Submitting and managing requests
Who can request access for someone?
Only RSAs can submit access requests. RSAs submit requests on the OFC Access Request form. Find your department's RSA on the RSA list.
Can an RSA request access for themselves?
Yes. When an RSA submits an OFC Access Request for themselves, ServiceNow automatically sends an approval email to their supervisor. The supervisor can also approve the request directly from the record in ServiceNow. Once the supervisor approves, Security & Controls picks up the request for review. Requests submitted for another person follow the usual process.
If you plan to request access for yourself, a quick heads up to your supervisor beforehand will help the approval go smoothly and keep your request moving.
Why is my request on hold?
Usually one of three reasons: required training was not found, there is a separation of duties conflict between requested roles, or the request needs an additional approval. You will get a note on the ticket explaining which. We allow up to 3 business days for a reply before the request is closed.
How do I remove access?
Submit the request through the same OFC Access Request form and choose removal. Removals do not need training verification.
Roles, security context and conflicts
What is a separation of duties (SoD) conflict?
Some role combinations cannot be held by one person because they would let one person complete conflicting steps in the same process. This applies across OFC, Jaggaer, Concur and TOE, and conflicts are checked at the role level. If we find one, we ask on the ticket which role the person should keep. Jaggaer role combinations are documented in the Gateway Roles Matrix (Google Sheet, opens in a new tab).
What does "JR" mean in a role name?
JR stands for Job Role. It is the naming convention OFC uses for its custom roles, for example UCSB Jaggaer Receiver JR.
What is a security context?
A role controls what a person can do. A security context controls what data they can see. The value depends on the role. For department roles marked with *, it is the Financial Reporting Unit (FRU) or FRUs the access applies to. Some central personas need a different type, such as a Business Unit (BU), and the value can be a department BU or the central BU. Include the security context in the request.
Which roles need a security context?
Department roles that need an FRU:
- Concur Adhoc Approver
- Concur Department Expense Approver
- Concur FRU Account Approver
- Concur Secondary FRU Account Approver
- Jaggaer Allocator
- Jaggaer Department Analyst
- Jaggaer Department Flexcard Administrator
- Jaggaer Department Invoice Approver
- Jaggaer FRU Approver LV1
- Jaggaer FRU Approver LV2
- Jaggaer FRU Approver LV3
- Jaggaer FRU Approver LV4
How many Concur approvers can an FRU have?
Each FRU can have only one Concur FRU Account Approver and only one Concur Department Expense Approver (DEA).
Jaggaer
How much can each Jaggaer FRU Approver level approve?
| Level | Can approve |
|---|---|
| LV1 | $0 to $2,500 |
| LV2 | $2,500 to $5,000 |
| LV3 | $5,000 to $25,000 |
| LV4 | Over $25,000 |
Can a person hold Jaggaer Advanced Shopper with other Jaggaer roles?
No. Advanced Shopper cannot be combined with any other Jaggaer role. Advanced Shopper is very restrictive by design and interferes with how the other Jaggaer roles function when held together.
After access is granted
How long until access works?
- Jaggaer/OFC: up to 4 hours
- Concur: next business day
- TOE: shortly after provisioning
To check assignments in Gateway, see the Jaggaer Access Confirmation guide.
Where can I see current access assignments (RSA Report and Access Report)?
Two reports in FinHub.
RSA Report
Shows assignments for the roles department RSAs can request. Roles marked with * require a FRU:
- Concur Adhoc Approver (requires FRU)
- Concur Department Expense Approver (requires FRU)
- Concur FRU Account Approver (requires FRU)
- Concur Secondary FRU Account Approver (requires FRU)
- Jaggaer Adhoc Approver
- Jaggaer Advanced Shopper
- Jaggaer Allocator (requires FRU)
- Jaggaer Department Analyst (requires FRU)
- Jaggaer Department Flexcard Administrator (requires FRU)
- Jaggaer Department Invoice Approver (requires FRU)
- Jaggaer Flexcard Holder
- Jaggaer FRU Approver LV1 (requires FRU) ($0 to $2,500)
- Jaggaer FRU Approver LV2 (requires FRU) ($2,500 to $5,000)
- Jaggaer FRU Approver LV3 (requires FRU) ($5,000 to $25,000)
- Jaggaer FRU Approver LV4 (requires FRU) (over $25,000)
- Jaggaer Receiver
- Jaggaer Requestor
- TOE GL Reviewer
- TOE Preparer
- VCAD Project Analyst
Access Report
Shows assignments for every role, since central RSAs can request any role.
I have a Concur or TOE how-to question.
Those are answered in office hours:
- Concur Office Hours (Google Calendar): Tuesdays, 1:00 to 2:00 PM
- TOE Office Hours (Zoom): Wednesdays, 3:00 to 4:00 PM
FlexCards
How do I get or cancel a FlexCard?
To get a FlexCard
Submit the FlexCard addition form through Procurement. The cardholder must also complete the FlexCard Exam (see Training requirements).
To cancel a FlexCard
- The department submits the FlexCard cancellation form through Procurement.
- Procurement makes sure all charges have posted.
- Procurement cancels the card.
- Security & Controls then removes the Jaggaer FlexCard Holder role.