Dear all,

this document outlines how the NWBC splash screen can be deactivated. When launching the NetWeaver Business Client (Transaction NWBC) the splash screen starts first. The splash screen shows all the role assignments the user has and is helpful in test systems for testing the roles. However, in productive systems it is recommended to deactivate the splash screen so that the NWBC starts directly.

A screenshot of the splash screen with standard roles assigned:

To deactivate the splash screen we have to deactivate the service /default_host/sap/bc/nwbc/nwbc_launch in transaction SICF. I suggest to search via the ServiceName field for *nwbc_launch* (so that you don't have to navigate thru all the services). Deactivation can be done with a right click and select "Deactivate Service".

After deactivation of the service the NetWeaver Business Client starts immediately.

Hope this is helpful for you.

Regards,

Alessandro

Hi All

If you are wondering what this document is all about then please refer to: Community Collaboration for GRC Blogs and Documents - you will find an overview of what this community collaboration is about and the rules on how you can contribute. You are still encouraged to write your own blogs and documents without participating in this process (it would be nice if you could update this document to let the community know you are working on something).

You are also welcome to be both the person who suggests the topic and the author. This can advertise you are working on the topic and hold yourself accountable to a deadline that the community is aware of.

Remember: Add a row below the 3rd row of the table to included your suggestion. Please do not change the first three heading rows as these rows indicate the title and a short summary of the content below. When including your name, please include your SCN profile as a hyperlink (easiest way to open your Profile in a new browser tab and copy the URL)

I have created this document in order to help the customer with one of many sub scenarios provided by Process Control Business Rules. My objective is to create one document for each sub scenario. This is the first one.

Before starting creating Data Sources and Business Rules, you need to check parameter for table logging in RZ11. You can specify specific clients for table logging or set the default option to ‘All’. Check SAP note 1653464 for further information on performance.

When setting continuous monitoring, you must create a Data Source.

Why creating a Data Source?

The data source created is usable for many business rules. The data source is where system is going to obtain monitored data.

Supported Sub-scenarios:

• SAP Query
• BW Query
• Process Integration
• SoD Integration
• Configurable
• Programmed
• Event
• ABAP report
• External Parter

In this tutorial we only will see the Configurable Sub-Scenario (Highlighted in Gray).

Creating a Data Source:

Filling out the General Tab:

Object Field:

In this example, I selected to monitor changes in HRP1000. I have selected some tables Field to lookup.

I cannot find any information related to this table.

HR tables are not supported in a Configurable scenario. You can include HR tables in the configurable scenario at your own risk by There is a work around. You can maintain the HR/PA table name in the table /GRCPI/GRIASPEC and can be used in Configurable scenario. However SAP will not hold any responsibility for this work around and it is not recommended. Customer at their own risk can implement this work around. We need to check another table to lookup.

• Chose LFA1.

LFA1 (Vendor master table) is a standard SAP Table.

Explanation of Related Table Lookup:

The Reference or Dependent tables option define the direction of the relationships.

Dependent tables are those which refer to (as foreign keys) the key fields of your main table (primary keys), while reference tables are the opposite — they hold the primary keys to which your main table refers as foreign keys. You can join multiple related tables together in such a compound data source, with the constraint that the join conditions are restricted to being equality relationships between like-type fields. For the most part, it is expected you will join primary keys to foreign keys. PC 10.0 looks up known relationships  from the data dictionary and pre-populates the join conditions area as you go.

When creating a Join condition in data sources, you may consider the following:

• If the join condition will make the result table retrieve data (according to the cause mentioned in KBA 2177348);
• Maximum number of related tables is 5 (five);
• Some fields in the join condition are not appearing (See the explanation in the resoltion section of KBA 1970160);
• If duplicated tables are created when adding the related tables in the join condition, SAP note 1880242 must be implemented.

Next step is to perform an ad-hoc query to check whether the table data is being retrieved.

Retrieved results successful. Meaning that the connection is okay.

In the connectors tab, you can check the connectors assigned to this Data Source. You can have multiple Connectors assigned to one Data Source.

The Data Source must be active to be available in the Business Rule.

Creating a business rule:

Select the Data Source created and press start.

I chose the data I have selected in the Data Source. Here you can choose the fields you want to monitor:

In the filter criteria, I only included the Name of person who Created the Object:

For the filter values, I chose ZHAOBR (include this range). I just want to include changes made by this user.

In the deficiency criteria, a handler must be selected in order to get changes from the target system. The table responsible for transport changes is SCU3.

Once selected, the fields must be shown in the Field Description.

If the fields are not available user needs to check in the target system whether or not the table LFA1 (table used in this example) is active for log changes.

Go to SE11 and type the table in the Database table field:

Go to technical settings of the table:

Enable Log Data Changes:

Check whether SCU3 is logging LFA1 table after the changes:

After this procedure if you still cannot see the deficiency fields check your GRCPINW support package level. An enhancement was done for capturing table change log directly from SCU3. Apply SAP note 1796052 if you are under Support Package 10 of GRCPINW.

Now, if we return to the Business Rules, the field descriptions are activated.

Conditions and Calculations

In this steps you can insert additional conditions to the Business Rule (BRFPlus). You can totally customize the BR according to your company needs.

Output Format

In the output format you can defined how the business rule will be shown.

Technical settings:

These settings basically affect the execution and performance of monitoring. It is always a best practice to test the performance of rules before transporting to production.

1. Calculate deficiency -> Remotely

It is used in the same way as PC 3.0. The job will collect data and apply the rule only on the returning data which is defined as deficient by the ERP. When the data volume is huge, this method will help to reduce the retrieving data.

2. Calculate deficiency -> Locally

This is used for almost all the sub scenarios. It analyzes the data on Process Control side. Rules are applied on the Process Control side as well.

