Cross system risks in standard ruleset

[Former Member]

Hi,

I am looking at SRM risks in the standard 5.3 ruleset. I notice that there are cross system risks e.g. Risk E007 consists of conflicting functions MM01, MM02 (R/3) and SR02 (SRM).

I have setup R/3 as a logical system and SRM as a seperate logical system. When I run the risk analysis it does not show any conflicts for risk E007 even though I know that there is a user in R/3 with transaction codes in function mm01 & mm02 and that same user also has transaction codes from SR02 in the SRM system.

Do I need to set these up specifically as cross system risks- is this why they don't show up in the reports?

Thanks,

Niamh

[Former Member]

Hello Niamh,

Firtly, you will have to modify the risk as cross system specifically. You will have to modify the enabling functions and set the scope of them as cross system (in addition to specifying the transaction codes + specific system from where these codes come from) in the functions. Then you will have to create a logical system in Configuration and include all the systems which would be part of this cross system. Since you have R/3 and SRM set up in different logical systems then the cross system risk analysis should work for you once you have done the above. Here are summry of steps you need to follow:

1. Create a cross system in configuration and then include all the physical systems which would be part of the same (R/3 and SRM in your case)

2. then you will have to change the scope of the enabling functions for the risk to cross system and then include the transaction from different systems into the functions.

3. You will have to generate the risks again and to generate the cross system rules.

4. After that run the risk anlaysis against the cross system that you created earlier.

I hope it helps. There are some very good SAP Notes available on SAP help portal regarding cross sytem and logical systems. I believe you should check them out. Search with the keywork "Cross System" and component GRC-SAC*

Regards, varun

[Former Member]

Hi Thakur,

thank you for the advice. I have looked up some SAP notes also. One thing that is not clear to me is - do I need seperate functions for cross system risks.

Example the function MM07 from R/3 is used in a cross system risk with SRM, but it is also in other risks that are not cross system.

I am wondering can I use the same function for cross system and non cross system analysis or is it better to create a new function for the cross system analysis?

Thanks,

Niamh

[Former Member]

Hello Niamh,

At the moment a function can have scope as either single system or cross system. If you set the scope to be cross system then that function will not work for single system analysis. I suggest you create separate functions for the same. This is what i am planning to do for a client. Since scope is the basis on which system generates rule, you can not have dual scope for a function at the same time. Creating separate functions would be better idea as in long run it will give you more flexibility and it will be easy to manage..

Regards, Varun

[Former Member]

Thanks Varun,

I will give it a try.

Regards,

Niamh