CC / RAR Rule Set Build

[Former Member]

We had a rule set built in Compliance Calibrator 5.2 by a vendor during implementation. We have over 700 rules and now know that there are too many rules in our rule set.

Can any of you tell me the best way to build a rule set? How many rules do most people have in their rule set? Is there a best practice out there somewhere to do this?

[Former Member · Accepted solution]

Hi Greg,

You will have to understand relationship between rule, risk, business process, function, transaction and permission to build a rule from scratch. If you need to build one or two rules, you can just go through CC and do it. If you want to build large set of rules then you will have to create text files for risks, functions, rules etc. I will recommend you go through the config guide for CC 5.2 or 5.3 and see how rules are being built.

There is no straight answer on the number of rules. The number rules you need will depend on industry, company size, location, rules and regulations to follow, company structure etc. Best practice rules come with the installation and you can always get them from SAP. Best practice ruleset contains around 40,000 action and permission rules.

Regards,

Alpesh

SAP GRC Manager (PwC)

[Former Member]

You are welcome, Greg.

You can find details about all the text files in the Appendix A section of the AC 5.3 config guide.

Here is the link to the AC 5.3 guides. Go to Page # 310 of the configuration guide.

https://websmp101.sap-ag.de/~form/sapnet?_FRAME=OBJECT&_HIER_KEY=501100035870000015092&_HIER_KEY=601...

Regards,

Alpesh

[Former Member]

OSS Note 986996 is very helpful.

Thanks!!