3. Communication mode -> A sync.

Process Control will perform a job steps (execution of a Business Rule) via RFC to the ERP system and it will be executed in background mode. When the execution is finished, RTA sends the result back via RFC to Process Control. It is a two way communication.

4. Communication mode -> sync

Most of the sub scenarios use this. It means that when a Job step is executed, the Work Process waits the result from the RFC call and processes it. In most of the cases, this is used to calculate deficiencies locally.

5. Change log type

Here you can include the change types you want business rule to capture.

Ad-hoc query

Here you will test your business rule against all the criteria you have established.

The message is not an error. It means that the information for that timeframe was not found for that connector. Changing the timeframe to 2012 for example, I can find results.

Based on my conditions and filters, the results are showing correct.

Checking SCU3:

I Can see the same results.

After these steps, rules must be assigned to controls.

The results will only be found according to the deficiency criteria. Other fields will not be taken into consideration.

If you are familiar with debugging, you can debug the ad-hoc query to check the results at code level by following the steps in the following wiki:

• Debugging Business Rule Ad-Hoc Query

This document is a collection of the most useful SAP GRC Access Control documents, blogs, resources, links, etc. here in SCN.

Overview

Getting Started with SAP Governance, Risk and Compliance Solutions (GRC)

GRC Processes, Lifecycles and Responsibilities

General opinion and thought-leadership

Are you ready to implement GRC 10?

A lot of help from my friends

If I had it to do all over: looking back on GRC 10 projects

Lessons learned from SAP GRC projects

Remediating Access Control SoD Risks

Internal Controls - a step towards strong controls

Defining Mitigating Controls / Compensating Controls

IT Control Testing - SOX Compliance

A #GRC tool is just part of the solution

It’s Just a Few GRC Ideas….Place

GRC General

Helpful transactions, tools, programs, tables, etc. for a SAP GRC Consultant

NWBC screen layout options for GRC

Customizing NWBC for New Menus with our own Transactions, Reports and Accessing SAP Backend Systems from NWBC

Configure LaunchPad for Menus

Customizing Access request and approval screens in GRC Access Control

Issues, Bugs in GRC SP13 - Related Fixes

General tips to help in troubleshooting scenarios

Access Control Debugging tips

SAP GRC AC 10.1 - Enhancements

How to delete roles, mitigation controls, users, and other informations from one connector

Product Support

GRC Product Support Monthly Newsletter

HR Triggers

Understanding HR Triggers in Access Control 10.0 - Governance, Risk and Compliance - SCN Wiki

GRC 10.0 - HR Trigger configuration - Governance, Risk and Compliance - SCN Wiki

Example of decision table for GRC 10 HR Trigger rule, using BRF+ tool

GRC Access Control - Compliant User Provisioning: HR Triggers

Debugging HR Trigger - GRAC_HR_TRIGGER_EVENT_RECIEVER

Debugging HR Trigger - Simulation

Debugging HR Trigger - PA40 changes to infotypes

MSMP Workflows

AC 10.0 - Customizing Workflows for Access Management

MSMP - Multi Step Multi Process – GRC’s answer to Workflow Configuration Flexibility

BRF+ Configuration

Determining the Logic behind Decision Tables

LDAP

Configuring LDAP Connector in Compliant User Provisioning of GRC Access Control

LDAP Group parameter mapping.. what does it mean?

Mobile Apps in SAP GRC

Administrator guides for Access Approver, Policy Survey, etc.

Fiori apps in GRC – Install two applications in 5 easy steps

Access Control with Identity Management (IdM)

SAP BusinessObjects GRC 10.0 Integration Guide – Access Control 10.0 and NetWeaver Identity Management

SAP Access Control 10.0 Interface for Identity Management

SAP GRC with SAP BPC

How to Assign SAP Business Planning and Consolidation Authorizations via the SAP Governance, Risk, and Compliance (GRC) Access Control Compliance User Provisioning Product

Access Risk Analysis (ARA)

ARA - For the new kid on the block

Rule set - Rules & Rule Types

Business Risks / Rule Set

Download, Modify and Upload the Access Risk Analysis Rule Set in SAP Access Control 10.x.

How to set up a Configurable Business Rule

Online vs. Offline Risk Analysis

Creation of Mitigation Controls in GRC 10.0

Organizational Rules in GRC Access Control

Mass change of Mitigation Assignments

SAP GRC AC 10.0 Alerting

The Action Usage Sync job in technical details - GRC Access Control 10.0

The Repository - GRC Access Control 10.0 

Access Request Management (ARM)

ARM - For the new kid on the block

AC10.0/10.1: Create Rule Based on Risk Violation in Request, Using BRF+ Procedure Calls

Approve/Reject Own Requests

How to Change Subject Line in SAP GRC Email notification

Recommendations for using Business roles provisioning in access request

Configure Manager Look-Up in ARM for GRC 10

Role Search Screen Enhancement – GRC 10

Terminate Account - Request Process - GRC 10

Creating Access Request: Template Based Requests and Configuring End User Personalization forms for use with Access Requ…

GRC Request with both System and Role Line Items

Access Control 10 (ARM) – Risk Analysis Report Type is editable in Access Request.

Access Control: - Create Access Request Using Web Service in GRC10

Design Considerations to reduce Password Self Service (PSS) Intruder Risk

User Access Review(UAR) Workflow Configuration and Description - Governance, Risk and Compliance - SCN Wiki

Direct vs. Indirect Role Assignment

Business Role Management (BRM)

BRM - For the new kid on the block

Maintain Default Roles in BRM GRC AC 10.1

Role Import - GRC 10

Import Role from ECC to GRC system

Business Roles concept and usability in GRC AC10

Enabling Business Role updates to existing assigned users

BRM Default Approvers via Condition Groups

BRM Role Methodology via Condition Groups

Emergency Access Management (EAM)

EAM - For the new kid on the block

Usage of EAM

EAM - Provisioning Strategies

EAM Utilisation and Log Review Process 

ID-Based Firefighting vs. Role-Based Firefighting

AC 10.0 - Centralized Emergency Access

Configure Emergency Access (EAM) in GRC 10

De-centralized EAM GRC 10.0

EAM - Approve through Wrokflow

Emergency Access Management Reporting

Analysis and Recommended Settings of the Security Audit Log (SM19 / SM20)

EAM: Requesting emergency access via access request workflow in SAP GRC - step by step.

