GRC 10.
0 Continuous Monitoring
SoD Monitoring
Applies to:
GRC 10.0 Continuous Monitoring
Summary
This User Guide provides information about GRC10.0 Continuous Monitoring Segregation of Duty
Integration implementation requirements and configuration instructions.
Author(s):
Daniel Chang
Company:
Team
Governance, Risk, and Compliance
Created on:
10/24/2011
SAP COMMUNITY NETWORK
2012 SAP LABS
SDN - sdn.sap.com | BPX - bpx.sap.com | BOC - boc.sap.com
Document History
Document Version
Date
Description
1.00
11/18/2011
Initial
1.10
10/24/2012
Added notes emphasizing the significance of
the valid from date of data sources and
business rules
SAP COMMUNITY NETWORK
2012 SAP LABS
SDN - sdn.sap.com | BPX - bpx.sap.com | BOC - boc.sap.com
Typographic Conventions
Icons
Type Style
Description
Icon
Example Text
Words or characters quoted
from the screen. These
include field names, screen
titles, pushbuttons labels,
menu names, menu paths,
and menu options.
Description
Caution
Note or Important
Example
Recommendation or Tip
Cross-references to other
documentation
Example text
Emphasized words or
phrases in body text, graphic
titles, and table titles
Example text
File and directory names and
their paths, messages,
names of variables and
parameters, source text, and
names of installation,
upgrade and database tools.
Example text
User entry texts. These are
words or characters that you
enter in the system exactly as
they appear in the
documentation.
<Example
text>
Variable user entry. Angle
brackets indicate that you
replace these words and
characters with appropriate
entries to make entries in the
system.
EXAMPLE TEXT
Keys on the keyboard, for
example, F2 or ENTER.
SAP COMMUNITY NETWORK
2012 SAP LABS
SDN - sdn.sap.com | BPX - bpx.sap.com | BOC - boc.sap.com
Table of Contents
1.
Business Scenario............................................................................................................... 1
2.
Background Information ..................................................................................................... 1
3.
Prerequisites ........................................................................................................................ 1
3.1
3.2
3.3
4.
System Requirements .................................................................................................. 1
SAP GRC Access Control 10 SoD has been configured. ................................ 1
SAP GRC Access Control 10.0 (AC) and SAP GRC Process Control (PC)
10.0 have been installed on the same system................................................. 1
The SoD input parameters have been recorded. ............................................ 1
Master Data Requirements ........................................................................................... 1
Regulation(s) have been created and configured ............................................ 1
Corporation and organizational units have been created. ............................... 1
Central process/subprocess/controls have been created. ............................... 1
Corresponding regulation(s) have been assigned to the control. .................... 1
Subprocess/controls have been assigned to either the corporation or
organizational unit. ........................................................................................... 1
Activate AC and PC applications .................................................................................. 2
Step-by-Step Procedure ...................................................................................................... 4
4.1
Review Master Data ..................................................................................................... 4
4.2
Create Data Source for SOD Integration ...................................................................... 7
4.3
Create Business Rule for SoD Integration ................................................................... 9
4.4
Relationship between Data Source and Business Rule ............................................. 18
4.5
Assign Business Rule to Controls .............................................................................. 19
4.6
Create a Job in Automated Monitoring ....................................................................... 22
4.7
View Job Step result for SoD Integration in Job Monitor ............................................ 26
5.
Comments and Feedback ................................................................................................. 29
6.
Copyright ............................................................................................................................ 31
SAP COMMUNITY NETWORK
2012 SAP LABS
SDN - sdn.sap.com | BPX - bpx.sap.com | BOC - boc.sap.com
GRC 10.0 Continuous Monitoring
1.
Business Scenario
The following sections describe the implementation requirements and configuration instructions for the
Segregation of Duty (SoD) monitoring feature of Continuous Monitoring for Process Control (PC)10.0.
SoD Continuous Monitoring enables management to continually review business processes for
adherence to, and deviations from, the appropriate level of checks and balances upon the activities of
individuals with their intended levels of performance and effectiveness.
