Oracle E-Business Suite Most Common License

Compliance Issues

A b.lay white paper

March 2015

Make software compliance an exciting opportunity to improve your business.

2

INTRODUCTION Organizations tend to underestimate the effort required for managing their software licenses and deploying all programs properly. Oracle’s E-Business Suite is no exception to this financial risk inducing business practice. This b.lay white paper addresses the most common Oracle E-Business Suite compliance issues. Our observations and recommendations are based upon over 15 years of experience with customers who implemented the Oracle E-Business Suite, and either went through an Oracle License Review or an Oracle License Audit. The most common compliance issues concern the following license metrics:

• Application User ............................................................................................................................................................ 3

• Application Read-Only User ....................................................................................................................................... 3

• Primary Usage ............................................................................................................................................................... 3

• Concurrent Usage ......................................................................................................................................................... 4

• Professional User vs. Employee User ....................................................................................................................... 5

• Professional User – Internal vs. Professional User – External .......................................................................... 5

Licensing of the following Oracle E-Business Suite applications and their most common compliance issues are considered as well:

• Human Resources .......................................................................................................................................................... 5

• Order Management ...................................................................................................................................................... 6

• Enterprise Asset Management and Self Service Work Requests ...................................................................... 6

• Customized E-Business Suite Applications ............................................................................................................ 6

• Customized Database Technology ............................................................................................................................ 7

o Database Modifications ................................................................................................................................ 7

o Application Server Modifications ............................................................................................................... 7

• Consultancy Firms ....................................................................................................................................................... 8

3

ORACLE E-BUSINESS SUITE - COMPLIANCE RISKS ____________________________________________________________________________________________________________

APPLICATION USER The Application User license requires an organization to determine all the individuals who are authorized to make use of the E-Business Suite programs, regardless of whether the person is actively using the software at any given time. In spite of this contractual term, organizations often don’t realize that they should actively perform user management to keep track of the changing population. You should not only identify new users who may need to access the software, but also regularly perform data cleanups of all E-Business Suite users. Individuals who no longer need to use the software should be end-dated: for example persons who have changed roles or left the organization. These people may not actually use the software anymore, but could still be authorized and then still have to be licensed. Such a cleanup should not only take place at an organization’s production instance but should include all instances, for example any test, development or acceptance environment. That’s because Oracle requires you to license every individual who is authorized to make use of the software installed, on single or multiple servers. Therefore, any person who may only be authorized to use the programs in a test environment, still needs to be licensed. Consequently, organizations should also keep track of any functionality that is under test at a certain moment plus of the individuals who are granted access to that tests. For instance, during an E-Business Suite Financials pilot you may want to verify if the module Purchasing could provide added value as well. A selected number of people will get the responsibility assigned within the system to test the module. If your organization decides to start using the Purchasing functionality, licenses are typically purchased. However, what if the organization decides to not use Purchasing? Did you end-date the responsibilities of all test users? Typically, this does not happen which means that in an audit both tested applications and test users will be counted. APPLICATION READ-ONLY USER Next to Oracle E-Business Suite “Application User” licenses, an organization often will acquire “Application Read-Only User” licenses for solely running queries or reports against one or more of the E-Business Suite applications (e.g. Financials). Since read-only licenses provide fewer usage rights than the Application User licenses, they are cheaper. However, you must make sure that all read-only responsibilities and corresponding users are clearly identified. Organizations that fail to distinguish between different types of users will end up with all licenses being counted as “full use” Application User ones, which is a costly mistake. Individuals who are granted the right to both read-only and full use will be counted only once, as full Application Users, in a license review or license audit. PRIMARY USAGE Before December 2006, Oracle applied a so-called Primary Usage policy which meant that organizations could purchase licenses for Financials, Purchasing, Discrete Manufacturing, Process Manufacturing and Project Costing with the primary configuration. Consequently, any individual authorized for at least two or more of these application programs would only be counted once. This licensing model was very cost effective and provided a feeling of paying for “fair usage” since it didn’t require licenses for every application program separately. Under the current Application User licensing model however, 1 individual authorized