See also

SAP Process Control - Useful Documents, Blogs, Resources, etc.

SAP Risk Management - Useful Documents, Blogs, Resources, etc.

SAP Fraud Management - Useful Documents, Blogs, Resources, etc.

Legend

	SAP SCN Documents
	SAP SCN Blogs
	SAP Wiki
	Newly added document (Contributors: please select from Emoticons )

Please help in updating the collection so that new users can get a well structured overview for their information.

Best regards,

Alessandro

In regard to my document about Rule Set / Business Risks I would like to give some detailed information about rules and rule types. As we learned rules (or risk rules) are possible combinations of transactions and permissions for a business risk.

Rules must be generated when ever risk contents change. This can be done in SPRO (GRC > Access Control > Access Risk Analysis > SOD Rules > Generate SoD Rules). Generally rules are combinations of actions and aren't maintained manually (done automatically by the program).

The number of rules defined from a risk is determined by

• the number of action combinations, and
• permission/field value combinations contained in each function of the risk.

The following graphic shows the rule structure in more detail:

Now let me give you a short overview of the different types of rules considered by GRC.

Transaction Rules

Rule components are as follows:

• System
• Conflicting Actions
• Rule ID
• Risk Level
• Status

Example (from the graphic above):

F001001: Maintain fictitious GL account & hide activitiy via postings

F001001 - Risk ID

F001001 - Action code combination number (represents Conflicting Actions)

Permission Rules

Rule components are as follows:

• System
• Object
• Field
• Rule ID
• Risk Level
• Status

Example (from the grapic above):

F00100101: Maintain fictitious GL account & hide activity via postings

F00100101 - Risk ID

F00100101 - Action code combination number

F00100101 - Object combination number

Critical Action

List of actions considered critical. Option to run at both Action and/or Permission level. Critical Actions are created same way as Segregation of Duty risks, exept Risk Type = Critical Action, and can contain only 1 function (as shown above with SCC4).

Critical Permission

List of objects/permission considered critical. Created same way as Segregation of Duty Risks, exept Risk Type = Critical Permission, can contain only 1 function, and function cannot contain actions.

Critical Roles and Profiles

Roles and profiles considered critical. Critical roles and profiles will be excluded from analysis if the configuration parameter 1031 (Ignore Critical Roles & Profiles) is set to YES.

Organizational

Used to eliminate false positive SOD reporting based on organizational level restrictions for users. Organziational rules should not be created for mass org level reporting as it should only be enabled for functions that you specifically need to segregate. Most companies are controlling what data a user has access to via role assignment. There are only very few companies who have a business need to create org rules. Please find more detailed information in Organizational Rules in GRC Access Control.

Supplementary

Additional security parameters other than authorizations a user must have to enable access. First checks to see if the user exists in the supplementary table, then checks if conditions are met. Based on exclusion setting, it will include or exclude the user in the risk analysis.

Please share and contribute in this document to make it better.

Looking forward to hear from you.

Best regards,

Alessandro

Offline Workflow Process is used to process Workflow tasks offline through email and submit back to GRC Process Control system for further processing.

In GRC Process Conrol 10.1, OWP workflow text does not contain information about relevant Organization,Subprocess, Control,Period and Year of

assessment. But there is a flexibiltity to include this information, as these parameters are contained in OWP exit class responsible for sending OWP workflow.

This functionality shall be available in Support package assembly only.

However if customer want to include the functionality :

Modify the document 'GRFN_OWP_DELIVER; responsible for sending the workflow text.

Execute transaction SE61 and chose the document class as 'general text'.

Select the document 'GRFN_OWP_DELIVER' and chose to change the object :

You might change the general text to below (example)Workflow text:

Dear Colleague,

Please complete this task on or befor due date: %DUE_DATE%

Task:%TASK_NAME%

Organization:%ORGANIZATION%

Control:%CONTROL%

Period and Year:%PERIOD_YEAR%

Open and complete the attached form. Submit it and send the resulting email.

Regards,

GRC Team

Save and activate the changes under suitable correction request to reflect the changes in OWP Workflow text.

Customer enhancement for change in the message class 0FN_OWP_DELIVER is required or we need to wait for Support Package11 assembly.

If you have a situation where you need approval of Manager's Manager.

like we have scenario for normal role and critical role.

when  we have workflow for request type New/Change account for assignment of role. Which goes for 2 level of approval process unless it is a critical role where it goes for 3 level of approval process.

Critical role are marked as critical within Role in GRC Access Control 10.1 Business Role Management which is repository of roles in GRC System.

When a request is submitted by user it creates a request number and a workflow is also triggered.

The work flow takes the approval path based on Initiator rule created in BRF+.

The initiator rule contains the input parameter in decision table and gives the rule result values which are directly mapped to follow the path based on rule result.

here is example of BRF+ decision table.

For example, New/Change Request type is 001, and when submitted a role assignment it check in the Initiator rules and takes the approval process.

The approval stages are maintained in MSMP for each path where Agent rules (approver determination Function Module) are mapped.

The Non critical role path is maintained with 2 stages of approval process

1. Manager
2. Role Owner

Critical Role Path is maintained with 3 stages of approval process

1. Manager
2. Manager's Manager
3. Info Asset Owner

      Determination of approver (Agent Rule) is mapped to stages and the workflow reads the stage detail in background and sent it to approver's inbox.