2.
Background Information
SoD monitoring is a key feature in Continuous Monitoring. It enables you to monitor a specific SoD to
address issues as they occur.
3.
Prerequisites
Verify that the following prerequisites have been met before implementation and configuration of SoD
monitoring.
3.1
System Requirements
SAP GRC Access Control 10.0 SoD has been configured.
SAP GRC Access Control 10.0 (AC) and SAP GRC PC 10.0 have been installed on the same
system.
AC 10.0 and PC 10.0 are based on the SAP NetWeaver 7.02 SP 6 (or above ) ABAP stack .
3.2
SoD input parameters have been recorded.
Master Data Requirements
Regulation(s) have been created and configured
Corporation and organizational units have been created.
Central process/subprocess/controls have been created.
Corresponding regulation(s) have been assigned to the control.
Subprocess/controls have been assigned to either the corporation or organizational unit.
See the SAP Process Control Master Data Guide for specific master data information.
October 2012
GRC 10.0 Continuous Monitoring
3.3
Activate AC and PC applications
Complete the following steps to activate AC and PC applications.
To configure AC and PC applications:
1. Access IMG and select Activate Applications in Client.
October 2012
GRC 10.0 Continuous Monitoring
2. Select Active for the applications listed on the Active Applications In Client list that you want to
use.
October 2012
GRC 10.0 Continuous Monitoring
4.
Step-by-Step Implementation Procedure
Complete the following sections to implement SoD Continuous Monitoring.
4.1
Review Master Data
This section describes how to review your Master Data.
1. Select Master Data from the main Process Control Work Center menu.
2. Verify that the supplied default example Corporate Wind Wagon Corporation has been
created.
3. Verify that Regulation Foreign Corrupt Practices Act has been created and assigned to a
related control.
4. Verify that the subprocess, Vendor Selection, and the control, Segregation of duties
(Automated), have been created, and assigned to corporate.
October 2012
GRC 10.0 Continuous Monitoring
5. Review the Organizations screen to verify that the organizational hierarchy is displayed
correctly.
Select the Wind Wagon Corporation example.
6. The Organization: Wind Wagon Corporation screen appears.
Review the Vendor Selection subprocess assignment and verify its configuration.
October 2012
GRC 10.0 Continuous Monitoring
7. Review the Control:Segregation of duties (Automated) screen to verify settings and assignments
are correct.
8. Review the Control: Segregation of duties (Automated) screen to verify that the correct regulations
are in place.
October 2012
GRC 10.0 Continuous Monitoring
4.2
Create Data Source for SOD Integration
This section describes how to create the data source for SOD integration.
1. Navigate to Rule Setup Continuous Monitoring Data Source.
Click Create.
2. On the General tab input the Data Source name and set In Review to Status.
NOTE
Ensure that the Valid From date is correct. We recommend that you set it as the valid from date
of the master data.
3. On the Object Field tab, select SoD Integration for the Sub-scenario.
Click Save.
October 2012
GRC 10.0 Continuous Monitoring
4. Set the new data source as Active.
a) Select the created data source.
b) Click Open.
c) On the General tab, set Active for the Status.
d) Click Save.
e) Select and review the data shown on the Object Field tab of the data source.
October 2012
GRC 10.0 Continuous Monitoring
4.3
Create Business Rule for SoD Integration
This section describes how to create a business rule for SoD integration.
1. Navigate to Rule Setup Continuous Monitoring Business Rules.
Click Create.
2. In the start window, select Search Data Source and complete the following:
a) Set SoD Integration in the Sub-scenario field.
b) Search for and select the data source you just created (see Section 4.2, Create Data Source
for SOD Integration).
c) Click Start.
3. Input information into the following fields:
Name: the name of the business rule.
Description: a brief description of the business rule.
Valid from: the start date for use of the business rule.
NOTE
Ensure that the Valid From date is correct. We recommend that you set it as the valid from
date of the master data.
Valid to: the end date for use of the business rule.
