* Access Control Manager - This duty role typically includes permissions for system configuration duties, which are not intended for the "Application Access Auditor" role. Removing this duty ensures
* the user cannot perform system configurations.
* Advanced Control System Administrator - This duty role also encompasses system configuration responsibilities and administrative privileges over the Advanced Controls setup. Removing this duty prevents the user from having system-wide configuration access, aligning with the client's requirement for a role focused solely on monitoring.
References:
* The information is based on the Oracle Risk Management documentation, which outlines the responsibilities associated with various duty roles within the Advanced Access Controls framework1.
* Additional details regarding the segregation of duties and the configuration of job roles can be found in the Oracle Advanced Access Controls Cloud Data Sheet2.
* For a comprehensive understanding of the duty roles and their functions, refer to the Overview of Oracle Advanced Controls3.

* In Oracle Risk Management Cloud, risks need to be in an "approved" state before you can associate controls with them. This ensures that only vetted and acknowledged risks are managed with corresponding controls.
* While the Data Migration tool is typically used for importing data from external sources, it is not designed for mapping controls to risks. Instead, controls are usually added manually within the system.
* After controls are defined, they can be related to the approved risks manually, ensuring that each risk is paired with appropriate control measures.

For importing Risk-Control data into Oracle Risk Management, the .xml format should be used. This is because:
* The .xml format is structured and allows for the definition of custom tags, making it suitable for complex data interchange.
* Oracle documentation specifies that when finishing entering data into the import template, it should be saved in the .xml file format1.
References:The information is based on Oracle's official documentation regarding the import template data requirements, which outlines the necessary steps and preferred formats for data import into the Risk Management system1.

When an assessor is reviewing Prior Results as part of an operational assessment for a control, such as manual AP Invoice entry, they are able to view the results of prior operational assessments specifically for that control.
This is because the system is designed to allow assessors to focus on the historical performance and evaluation of the control in question, providing a targeted and relevant overview of its effectiveness and any issues that have been identified in the past.
References:The information provided is based on the Oracle Risk Management documentation, which outlines the processes and capabilities of the system regarding operational assessments and the review of Prior Results1.

* Choose display (or hide) configurable options: This allows users to manage the visibility of configurable options such as results, events, consequences, and treatments within the module.
* Set "object-perspective" association: Users can associate objects with specific perspectives, which helps in organizing and viewing data according to different business dimensions.
* Edit the assessment activity question and guidance text: This step involves customizing the questions and guidance text for various assessment activities to align with the organization's specific requirements.
References:The information provided is based on the Oracle Risk Management documentation and resources, ensuring accuracy and adherence to the official guidelines12.
Please note that while 'Create object data import templates' and 'View assessment response details for all assessment types' are valid actions within Oracle Risk Management, they are not listed as steps that can be performed on the Configure Module Objects pages according to the provided documentation.