GRC RAR 5.3 - Best approach for implementation

[Former Member]

Dear Experts ,

I would like to understand what is the best approach for implementing RAR ,specially in a case where more than 15000 roles already exist in SAP system .

From my point of view we should start with role clean up activity after mapping to respective business process .And then while deleting or modifing any role we should use RAR for risk analysis .

It woukld be really great ,if you can share your views on the same topic .

Thanks & Regards

Asheesh

[koehntopp]

15000 roles seems like a lot. So, first of all, I would start by questioning the authorization concept. Is your company so big and diverse that this many roles are required, or is this just what it has grown to over the last xx ears?

Then I suggest identifying roles or transactions in roles that have not even been used for a year or more, and weed them out. If you don't do that you'll spent months resolving conflicts that originate in transactions that nobody needs to use anyway.

Then start by defining/activating your most critical risks and try to deal with them (take away access or mitigate). This will help you identify a mitigation or remediation process that actually works.

In an authorization workflow, your goal needs to be to make mitigating risks the exception. If it's the rule it becomes an excercise that nobody takes serious, and you might just as well not do it at all.

Frank.

[Former Member]

Thank you Sahad and Frank ,

Dont you think it would be nice to collect first Business Process master list and then map existing (standard/single roles) to respective Process .

After then we can collect Expired role , Duplicate role ,Unassigned roles and redundant t codes and with approval from respective Business owner we can deleter them.

For rest of the roles we can use RAR for risk analysis and can then follwo normal process of Risk mitigation etc .

Your views are most welcome .

Thanks & Regards

Asheesh

[Former Member]

Hi Asheesh

Mapping can help which roles are really required in the business process and help in deleting the unwanted ones.

Thank you

Sahad

[Former Member]

Hi Ashish

Below are the best practice

1) Identify the risks in the business process

2) upload the identified risks/rules in RAR

3) Clean all single roles so that each single role should not have any risk/violation according to RAR reports

4) later you can go for user remediation

All cleaning activity should be based on RAR reports.

Thank you

Sahad