4

for Financials, Purchasing and Project Costing requires 1 Application User license for Financials, 1 for Purchasing, and 1 for Project Costing. If the Primary Usage principle still is applicable, such a person only needs 1 single license. Licenses purchased before December 2006 fall under the Primary Usage principle. If your organization owns such licenses and purchased additional ones after December 2006 then Primary Usage governs the extra licenses also. If organizations are not aware of this or don’t distinguish proper, which is often the case, during an Oracle License Audit or License Review the benefits of the Primary Usage principle are being wasted. CONCURRENT USAGE From 1994 to 1998, Oracle sold its E-Business Suite applications on Concurrent Device or Concurrent User license metrics. Although Oracle does not sell software this way anymore, organizations owning such licenses are still allowed to use the applications under the original terms. Concurrent licenses require organizations to license the maximum number of users or devices that will use the software simultaneously (concurrently). This licensing model is very cost effective and provides a feeling of paying for “fair usage.” Concurrent licensing does not require an organization to list all authorized individuals as per the current Application User model. Instead, peak usage is the relevant factor. Concurrent Device or Concurrent User licenses often provide a lot of value to organizations but, especially since they are no longer sold, “concurrent” usage should be actively managed. For example, by determining on a regular basis which user population is the “heaviest” in order to allocate the available Concurrent licenses to them. Not managing the concurrent usage of the software typically means that in a license audit you cannot prove your compliance position. Consequently, an organization will need to to migrate Concurrent licenses to the less favorable Application or Named User licenses. In most cases this requires additional Application or Named User licenses to be purchased since the whole authorized user population needs to be licensed. Managing software licenses properly also gives you the opportunity to mix older, more favorable licenses with new licenses, which may be needed due to the natural growth of the usage population. Consider an organization with 10 Concurrent User licenses and a total of 100 individuals, which are authorized to use the Financials application. With a maximum of 8 simultaneous users over the last month or year never exceeded 8 Concurrent Users there won’t be any issues. However, not being sure and able to demonstrate may mean that your organization needs to subscribe all 100 individuals; which is a costly investment in license and recurring annual support fees.

5

PROFESSIONAL USER VS. EMPLOYEE USER From February 2002 until March 2003, Oracle sold its E-Business Suite applications on the license metrics “Professional User” and “Employee User,” that granted individuals the right to use a number of E-Business Suite applications (Financials, Purchasing etc.) as listed in an Exhibit to the Ordering Document. This licensing model followed the “Primary Usage” model of before December 2006. Although the Professional User and Employee User metrics allowed the use of a bundle of E-Business Suite applications, the rights were limited to the application programs in the Ordering Document or an extra Exhibit. Many organizations don’t realize that and wrongly assume being entitled to use all E-Business Suite application programs. In addition, organizations typically fail to realize that individuals who are authorized to use both bundles (Professional User and Employee User) will be counted under the Professional User metric, being the “stronger” of the two. PROFESSIONAL USER – INTERNAL VS. PROFESSIONAL USER – EXTERNAL Initially, enterprise software was used to support the internal business processes of an organization. Over time, organizations wanted software also to support all business processes between themselves and “external” organizations in a B2B relationship. Oracle began to use this distinction when the company introduced two options in its Professional User licensing model: licenses which grant individuals from the own organization the use of E-Business Suite programs and licenses which grant individuals from external organizations to use E-Business Suite programs. “External User” licenses were typically less expensive than “Internal User” ones, but required that all external users would be clearly identified in the software. For example, by applying a naming convention in the user and access management functionality with a description of the employer, or by adding the company email address of the individual that would have access to the E-Business Suite program(s). Business Application Managers often don’t have a correct understanding of such contractually agreed terms and conditions. And if they are aware of them, they often don’t have the time and/or resources to create and manage the user profiles and authorizations appropriately. Consequently, organizations tend to lose track of which users are internal and which external. Being unable to clearly distinguish internal from external users will mean that all will be counted as internal when an Oracle License Audit or License Review is being performed. This is yet another example of how the lack of proper software license management can easily cause financial risk. HUMAN RESOURCES Before October 2006, Oracle sold its Human Resource software on a “Person” licensing metric. As of October 25, 2006, Oracle started to this software on an “Employee” licensing metric. Organizations already owning Person licenses were recommended to migrate these to the new “Employee” metric and license all people who needed to use the software. It is not uncommon for anorganization to still have both license types in place (Person and Employee), and pay support maintenance fees for both with the risk of having the software licensed twice. Organizations owning Human Resources licences or any other application on an “Employee” metric should be aware to run certain queries on their E-Business Suite installations during the course of an Oracle License Review or License Audit. These queries validate the HR records in the E-Business Suite software and validate if the employee or contingent worker flags are set to ‘Yes’. Organizations should make sure to

