Standard roles?

[Former Member]

Hi all,

What are pros and cons of using SAP Standard roles?.

Will we upload the roles in GRC tool or the system automatically recognizes the roles once the system is connected to particular application(R/3,CRM).

Swathi

[Former Member]

Hi Swathi,

I think SAP has provided the Standard roles as templates which need to be tailored to meet the requirements for your Company.

It is not recommendable to use them directly and talk to your Security team who will work on drafting new roles based on the requirements.

Make sure that you properly segregate the tcodes when creating the new roles as some SAP standard roles may contain SoD conflicts.

I dont think you upload the roles into SAP GRC, you rather upload the GRC rulesets applicable for SoD conflict management for all the roles and users in the SAP System.

Hope this helps.

Regards,

Kiran Kandepalli.

[Former Member]

We have reports like

RSUSR005 - List of users with critical auth

RSUSR008 - By critical combination of auth at transaction start

then what is the use of GRC tool???

swathi

[Former Member]

GRC tools are one way of automating some controls. They offer more functionality and greater ease of use than the standard tools do.

They certainly aren't needed but they do have benefits in some situations. Segregation of duties analysis is easier than doing it manually or configuring RSUSR008_009_NEW

GRC as a subject (rather than a product) can be managed in many ways, including using pre-existing SAP tools.

[Former Member]

Hi K s,

GRC can be utilized in many ways.

Best justification is your organization risk strategy.

It can be usefull in many situation. There is cost involved, I often seen organization justifies cost against the security policies and prevention, protection strategies. It also depends on your company's goal that which product that you would use.

SAP has standard reports which can also serve the same purpose however this tools would facilitate you to achieve more efficiently.

[Former Member]

Hi Swathi,

SAP GRC is a very broad SoD tool that is intended to establish the following in the SAP and non SAP Systems in the Organization:

Access Controls

Process Controls

Risk Management

Global Trade Management

Implementing Green Practices(Making your company Environmental friendly)

and other areas where there is Social and Corporate responsibility

I think what you are talking is only from the Access Controls perspective and it is only one of the applications to deal with and SAP GRC does give outstanding solutions available with the latest version 5.3 in the following:

Risk Analysis and Remediation

Enterprise Role Management

Compliant User Provisioning

Super User Privilege Management

So SAP GRC applications has so much breadth and width that it extends to all directions of Corporate Governance and Risk Management and you can't acheive with a few reports in SAP.

Regards,

Kiran Kandepalli.