     There are SAP Standard Function Module based rule for determining approver like Manager and Role Owners

Determination of Manager's immediate head is not a standard functionality but can be achieved using ABAP Class based function module Rule

SAP GRC 10.1 Access Control provides interface GRFNMW_DEV_RULES to develop your own rules and can be contained to be mapped into MSMP.

The rules created will be maintained in the MSMP Rules as approver, and will be used in MSMP Stages as approver agent.

When a request goes to the stages it sends the workflow item to the approver determined by the rule.

To achieve this, A Function group (ZGRAC_FM_RULE) and Function Module based rule (ZMGR2_CRA_AR). Needs to be created

Step 1: Create a function group ZGRAC_FM_RULE

Step 2: Execute tcode GRFNMW_DEV_RULES Create a Function Module based Agent rule ZMGR2_CRA_AR.

Copy GRAC_MSMP_MANAGER_AGENT to create a function module ZMGR2_CRA_AR.

It will be linked to MSMP process id SAP_GRAC_ACCESS_REQUEST by GRC Team (TECHM) once the development of new Function module rule is complete.

The agent based Function module rules, should first run a query on table GRACREQ to get the Request GUID. Then it looks up in table GRACREQOWNER using Request GUID for that particular request, looks for Usertype=MAN and determines the value of USERID from the table which is managers ID of the user for whom the request is raised. The Manager ID will be used as User ID and  will look up for its managers based on data source configuration.

This is already configure`d in SPRO, Data Source configuration.

The Function Module Rule will be maintained Under Maintain Rule in MSMP.

And will be mapped to Agent ID, which will be used in Stage for approval.

Whenever a request is submitted GRACREQOWNER table is updated with Request ID, with information of Manager is stored under User Type as MAN ,and Manager's ID is stored under USERID.

1. The RFC Information are stored in table GRACV_DETAIL_DS, where Connector ID is the RFC Name and User Data type = HR ,

  Table GRACV_DETAIL_DS  is a maintenance view table.  Select queries cannot be applied on maintenance tables. As discussed, we can refer to table GRACUSERSOURCE, this is the root table of GRACV_DETAIL_DS.

                Read table GRACUSERSOURCE using the ff. parameters:

• User Data Type: HR
• Data source type: 01

if There are 2 HR systems the loops will check the systems based on sequence.

• Once Manager ID is retrived, the value of Manager ID  will be passed to HR System Using RFC and the RFC should call function Module /GRCPI/GRIA_USR_GET_DETAILS provide the Manager ID and path  and retrive the Managers Manager ID and pass it to GRC System agent rule as an Agent for that stage.

The following input parameters will be passed to FM /GRCPI/GRIA_USR_GET_DETAILS

• Manager’s of the user
• Path ID – will look at table GRACCONNSTAT passing the connector = RFC connection.
• (SPRO àààMaintenance Connector Settings)

Thanks you.

This document will explain step-by-step process to delete below type of roles from AC 10.

• Business Roles
• Composite Roles
• Single Roles

• Deletion of Business Role:

    When you try to delete the business role, you may get below error. It means that Business role is being used in some request which is still open.

   To check all the requests for particular PFCG/Business Role, check GRACREQPROVITEM table.

   This table will give you the list of all CUP request where this role is being used. In field "Provisioning Item" put Business role (PFCG role if you need to see request for PFCG role) and execute. You can give date criteria as well if you are very much sure that beyond that date no request is open or using mentioned role.

This will give you the list of all requests open/closed. Please note that field "Line Item Status in Application" of table GRACREQPROVITEM sometime do not update the status of rejected/cancelled request (see  below screen shot for ref.) so please verify the status in Search Request to make sure all requests are in Finished status..

         Once above check is complete. You can delete the Business role.

Please note that in order to remove business role, you don't have to remove composite/single role from Business role.

• Deletion of Composite Role:

     When you try to delete the Composite role, you may get below error.

In this case also, please make sure that Composite role is not part of any Business role and there are no open request for composite role.

Sometime even after doing above steps you might face the same error, in that case refresh your session and try again. Role will be deleted.

Purpose of User Defaults:

When a new user is being created in the target system, all users of that system might require few common user defaults like Logon Language, Time Zone, Decimal Notation, Date Format, Parameters etc. Hence when a user is getting created through GRC, based on the request type these user defaults can be assigned to the users.

By including user defaults as part of request type (mostly New Account), user gets created with required user defaults in the target system.

Important SAP notes regarding User Defaults to refer before configuring User Defaults:

1615552 - GRC 10.0 How to set User Default

1665585 - User Defaults BRF+ rule not working correctly

2020712 - UAM: User group not provisioned after request provisioning

Steps to Implement User Defaults:

Step 1: Maintain “User Defaults “action as part of your Request Type. My Request Type 36 is for “New Account” and I have assigned “User Defaults” as shown below.

SPRO =>Governance, Risk and Compliance =>Access Control =>User Provisioning =>Define Request Type

Step 2: Go to SPRO -> IMG -> GRC -> Access Control -> User Provisioning -> Maintain User Defaults

Define User defaults for different connectors connected to your GRC system. One example as shown below:

You can assign default User Group and default Parameters based on the connector by using options “Set the User Group” and “Set Parameter ID” in the above screen as per your requirement.

Once you define the User Defaults as mentioned above and save it, a unique “Default-Id” gets created as shown below. This is the User Default Id which will be used in BRF+ decision table while configuring User Defaults.

Step 3: Existing BRF+ User Defaults application “GRAC_BRFP_USER_DEFAULTS” provided by SAP will be used during configuration of user defaults.

Copy the Function Id of USER_DEFAULT_FUNCTION from BRF+ application.

