Query on Mitigation Control

[Former Member]

Hi all,

We have configured Mitigation Controls and mitigated some of the users. We have the following queries in this regard:

a) When we run the SoD anlaysis for that particular user we could able to see only half description of the Mitigation Control.

Is there any limitation for the space or the parameters for the Mitigation Control Description.We are unable to see the entire description of the Mitigation Control (If the mitigation control is more than 7-8 lines) in the Detailed Report screen as well. Even after downloading into a spreadsheet also we are getting only the part of the mitigation control and not the entire description of the mitigation control

b) A risk ID can be addressed by 2 or 3 mitigation controls. In this scenario,we have assigned 2-3 mitigation controls to one Mitigated user for mitigation. When we run SoD analysis we could able to see only the latest mitigation control assigned to the user in the report format (say out of 3 assigned only the 3rd one assigned is being shown).

But when we did a search for Mitigation controls with the Risk ID & User ID combination then it is throwing all the 3 mitigation controls. But the same is not shown in SoD violations reports

Is there anything to do with the parameters set up or at the configuration side to resolve this.

Please provide the procedure also in case of any changes to be made at configuration level.

Thanks and Best Regards,

Sri

[Former Member]

Thanks

[Former Member]

Hi Sri,

One point needs to clarify that the table which contains the description is not VIRSA_CC_MIREFT.

The correct table name is VIRSA_CC_MITREFT.

This VIRSA_CC_MITRISK table contains risk ids for each mitigation control.

[Former Member]

Hi Vit,

Thanks for your reply. We crosschecked and you are correct that the space limitation is only for 132 characters in this table.

Is there a way to get the mitigation control whole description or do we need to stick to this limitation itself.

Also, when we did a search for Mitigation Control it gives only Mit.ID, Mit Control Desc, BU and Management approver. Whether there are any tables (from SAP Backend) or reports where we can get the Risk Ids including the above addressed by the mitigation controls.

Thanks and Best Regards,

Sri

[Former Member]

Hi Sri,

a) AC 5.3 Mitigation description is defined in table VIRSA_CC_MIREFT and is limited to 132 characters.

Kind regards,

Vit