Analysis Type: categorize the business rule analysis type using the field drop-down menu.
Deficiency Type: categorize the business rule deficiency type using the field drop-down menu.
October 2012
GRC 10.0 Continuous Monitoring
4. Set to In Review in the Status field.
a) For the business rule Filter Criteria, set the Filter Value for each Filter Field.
NOTE
The filter values are the input parameters for the SoD Engine.
b) Select the Report Type Table.
The required values for Object Range Table, Report Type Table, System Range Table, and
Object Type are selected and indicated by the green check arrows.
October 2012
10
GRC 10.0 Continuous Monitoring
c) Other optional values for Filter Fields include :
Business Process Range
User Group Range Table
Org Rule ID Range
Risk ID Range Table
Risk Level Range
Rule Set ID Range
User Group Range Table
User Type
Analysis Mode
Language
Offline Analysis
Report Format
Role Type for Risk Analysis
Simulation Risk Only
Use Simulation Risk Only
d) Valid values for the Report Type Table include the following:
01 = Action Level
02 = Permission Level
03 = Critical Action
04 = Critical Permission
05 = Critical Role/Profile
06 = Analytical Report
07 = Mitigating Controls
08 = Invalid Mitigating Controls
09 = Alerts
10 = Access Risk Assessment
21 = SoD Reports
22 = ERM Role
30 = Role
31 = User
32 = Profile
33 = User Org
34 = Role Org
35 = HR Object
October 2012
11
GRC 10.0 Continuous Monitoring
e) Select the Sample Filter Values on the Object Range Table.
October 2012
12
GRC 10.0 Continuous Monitoring
f)
Select the System RangeTable.
Enter valid input values for the System Range Table selection.
The system name and range values are defined in the customizing task (IMG) Integration
Framework.
October 2012
13
GRC 10.0 Continuous Monitoring
g) Select the Object Type on the filter field.
The following lists indicate valid values for select filter fields.
October 2012
Valid values for Object Type include the following:
o 1 = User
o 2 = Role
o 3 = Profile
o 4 = HR Object Job
o 5 = HR Object - Org Unit
o 6 = HR Object Position
o 7 = Action
o 8 = User Org
o 9 = Role Org
o 10 = User Group
o 11 = Org Unit
Risk Level Range: because risk level can be customized, verify that you are using
the correct value for grcrisklevel.
Valid values for User Type include the following:
o 0 = All
o A = Dialog
o B = System
o C = Communication
o L = Reference
o S = Service
14
GRC 10.0 Continuous Monitoring
Valid values for Analysis Mode include the following:
o 1 = Ad Hoc Foreground
o 2 = Ad Hoc Background
o 3 = Batch
Valid values for Offline analysis include the following:
o X True (selected)
o False
Valid values for Report Format include the following:
o 1 = Summary
o 2 = Detail
o 3 = Management Summary
o 4 = Executive Summary
Valid values for Role Type include the following:
o 1 = Technical Role
o 2 = Business Role
o 3 = CUA Role
Valid values for Simulation Risk Only include the following:
o X True (selected)
o False
Valid values for Use simulation authorization only include the following:
o X True (selected)
o False
Dyanmic query data values are available for the following:
Business Process Range
Org Rule ID Range
User Group Range
Object Range
Risk ID Range
Rule Set ID Range
System Range Table
User Group Range Table
NOTE
For the query data values, check the Access Risk Analysis User/Role/Profile/HR
Object analysis search screen to find the value.
October 2012
15
GRC 10.0 Continuous Monitoring
h) For the Technical Settings selection, the Max. No of Records to Analyze field can be modified
by selecting the field and entering the number of records to analyze.
i)
You can attach files or add pertinent hyperlink URLs to the business rule object by clicking
Add.
Select Save to save the Business Rule.
October 2012
16
GRC 10.0 Continuous Monitoring
j)
Open the created business rule for further editing by clicking Change This Business Rule.