Now map the BRF+ Application for user defaults under the IMG configuration shown below:

Go to IMG->Governance, Risk and Compliance->Access Control->Maintain AC Applications and BRFPlus Function Mapping

Step 4: Add Decision Table and Loop expression to BRF+ User Defaults function as shown below:

Decision Table: In the decision table maintain entries as shown below

Loop: For using "System" as one of the fields in setting the conditions for User Defaults, SAP suggested for implementing a LOOP in BRF+ Rule. This might be needed since "System" field is not available under Request Header attributes, rather it is available as Role Attributes which are called as line-item fields while calling the BRF Rule. So, in such cases LOOP is a suggested solution, rather than using the Decision Table directly. Though within the LOOP, we can still call the Decision Table or implement IF/ELSE conditions.

Step 1:

Change the Mode of the BRF+ User Defaults Function from “Functional and Event Mode” to “Event Mode”

Now click on “Assigned Rule sets” tab in Function and click on “Create Ruleset”

Ruleset gets created as shown below. Now click on the Ruleset and navigate to Ruleset screen

Click on “Insert Rule” and select “Create” option as shown below

In the Rules screen, fill in the role description and click on “Add” button and select the options as shown below

Once the above step is completed LOOP is created. Now navigate to LOOP by clicking on LOOP_CONNECTOR_ITEMS and you will see below screen.

Once you click on “Create Rule”, you will get the below screen.

Select the decision table as you want to LOOP on the entries in your decision table. Once done click on “OK” button.

Ruleset: When a Function is in event mode, it looks for additional logic execution depending on the Rule-set defined.

Once all above things are done, activate the Decision table, Loop, Ruleset, Function and Application.

Step 5:  Now Create an Access request to test the User defaults and once the User is created please cross check the User Defaults in SU01 to check if everything is fine. If all the above steps are followed properly, User defaults will get updated properly as below in SU01.

Reference Links: http://wiki.scn.sap.com/wiki/display/GRC/Setting+up+User+Defaults

Sign off is Process of freezing the data for particular timeframe. Once the signoff is done data cannot be changed. All
the pending tasks including pending issues and plans will be cloned and the previous tasks for the user will be logically deleted.

1.Close assessments without issue - When there is no issue for an assessment, the assessment will be closed directly.

2.Clone the open issues - Only open issue will (with corresponding assessment , testing , remediation plan if exists) be cloned. Closed issue is
kept as it was.

3.Workflow replacement - The old issue (and the corresponding remediation plan if exists) will be removed or from work inbox(logically deleted) , and general new work item for the new cloned case.

For example, at the moment of sign off, Assessment didn’t finish and it had one issue and Remediation Plan to be working.

This task was blocked during the signoff. When this activity was finished, the remediation plan owner is apt to update the remediation plan
progress and conclude the task. So the system automatically creates the carry forward case for the pending cases.

The flow diagram above explains that all the pending tasks including pending issues and plans will be cloned and the previous tasks for the user will be logically deleted.

Functionality:

Signoff will be performed for whole system which means all the organization in standard hierarchy.

Workflow:

1 Sign off is bottom up process.

2 Sign off for Organization is only triggered if Subject to signoff is Yes for that particular regulation

3 Workflow will be sent lowest level of organization.

4 Once the lowest level is completed the workflow is triggered to parent and finally reaches the corporate. Even if multiple corporate is present it follows the same process.

5 Process will end once it finds the corporate node.

6 For corporate the workflow will be sent the CEO/CFO of the company

7 For Organization unit normally be triggered to Organization owner.

IMG:

Below two screenshot explains how the workflow is triggered:

Duer Org 2 is child of Duer Corp.

After Planning Sign off from Planner:

1. Take the task plan id from GRFNTASKPLAN using timeframe and year.

2 Enter the task plan id noted above and query GRPCSIGNOFFPLAN.All the organization to be signed off will present once the plan is
completed.

3 Once the signoff is done from inbox, data is stored in GRPCSIGNOFF,GRPCCLOSING, andGRPCCLOSINGBG.

4 ENTRY in GRPCCLOSING is responsible for setting locking of data in frontend.

After signoff all the data Organization and local sub process, local control and respective Central sub process, central Control, Risk Template, Control
Objective, Account Group are locked for the timeframe and cannot be changed.

4.1 Sign off is regulation specific.

4.2 If organization is signed off and if one of Control assigned to Organization belongs to different regulation then the local control should be
editable.

5 Org id will be stored in GRPCCLOSINGBG for carry forward job, once the job is completed the entry is removed from the table GRPCCLOSINGBG.

6  For the Corporate Org if more than on user (CEO/CFO) is assigned then both the user should signoff the Corporate.

7 In carry forward a new case id will be created and relationship is maintained in GRPCCASERELA table.

Carry forward is to move the open issues and remediation plan of an assessment or testing to future timeframe. This is taken care by Background job.

In this Customizing activity, you set up the background job that is executed once sign-off has been completed, to perform the carry forward of open
issues. This allows the open issues to be processed after the sign-off data freeze for the applicable timeframe.

Once the background job is scheduled, it is executed every time the sign-off is completed. The issues that are carried
forward include the assessment, testing and remediation plans.

JOB NAME: GRPC_SAP_JOB_AFTER_SIGNOFF

8 Attachments  will also be carry forwarded.

In this Customizing activity, you set up the background job to carry forward cases' documents. This is executed after the carry forward of issues has
been completed. This applies to assessment, testing, issue and remediation plan cases.

This process allows the document attachments from the cases to be available when the cases are carried forward. Once the background job is scheduled, it is executed every time the background job to carry forward open issues has completed.

JOB NAME:
GRPC_DOCUMENTS_CLONING_JOB

8.1 In the signed off timeframe below screenshot;

8.2. In the non- signed OFF timeframe the attachments is

9 The CF status of an assessment or testing will be Initially ^: No carry forward

Once Sign off is Done -

Old case id CF status ^is Carry Forward.

New Case id CF status  Carry forward without target timeframe. ( because timeframe can be anything next month or year).

10 After the signoff is planned if we change the Radio button in Organization to “ Not Subject to sign off”

Then when we open the work item of signoff task a new button called Close without signoff will appear

Report:

Signoff is done for the Organization in August 2012 .Organization has an open issue and remediation plan.

