designated external storage location — as a standard component of every Oracle EPM Cloud managed service engagement. The export schedule, the storage location, and the retention policy are documented in the IT general controls evidence register maintained for each client.