Set the new business rule status to Active.
k) Select the newly created business rule.
i. Click Open.
ii. On the Basic Information tab, select Active for the Status field.
iii. Click Save.
October 2012
17
GRC 10.0 Continuous Monitoring
4.4
Relationship between Data Source and Business
Rule
The following section describes the relationship between the data source and the business rule.
The data source is only of significance if a business rule is defined for it.
To verify the relationship between the data source and business rule:
1. Open the data source you have created (see Section 4.2, Create Data Source for SOD
Integration).
2. Select the Business Rule tab.
3. Verify that all the business rules based on the data source are listed.
October 2012
18
GRC 10.0 Continuous Monitoring
4.5
Assign Business Rule to Controls
This section describes how to assign a Business Rule to Control.
1. Navigate to Rule Setup Continuous Monitoring Business Rule Assignment.
2. Select the Organization Via Value help.
Click Search.
3. Select the Control, Segregation of duties (Automated).
Click Modify.
The Business Rules section is now in the edit mode.
a) Click Add and select the Business Rule you have created (see Section 4.3, Create
Business Rule for SoD Integration).
b) Click Maintain Frequencies.
c) Select Monitoring and Compliance for Any Frequency.
d) Click Save.
The Common Business Rules tab indicates that the displayed data can be shared by the
regulations of this control.
October 2012
19
GRC 10.0 Continuous Monitoring
4. The Regulation-Specific Business Rules tab indicates whether you can set one regulation to
use either its own specific business rules or commonly used business rules.
5. Verify the relationship between the control and the business rule, Control Object View by
completing the following steps:
a) Open the Control Object.
b) Go to the Business Rules tab of the control.
c) Verify that all of the business rules have been assigned to this control.
October 2012
20
GRC 10.0 Continuous Monitoring
5. Verify the relationship between Control and Business Rule, Business Rule Object View by
performing the following steps:
a) Open the Business Rule Object.
b) Go to the Controls tab of the Business Rule Object.
c) Verify and view all of assigned controls with the selected Business Rule.
October 2012
21
GRC 10.0 Continuous Monitoring
4.6
Create a Job in Automated Monitoring
This section describes how to create a job in Automated Monitoring.
1. Navigate to Rule Setup Scheduling Automated Monitoring.
a) Select Create Job.
b) Select Automated Monitoring Job for Job Type.
c) Click Start.
2. Enter the following required information into the displayed fields:
Job Type: type of job
Job name: the name of your job
Execution Type: select from the drop down list of types
Frequency: select from the drop down list of frequency
Test Period From: the start of the test period
Test Period To: the end of the test period
October 2012
22
GRC 10.0 Continuous Monitoring
3. Select the type of Regulation from the drop down list.
4. Search and select the control Segregation of duties (Automated).
Click Save.
October 2012
23
GRC 10.0 Continuous Monitoring
5. Verify the Selected Controls details.
9. After you have clicked the Save button, you can review the created Job Steps in the
Automated Monitoring Jobs list as shown in the following screen shot.
October 2012
24
GRC 10.0 Continuous Monitoring
10. You can also review the job step execution detail by selecting the Job Step Log.
October 2012
25
GRC 10.0 Continuous Monitoring
4.7
View a Job Step result for SoD Integration in the
Job Monitor
This section describes how to view a job step result for SoD Integration in the job monitor.
1. Navigate to Rule Setup Scheduling Job Monitor.
a. Input the Search Criteria data.
b. Set the SOD* for Job Name, Set Execution Date From, and Set Execution Date To.
c.
Click Search.
2. Select the Job Step created for SoD Integration.
3. Select the View Results button to review the SoD analysis result.
4. Select Business Rule.
The business rule detailed information window is displayed.
October 2012
26
GRC 10.0 Continuous Monitoring
5. Select the hyperlink in the Control and Issue Priority column to review the control and issue
details.
6. The details of the control are shown on the next screen.
October 2012
27
GRC 10.0 Continuous Monitoring
7. The Issues detail is shown as in the following screen:
8. Click the Business Rules button.
The following screen shows the details for the business rule.