6

properly keep track and clean up their HR records. Failing to actively manage the E-Business Suite software may well have the effect that people who are retired but still have the employee flag set to ‘Yes’ falsely contribute to the number of software licenses. ORDER MANAGEMENT Before March 2003, Oracle licensed its Order Management software on an “Order Line” licensing metric. As of March 24 2003, Oracle started to license this software by the license metrics “Application User” and “Electronic Order Line“. Oracle applied these licensing types to reflect different usage: individuals who are entering order lines manually within the software are counted as Application Users, while electronic orders fall under Electronic Order Line licensing. Typically, organizations only purchase Application User licenses, either because there is no intention of entering orders electronically or because the concept of electronic ordering is not fully understood. Too many times, organizations consider order lines not to qualify as electronic that were manually entered in other systems and then imported in the Order Management software. This practice however can be technically verified and definitely classifies as “Electronic Order Line” usage. Since Advanced Pricing is an option in the Order Management functionality, this principle is applicable to Advanced Pricing as well. ENTERPRISE ASSET MANAGEMENT AND SELF SERVICE WORK REQUESTS The license “Self-Service Work Requests” is an option of the product “Enterprise Asset Management,” which are separately licensable. However, the responsibilities used during the user setup and authorization process within the E-Business Suite software are usually defined under the same application module (Enterprise Asset Management) for both programs. As a result, organizations using these products are typically at risk for counting users authorized for Self-Service Work Requests under Enterprise Asset Management, to the effect of an artificial increase of the usage of Enterprise Asset Management. In order to avoid this and to use the different licenses as efficient as possible, it is recommended to identify and register the self-service responsibilities correctly to make sure that the Self-Service Work Requests for Enterprise Asset Management are counted correctly. CUSTOMIZED E-BUSINESS SUITE APPLICATIONS 9 out of 10 times, organizations that implement Oracle E-Business Suite will need to perform modifications to the default settings. Typically, the procedure will be based upon an existing customized E-Business Suite application which requires the people authorized to use this program to be licensed, since the customized application program is based on, or making use of Oracle’s intellectual property. Therefore, organizations should be aware of (and register from the start of the implementation) the specific functionalities of all the different customized applications. Failing to keep track of application programs used as a basis for certain functionalities, almost always results in the usage of certain standard E-Business Suite applications being higher than expected, since the customized applications were not accounted for. In the rare occasion that users are authorized to make use of stand alone customized applications, not related to any of the standard existing E-Business Suite applications, organizations should be aware that these users need to be licensed by the cheapest license from the current Oracle E-Business Suite price list. Since the custom modules use the EBS infrastructure (the logon system), all people authorized would must be licensed in some manner.

7

CUSTOMIZED DATABASE TECHNOLOGY Oracle originally developed as a database company. With the introduction of the Oracle E-Business Suite programs, it has always been (and still is) Oracle’s strategy to gain a substantial share of the Enterprise Application software market. As part of this strategy, Oracle grants its E-Business Suite customers - within the E-Business Suite licenses – restricted usage of the Oracle Database and Internet Application Server software. The software can only be used for the E-Business Suite and usage is restricted to the “out of the box” - unmodified - functionality of the E-Business Suite software. By granting its E-Business Suite customers this restricted usage right for the database and the middleware software, Oracle managed to secure a competitive benefit compared to other Enterprise Application vendors who require their clients to buy separate database and middleware licenses from other players. Given the specific nature of business processes and/or the integration with other applications, organizations typically need to implement modifications to the Oracle Database and/or Oracle Application Server supporting the E-Business Suite application to build an overall business solution.