If we run the report for example remediation plan in August the carry forward status will be as below:

If we run the same report in September the status will be as below:

Points to be note:

1 Sign off cannot be planned for single Organization and it will be planned for all organizations

2 Organization should not be created in the same timeframe once the sign is planned for the signoff (If created will give an error while signing off
from the inbox)

3 Signoff task should not be forwarded manually using standard workflow functionality Transaction codes.

4 Even if the user is authorized to single Org- unit if the user plans sign off the signoff will be planned for all organization(s).

Dear all,

the motivation to write this document comes because I have been asked several times by users on SCN and by Email to provide best-practice approach with synchronisation jobs. In every GRC implementation project synchronisation jobs need to be scheduled to ensure that the necessary data from the backend systems are present in the GRC system. In this document I would like to share my experience in setting up the ordering and the frequency of synchronisation jobs required for SAP Access Control.

Please note that the frequency can vary in your projects based on the requirements you have. From my experience the following listing is a good approach to start with.

I recommend to run the jobs in the order as listed above. The repository object synchronisation job can also be run dedicated for users, roles and profiles. If run dedicately, also run in sequence as follows: users, roles and profiles.

In order to enable User Access Review (UAR) the following four jobs need to be run in its order:

1. Role synchronisation (is part of the job GRAC_REPOSITORY_OBJECT_SYNC, can also be run individually with program GRAC_ROLEREP_ROLE_SYNC).
2. User synchronisation (is part of the job GRAC_REPOSITORY_OBJECT_SYNC, can also be run individually with program GRAC_ROLEREP_USER_SYNC).
3. Action Usage synchronisation (program GRAC_ACTION_USAGE_SYNC).
4. Role Usage synchronisation (program GRAC_ROLE_USAGE_SYNC).

Please find detailed information regarding the repository jobs (authorization data, repository objects, transaction and role usage) on SAP Wiki: The Repository - GRC Access Control 10.0 - Governance, Risk and Compliance - SCN Wiki

Looking forward to your valuable feedback and your experience you have made in your projects. Other approaches can be implemented in this document.

Best regards,

Alessandro

Dear all,

This document contains some of the configuration settings and purpose of use with impact while working in GRC10 Risk Management.

I hope its useful.

1.Maintain configuration for Maintain Entity Role Assignment

SPRO->Governance, Risk and Compliance->General Settings-> Authorizations->Maintain Entity Role Assignment.
Maintain a new entry as:

               Entity: G_AI

               Role: SAP_GRC_FN_ADISSUE_PROCESS

               Unique: Check this checkbox

               Application: Process Control and Risk Management.

Purpose: 1.To avoid the dump ‘The ASSERT condition was violated’ when submitting created issue in risk and opportunity.

                              2.To avoid the dump 'CL_GRFN_ISSUE=================CP' while creating issue in Ad Hoc tasks

2.Filter settings for risk category

          SPRO> Governance, Risk and Compliance >Reporting> Select Report GRRM_R1> for filter ID: RG_T, set value: Pattern match with child

          Purpose: Risk category used as selection field in reports like Survey results for risk survey with risk category and heatmap.risk templates

3.Customizing for Case Management

SPRO (IMG) -> Governance Risk and Compliance -> Process Control -> Cases -> Check Customizing for Case Management.

And activate the Customizing for Case Management

     Purpose: To avoid the exception WDR_ADAPTER_EXCEPTION error when creating response under Response and Enhancement Plan management.

4.Define responses for Policies

          SPRO -> Governance, Risk and Compliance -> Risk Management -> Response and Enhancement Plan -> Responses for Policies

             Purpose: Once a policy is assigned to the risk, then the policy becomes response. From that moment the policy is handled as response.
                      If you open the assigned object, then response UI is opened not policy UI.
                     And the response statuses are Active/Draft not policy statuses.
                     Please note that the policy status is projected into response completeness/effectiveness. So if the policy status is changed, then                     response completeness/effectiveness is changed correspondingly.

5.Maintain Object category

SPRO>Governance, Risk and Compliance -> Risk Management -> Master Data Setup -> Maintain Objective Categories.

Maintain the categories there.

Purpose: we need to make objective categories as active otherwise we cannot find the objective categories in NWBC while creating under master data work center.

6.Configuration of Incident and/or a Loss attributes

SPRO >Governance, Risk and Compliance>Risk Management>Open Incident Loss database

Click the link Maintain Incident and Loss Attributes; Add the attributes as many as wanted and make sure to select the field Attribute Type as Internal Structure and field Attribute Relation as Both (Incident and Loss). The last field you define if you want to see the same attribute as incident and/or Loss.

After that, select each one of the attributes and click the left option Values and add possible values for the same;

Save your changes and move back to the SPRO Menu

Now add the same attributes to one specific Organization Unit

Select the option Assign Incident/Loss Attributes to Organizational Unit

Select the Organization Unit and add the attributes created the steps before, Save

          Purpose: To create Incident reports in NWBC

7.Incident workflow tasks configuration

SPRO>Governance, Risk and Compliance -> General Settings -> Workflow -> Workflow E-mail Notifications -> Maintain Workflow Notifications.
The notification maintenance appears. Select the line for scenario GRCNOTIFICATION.
Run following entry in the left side tree menu Business Scenario -> Filter Basic Data -> Filter Settings.
Add following tasks into the filter TS45607923, TS45607924, TS76300066, TS76300062, TS45607926, TS76300067 and TS76300068.

Purpose: For notification workflows

8.Configuration of Response types

SPRO -> Governance, Risk and Compliance> Risk Management -> Response and Enhancement Plan ->

Maintain Response Types

                         Click on "New Entries" and enter a numeric value for the response type you want to set up.

                          In the second column, enter a descriptive text.

                         Save the entry.

