Simulation in RAR 5.3

[Former Member]

Hi,

We are on ECC system and I have a requirement to change one of our exisitng roles for ESS (Employeee self service role).

The access that is going to be added into this role is at object level - and it is not linked to any transactions since the access is given in order for users to be able to work from portal - to update Bank details (INfo type 0009).

So I would like to run a simulation in production with the following values at role level , including users:

P_PERNR, auth-M,R,W and Infotype-0009.

Is there a way to run this simulation in RAR? I could figure a way to run simulation only if this was linked to adding a transaction and not object level values.

Regards,

Soumya

[Former Member]

Even though I still do not have a clear answer on whether RAR provides the possiblity for a simualtion to analyse user+role level risks when a new object level value is added in roles, it has given me a work around or a dummy analysis model.

[Former Member]

Hi Soumya,

If there is no transaction code to simulate against, I would suggest copying the role in question in your development/non-prod system, inserting the new auth object and values and then performing a risk analysis against that role (if your GRC system is connected to the Dev/non-prod system).

If the user profiles are replicated in the non-prod system, then you can also simulate the addition of this new role against the users, so you could get an idea of the user level violations that could be introduced (if any) into the system.

Hope that helps.

[Former Member]

Thanks a lot Kaushal.... I could do that, but the only problem is our Qa system is not completely in Syn with production when it comes to end user access.

So the method I have tried right now is something like a dummy set up.. I used transaction code SU3 for the simulation and added the object level values againt this transaction (that way ALL users on the system will come under the analysis as every user on the system has SU3 access). I think logically this should work, but I am keeping this chain open to see if there are any better ways of tackling this situation.

[Former Member]

As long as the risk analysis is taking place at Permission level, that method as a workaround should work in 5.X.