October 2012
28
GRC 10.0 Continuous Monitoring
5.
Comments and Feedback
Your feedback is very valuable and will enable us to improve our documents. Please take a few
moments to complete our feedback form. Any information you submit will be kept confidential.
You can access the feedback form at:
http://www.surveymonkey.com/s.aspx?sm=stdoYUlaABrbKUBpE95Y9g_3d_3d
October 2012
29
GRC 10.0 Continuous Monitoring
6. Copyright
2011 SAP AG. All rights reserved.
No part of this publication may be reproduced or transmitted in any form or for any purpose without the express permission of
SAP AG. The information contained herein may be changed without prior notice.
Some software products marketed by SAP AG and its distributors contain proprietary software components of other software
vendors.
Microsoft, Windows, Outlook, and PowerPoint are registered trademarks of Microsoft Corporation.
IBM, DB2, DB2 Universal Database, OS/2, Parallel Sysplex, MVS/ESA, AIX, S/390, AS/400, OS/390, OS/400, iSeries, pSeries,
xSeries, zSeries, System i, System i5, System p, System p5, System x, System z, System z9, z/OS, AFP, Intelligent Miner,
WebSphere, Netfinity, Tivoli, Informix, i5/OS, POWER, POWER5, POWER5+, OpenPower and PowerPC are trademarks or
registered trademarks of IBM Corporation.
Adobe, the Adobe logo, Acrobat, PostScript, and Reader are either trademarks or registered trademarks of Adobe Systems
Incorporated in the United States and/or other countries.
Oracle is a registered trademark of Oracle Corporation.
UNIX, X/Open, OSF/1, and Motif are registered trademarks of the Open Group.
Citrix, ICA, Program Neighborhood, MetaFrame, WinFrame, VideoFrame, and MultiWin are trademarks or registered
trademarks of Citrix Systems, Inc.
HTML, XML, XHTML and W3C are trademarks or registered trademarks of W3C, World Wide Web Consortium,
Massachusetts Institute of Technology.
Java is a registered trademark of Sun Microsystems, Inc.
JavaScript is a registered trademark of Sun Microsystems, Inc., used under license for technology invented and implemented by
Netscape.
MaxDB is a trademark of MySQL AB, Sweden.
SAP, R/3, mySAP, mySAP.com, xApps, xApp, SAP NetWeaver, and other SAP products and services mentioned herein as well
as their respective logos are trademarks or registered trademarks of SAP AG in Germany and in several other countries all over
the world. All other product and service names mentioned are the trademarks of their respective companies. Data contained in
this document serves informational purposes only. National product specifications may vary.
These materials are subject to change without notice. These materials are provided by SAP AG and its affiliated companies
("SAP Group") for informational purposes only, without representation or warranty of any kind, and SAP Group shall not be
liable for errors or omissions with respect to the materials. The only warranties for SAP Group products and services are those
that are set forth in the express warranty statements accompanying such products and services, if any. Nothing herein should
be construed as constituting an additional warranty.
These materials are provided as is without a warranty of any kind, either express or implied, including but not limited to, the
implied warranties of merchantability, fitness for a particular purpose, or non-infringement.
SAP shall not be liable for damages of any kind including without limitation direct, special, indirect, or consequential damages
that may result from the use of these materials.
SAP does not warrant the accuracy or completeness of the information, text, graphics, links or other items contained within
these materials. SAP has no control over the information that you may access through the use of hot links contained in these
materials and does not endorse your use of third party web pages nor provide any warranty whatsoever relating to third party
web pages.
Any software coding and/or code lines/strings (Code) included in this documentation are only examples and are not intended
to be used in a productive system environment. The Code is only intended better explain and visualize the syntax and phrasing
rules of certain coding. SAP does not warrant the correctness and completeness of the Code given herein, and SAP shall not be
liable for errors or damages caused by the usage of the Code, except if such damages were caused by SAP intentionally or
grossly negligent.
GRC 10.0 Continuous Monitoring