Purpose: 1.To avoid the error Assert Condition was violated in creating any response catalog,

                                            2.Response type drop down list is empty in Response creation screen.

9.Configure the Response purpose texts

          SPRO -> Governance, Risk and Compliance -> Risk Management -> Response and Enhancement Plan

                     ->Maintain Response and Enhancement Plan Purpose

          Purpose: Response purpose texts are empty in response creation screen.

10.Define Activity types

                         SPRO -> Governance, Risk and Compliance -> Risk Management -> Master Data Setup ->

                                        Maintain Activity Types.

Purpose: The Activity Type represents on hierarchy of the activities and used to group similar activity

categories under one activity type in the application.

11.Define Maintain Probability Levels

                         SPRO-> GRC Risk Management -> Risk and Opportunity Analysis -> Maintain Probability Levels

               Purpose: 1.used to select Probability Reduction while creating the risk analysis.

                                2.Risk level cannot be calculated if probability levels are not maintained

12.Activate risk types

               SPRO->Governance, Risk & Compliance-> Master Data Setup-> Activate Risk Type.

                 Select the Active Check box under Risk Type Activation.

                    Purpose: We cannot create Corporate/Operational Risks under Risks tab

                          NWBC>Assessments-> Risk Assessments-> Risks & Opportunities.Select the Risks tab->

                         Create a Risk

Regards

Baithi

Purpose of User Defaults:

When a new user is being created in the target system, all users of that system might require few common user defaults like Logon Language, Time Zone, Decimal Notation, Date Format, Parameters etc. Hence when a user is getting created through GRC, based on the request type these user defaults can be assigned to the users.

By including user defaults as part of request type (mostly New Account), user gets created with required user defaults in the target system.

Important SAP notes regarding User Defaults to refer before configuring User Defaults:

1615552 - GRC 10.0 How to set User Default

1665585 - User Defaults BRF+ rule not working correctly

2020712 - UAM: User group not provisioned after request provisioning

Steps to Implement User Defaults:

Step 1: Maintain “User Defaults “action as part of your Request Type. My Request Type 36 is for “New Account” and I have assigned “User Defaults” as shown below.

SPRO =>Governance, Risk and Compliance =>Access Control =>User Provisioning =>Define Request Type

Step 2: Go to SPRO -> IMG -> GRC -> Access Control -> User Provisioning -> Maintain User Defaults

Define User defaults for different connectors connected to your GRC system. One example as shown below:

You can assign default User Group and default Parameters based on the connector by using options “Set the User Group” and “Set Parameter ID” in the above screen as per your requirement.

Once you define the User Defaults as mentioned above and save it, a unique “Default-Id” gets created as shown below. This is the User Default Id which will be used in BRF+ decision table while configuring User Defaults.

Step 3: Existing BRF+ User Defaults application “GRAC_BRFP_USER_DEFAULTS” provided by SAP will be used during configuration of user defaults.

Copy the Function Id of USER_DEFAULT_FUNCTION from BRF+ application.

Now map the BRF+ Application for user defaults under the IMG configuration shown below:

Go to IMG->Governance, Risk and Compliance->Access Control->Maintain AC Applications and BRFPlus Function Mapping

Step 4: Add Decision Table and Loop expression to BRF+ User Defaults function as shown below:

Decision Table: In the decision table maintain entries as shown below

Loop: For using "System" as one of the fields in setting the conditions for User Defaults, SAP suggested for implementing a LOOP in BRF+ Rule. This might be needed since "System" field is not available under Request Header attributes, rather it is available as Role Attributes which are called as line-item fields while calling the BRF Rule. So, in such cases LOOP is a suggested solution, rather than using the Decision Table directly. Though within the LOOP, we can still call the Decision Table or implement IF/ELSE conditions.

Step 1:

Change the Mode of the BRF+ User Defaults Function from “Functional and Event Mode” to “Event Mode”

Now click on “Assigned Rule sets” tab in Function and click on “Create Ruleset”

Ruleset gets created as shown below. Now click on the Ruleset and navigate to Ruleset screen

Click on “Insert Rule” and select “Create” option as shown below

In the Rules screen, fill in the role description and click on “Add” button and select the options as shown below

Once the above step is completed LOOP is created. Now navigate to LOOP by clicking on LOOP_CONNECTOR_ITEMS and you will see below screen.

Once you click on “Create Rule”, you will get the below screen.

Select the decision table as you want to LOOP on the entries in your decision table. Once done click on “OK” button.

Ruleset: When a Function is in event mode, it looks for additional logic execution depending on the Rule-set defined.

Once all above things are done, activate the Decision table, Loop, Ruleset, Function and Application.

Step 5:  Now Create an Access request to test the User defaults and once the User is created please cross check the User Defaults in SU01 to check if everything is fine. If all the above steps are followed properly, User defaults will get updated properly as below in SU01.

Reference Links: http://wiki.scn.sap.com/wiki/display/GRC/Setting+up+User+Defaults

Access Request Management (ARM) can connect to ABAP-based SAP systems such as SAP ERP (ECC), SAP SCM, SAP CRM, SAP  Business Intelligence (BI) to create users and assign roles with pre-delivered ABAP-based programs. Enabling the same functionality with a Java-based system such as the SAP Enterprise Portal requires a different procedure and separate configuration. To connect to Java-based systems, you use pre-delivered Web services installed on the SAP Enterprise Portal for integration.

A step-by-step guide demonstrates the required configuration to integrate SAP Enterprise Portal with GRC 10.0.

Step 1:-Deploy the AC 10.0 web service and you will find the following in WS Navigaton.

Step 2:-Create a G type SM59 connector. This will connect to the above web service for AUTH extraction and password generation.

Step 3:-Create a G type SM59 connector. This will connect to EP’s SPML interface for PROV.

Step 4:-Maintain the Logical port for WS connector in tx LPCONFIG.

Step 5:-Maintain Connector and Connection Types.

