Risk Terminator: Anyone using it?

[Former Member]

Hi,

I would like to find out how many of you are currently using Risk Terminator in R/3 for risk analysis when defining roles in PFCG.

Many thanks in advance. Best regards,

Imanol

[Former Member · Accepted solution]

Hi Imanol,

Many of the clients for whom I worked, have RT enabled. As highlighted in few of the responses, it is easy to track the risks while generating the roles, or assigning roles to the users.

I would definitely vote for it since, RT is a pro-active way of identifying the risks. When the options are set to stop generating or assigning, when there are risks, RT will not allow to proceed further which is almost closing any deviations.

However, if you have ERM and CUP tools used in your environment, then probably RT might not be required.

Rgds.

Raghu

[koehntopp]

Lots of my customers are using it. It's a great way to avoid changes in PFCG introducing risks into single roles without going all the way to ERM.

Frank.

[Former Member]

Hi Frank

We hada demo at my previous client's premises via webex and we weren't convinced of its merits but that may have been due to our way of working.

I have to admit to never using it in anger (mostly angry using SAP but there you go) but it appeared to allow users to propose the creation of single roles which would be SoD/critical compliant/mitigated.

I can see that giving only a few users access to this so that a standard way of working and vetting requests might work but, in the version we had, that also meant they had to have access to PFCG in R3 too...that was going to be fixed in a later release?

Very true about the green flag/red flag check whilst still in the Java side of things but wouldn't the workload change for the security dept. in that they were constantly vetting 'instant' requests for new or changed roles instead of the requests going through a proper CAB meeting approval before creation anyway?

Still not convinced that this element really can be more efficient especially if not controlled but the SoD quick check would save time doing a simulation in RAR after the role has been created in PCFCg via R3 but then you can always delete/start again or mode the role based on the results.

Saying that - isn't GRC going back to the ABAP stack in the AC10 release? How would that affect the role requests?

Sorry for more questions and no answers!

Cheers

David

[Former Member]

Imanol,

Per my knowledge, many SAP GRC customers are using Risk Terminator.

It is more easy to use with CC 4.0. with 5.x lot of settings are required.

Yes many GRC customers are using it.

regards,

Surpreet

[Former Member]

Hi

Nope! (Thing of evil that it is)

Cheers

David