How to find Invalid Mitigating Controls for users in GRC CC 4.0?

[Former Member]

Hi,

We have Compliance Calibrator 4.0 and for some users we have assigned some controls long time back. But due to role changes to users or txn removal from roles, there are some invalid Mitigating controls which are not necessary for them.

Is there any report to find out easily what invalid controls exists for users? I dont need if there are expired controls, but I only need which Mitigating controls are not necessary for that user.

Please help.

Thanks,

Hari.

[hkaur · Accepted solution]

Hi Hari,

The report for Invalid Mitigation Controls can be found in the Utilities Menu of CC 4.0. You will need to specify the Validation Date for the Mitigation Controls. So, any Mitigation Controls expiring before this date are included in the report. The generated report lists the invalid Mitigation Control records from the Mitigated User table based on the specified date.

A job needs to be run to retrieve this data.

Hope this answers your query.

Regards

Harleen

SAP GRC RIG

[Former Member · Accepted solution]

Hi Harleen

Thanks for your response. It shows the list of expire controls and what I need is only the controls which exists even if the risk is removed.

Matt's answer is little complex but will do the job.

Hari.

[Former Member]

Hi Hari:

I'm not aware of a report, but I would take table /VIRSA/ZMITCNTL and a violation report and put them into MS Access and run a query. Entries that exist in /VIRSA/ZMITCNTL and don't have matching violations can be disabled (they're orphaned or unnecessary mitigating control entries).

I hope this helps.

Matt

[Former Member]

Thanks a lot Matt.