WS will be attached to the LPCONFIG end point SPML1 logical port will be same as Target Connector

Step 6:-Define the EP Group (this will be used in field mapping).

Step 7:-Attach both the connectors (WS and SPML) to AUTH scenario.

Make sure that the following classes are attached to the scenario.

Step 8:-Do same for PROV scenario.

Step 9:- And for ROLMG scenario.

Step 10:-Set as Production system.

Step 11:-Create the group field mapping.

Default connector is the one which will make a runtime call to get the F4 for system field names in figure below.

Define the field mapping for the group applicable to all the system in that group (F4 from default connector)

Define the technical parameter mapping .

Step 12:-Synchronize EP SPML Schema.

Connector is the one for SPML we earlier created

Step 13:-Now sync user, roles, auths from EP.

This is from WS connector.

Step 14:- Deploy GRC Portal Content -add-on portal business package GRC_POR which contains  the GRC Portal UI elements to access the GRC suite.

Step 15:Deploy GRC Portal Plugin(GRCPIEP)(Must for GRC AC)

Step 16:- Set the system Alias for GRC system in SAP Netweaver Enterprise Portal as  follows:

                  SAP-GRC

                  SAP-GRC-AC

                  SAP_GRC(in case of issue-faced by me in SP8)

                  SAP_GRC_AC(in case of issue-faced by me in SP8)

*In case of GRC PC is activated then system alias must be SAP-GRC & SAP-GRC-PC,for GRC RM SAP-GRC & SAP-GRC-RM.

Step 17:-Create a same user both in GRC and EP and assign  following Portal Roles to the user.

                a.GRC Access Control

                b.ERP Common

       Assign Required GRC Roles to the user in the GRC System.

*In case of GRC PC or RM activated  assign GRC SUITE  & ERP COMMON Portal Role to the user,additionally GRC Internal Audit Management if required by the user.

Procedure for creating user in the Portal for  Accessing GRC Roles.

1.Log on as portal user administrator and access the User Administration function.

2.If the user has been created by the User Management Engine (UME) that is connected to the GRC ABAP system, you do not need to create the user in the portal system.

If not, create a new portal user and assign the system to the user in the User Mapping for System Access tab, along with a mapped user ID and password.

3.After creating the user, go to the Assigned Roles tab and assign the role GRC Access Control  to the user who has the power user role SAP_GRAC_FN_ALL in the ABAP system, to enable viewing of all the Work Centers.[Only in case of GRC AC is activated].

Hope this  was useful. Please use the comments section to share your feedback and questions.

Purpose

The purpose of this document is to provide links to the top 10 most viewed SAP KBA's for Governance, Risk and Compliance.(GRC)

Overview

This page will be updated regularly as new documents are published.

Click on the month below to view the publications for each GRC component:

Access Control                                   

   March 2014

   April 2014

   May 2014

   June 2014

   July 2014

   August 2014

   September 2014

   October 2014

   November 2014

   December 2014

Process Control

   April 2014

   May 2014

   June 2014

   July 2014

   August 2014

   September 2014

   October 2014

   November 2014

   December 2014

Risk Management

   April 2014

   May 2014

   June 2014

Please note, in order to view the contents of the Knowledgebase Articles (KBA), you will need to be logged into Service Marketplace.

Dear GRC Community,

as moderator of the GRC space I would like to hand out some general information of what is expected in a good discussion thread. Since I am following most of the threads in the GRC space I can easily identify if the question is going to be answered quickly or if it's going round in circles for several days.

As most of the contributors are volunteers and offer up their free time I would like to decrease the unproductivity and instead pointing the questions to more specific and helpful answers.

Prior to your first posting make sure that you have read and understood the rules of engagement: The SCN Rules of Engagement

The use of the search engine (that can be found on the top right corner) and also Google or any other is well appreciated as most of the content is already available here on SCN or SAP Wiki. To date, almost 12'000 discussions have been started on the GRC space including 400 documents and 180 blogs.

What is the minimum information required?

Please provide the following information in each discussion thread:

• Detailed information on your current release and service pack level. It is enough to mention 10.0/SP12, 10.1/SP3, etc.
• Already implemented SAP notes releated to your issue
• Elaborate your business case (what you are trying to achieve, etc.)

Also never assume that your counterpart has the background information of your project or environment. Hence provide useful information especially when you are not using standard functionalities.

Please note that discussion threads that do not meet the minimum requirements will be rejected by the moderators.

Looking forward to your contribution in the GRC space.

Best regards,

Alessandro

Dear all,

This document gives an overview to create different ways to create risk in Risk Management

We can create risk in risk management in two different ways

1. Risks and Opportunities
2. Activities

Risks and Opportunities

Click on Risk and Opportunities to create risk

Refer my previous blog on how to create risk Creation of Risk in Risk Management GRC V10.0

Click on Activities to create risk from third tab risk and opportunities

Click on Create

To create Activity, we need to maintain activity Categories

Activity Category is configured at Master data

Click on Activity Hierarchy

Click on Create and Provide Details

We need to select Allow Activity Assignment is YES, otherwise we cannot use in Activity

Go to Tabs Risk Classification and Opportunity Classification

Risk Classification and Opportunity Classification will be configured under

Risk classification will be part of Risk Category

Opportunity classification will be part of Opportunity Catalog

Note: Make too sure select Allow Assignment is “YES” and time frames are also important

Now go to Risk Classification and click on Assign to add

Now go to Opportunity Classification and click on Assign to add

Now click on SAVE, Created activity will be available in Activity hierarchy

Now we can use the created activity category in Activity

Provide Name, Select organization unit from F4 list and Select the Activity Category from F4 list (Which is created like above)

Now go to Roles Tab to assign the owners

Roles assignment can be maintained in SPRO

Now select the role and assign the user

Now go to Risks and opportunities,

Refer my previous blog on how to create risk Creation of Risk in Risk Management GRC V10.0

Regards

Baithi