DATABASE MODIFICATIONS

Commonly, the Oracle Database is being tuned by adding and/or modifying tables, columns, stored procedures and triggers, which are part of Oracle E-Business Suite application schema. Organizations should be aware that in this way they “breach” the restricted usage rights should therefore additionally purchase separate Full Use licenses for the Oracle Database Enterprise Edition AND the Oracle Internet Application Server Enterprise Edition. The number of licenses required depends on the total number of end users or processors for which modifications are deployed. Moreover, organizations may be required to license the Internet Developer Suite and/or Programmer software as well, to license the usage of the developers who perform the modifications. APPLICATION SERVER MODIFICATIONS Common modifications to the Oracle Application Server include any creation or modification of reports, forms, and/or workbooks. In addition, modifications implemented as Java programs, which include Java producing HTML interface or Java business logic, are also in this category. In these two scenarios, an organization continues to own a restricted-use license for the Oracle Database Enterprise Edition and a limited set of other products. This restricted license may only be used with the licensed E-Business Suite application(s); it cannot be used for any other purposes. Moreover, the organization is required to purchase Full Use since the restricted usage rights were breached. The number of licenses required depends on the total number of end users or processors for which the modifications are deployed. More details about these kinds of modifications can be found in Oracle’s Application Licensing Table, see: http://www.oracle.com/us/corporate/pricing/application-licensing-table-070571.pdf .

8

CONSULTANCY FIRMS Organizations that implement the E-Business Suite applications typically do not carry out the implementation and modifications to the software themselves. Instead, they hire an implementation partner or consultancy firm. Some organizations decide to make use of Oracle’s own consultancy organization; others choose alternative partners. Since these consultancy firms are typically not aware of their modifications’ licensing consequences, non-compliance issues may only be discovered many years afterwards. This typically results in unexpected financial risk and – once the issues are identified – in unbudgeted costs. In such a situation, an organization will try to hold the consultancy firm responsible and reclaim their loss. However, the organization itself is fully responsible and accountable for complying with the terms and conditions of its license agreements, even if Oracle’s own consultancy organization would have performed the implementation and modifications.

9

ABOUT THE AUTHORS ____________________________________________________________________________________________________________

TUDOR STOENESCU Tudor is one of b.lay’s Senior Technical Analysts, responsible for the execution of technical analysis services for enterprises software programs, the development of internal measurement tools and analysis processes, and for customer support and consultancy around Oracle licensing. Tudor brings to clients his knowledge accrued over the last 6 years in Oracle’s License Management Services department in which he performed license analysis and usage reports for hundreds of Oracle E-Business Suite customers globally. In addition, Tudor has been maintaining and developing Oracle E-Business Suite environments of end users, developing and enhancing reporting functionalities of Oracle Financials (including the integration of external applications) and writing technical and end-user documentation. Tudor holds a Master’s

degree in IT from the Academy of Economic Studies of Bucharest, Romania.

RICHARD SPITHOVEN Richard joined b.lay as a partner on September 1, 2013. Richard uses his knowledge from the last 8.5 years in Oracle License Management Services to educate, equip, and enable software end users in their challenges with regard to proper software license management. Richard started in October 2005 as an Oracle Licensing Consultant, after which he fulfilled the role of Regional LMS Director for the Europe South region (including Belgium, Netherlands, Luxembourg, France, Spain, Italy, and Portugal) for a period of 4.5 years. In this role, Richard managed a team of 40 licensing

consultants and was responsible for setting the strategic direction of the LMS organization. Richard holds a Master’s degree in IT from the University of Amsterdam, The Netherlands.

10

DISCLAIMER

The information contained in this document represents the current view of b.lay BV on the issues discussed as of the date of publication. Because b.lay must respond to changing market conditions, it should not be interpreted to be a commitment on the part of b.lay, and b.lay cannot guarantee the accuracy of any information presented after the date of publication. This White Paper is for informational purposes only. b.lay MAKES NO WARRANTEES, EXPRESS, IMPLIED, OR STATUTORY, AS TO THE INFORMATION IN THIS DOCUMENT. Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, no part of this document may be reproduced, stored in or introduced into a retrieval system, or transmitted into any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), or for any purpose, without the express written permission of b.lay BV. b.lay may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement of b.lay, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property. COPYRIGHT NOTICE. Copyright © b.lay BV, Goeman Borgesiuslaan 77, 3515 ET, Utrecht, The Netherlands. All rights reserved. TRADEMARKS. b.lay, the b.lay logo, b.lay BV, Zyncc, Lictionary, Tzin Tzin and/or other b.lay products referenced herein are either trademarks or pending trademarks of b.lay. All other trademarks are the property of their respective owners.

11

Address: Maliebaan 79 3581 CG Utrecht The Netherlands URL: http://www.b-lay.com Email: info@b-lay.com