RAR 5.3 : Running Risk Analysis for Critical Actions at object level

[Former Member]

Hi experts,

I am pretty new to GRC. I have been doing some research around Critical Actions in RAR 5.3. Per my understanding when i run critical actions analysis on a user/role, it will return violations irregardless what object level permission it has.

However, when i look at the rule architect for the critical action risks, they are referenced to functions that define those critical actions to an object level. However, when i run the risk analysis for critical actions, they will not reference those object levels.

Is there a way to enable Critical Actions Risk Analysis to analyze to an object level? Or is Critical Actions Risk Analysis just that, analysis only at the Actions level, nothing more (which for my company makes not much sense as we do not view display access for all critical actions as risks)

[Former Member · Accepted solution]

When you run the Risk analysis, click the "Detailed report" view (the Magnifying glass). This will show the permissions identified within the results for Critical Actions. To me, this looks like Critical Action Analysis looks down to Object level permissions by default.

From what information I have gathered, Critical permissions works with no Actions/Transactions being attached to the permissions, therefore Critical Permissions work independant of what the Transactoin code is.

There is a SAP Note for this [https://service.sap.com/sap/support/notes/1225227], which describes how to define Critical Permissions (meaning no dependence on what Tcodes the permissions are attached to).

Regards

Edited by: Kaushal Vastani on Jul 16, 2009 1:51 PM

[Former Member]

Hi,

Critical action by default analyzes all the objects which are related to transaction.

When you check the rules of Critical Action, it should display the TCODE along with the permissions in active mode. If this is displayed then all these values will be checked when you run the Critical action report.

Regards,

Shweta