- Get correct Oracle user listings
	- New Users (all users and responsibilities with an effective/start date during the year)
	- Term Users (all users and responsibilities with an end/disable date during the year - compared to HR term employee/contract listing - compared to prior year user listing)
	- System Administrator users

Things we didn't do last year: 
	- CNC
		- Details of who, what, and how was extremely loose in CNC for each process.
		- No completeness and accuracy explanations for review contorls in describe process
		- No explanation of why common process for IT environment  
		- There was minimal information/explanation in WT of ones
		- No explanation of tools used in processes
		- No explanation of whether priv users follow common process in MA
		- No description/table of who reviews in UAR and how
		- No true evidence of change implementers (e.g. sudoers) obtain/documented
		- No evidence of automated workflows and who can modify
		- No evidence of automated reports (script, scheduled job, and who can modify)
		- No evidence/documentation of versions or patches
		- No explanation of the process for follow-ups/problems identified in review controls
		- No testing of 'su' logs 
		- No UAR testing template
	- BaaN