GRC 10.0 Upgrade & Functionality - 4 Questions

[Former Member]

Hi Forum,

We are currently evaluating upgrading to GRC 10.0 from 5.3 and also start using SPM. Currently, we only use RAR. Can you guys help me with following 4 questions?

1. We have a number of different firefighter roles used by different teams and approved by different approvers. Can we have separate requester and approver lists for different firefighter accounts in GRC 10.0 SPM?

2. Do we have to implement GRC 10.0 Portals for SPM approval workflow?

3. We have license for all GRC modules. Does this also include Continuous Transaction Monitoring with Oversight or is a separate license required for this?

4. Does GRC 10.0 support automatic archiving of AC-RAR SoD reports? - When I start a weekly background job, can it be automatically archived into an archive folder of my desigantion?

Thanks so much for your input.

Joerg

[Former Member · Accepted solution]

Hi Joerg,

I will try to answer the first two questions:

1) Yes: For every FireFighter you should define who can request it (requester) and who can approve the request (named in SPM is controller)

2) No: From a technical point of view, Requester can use any method he likes in order to contact with the controller (email, phone call, coffee machine meeting...). Once the controller activates the Firefighter ID for that requester then the FF Id is available for that user.

Best regards,

Félix

Edited by: Felix Granados on Jan 25, 2012 4:10 PM

[Former Member]

Thanks for both posters for their awesome answers. Kudos and hope you continue helping poeple out here. Thanks again so much guys.

[simon_persin4]

hi Joerg

1.Yes, you can have different approvers per firefighter ID and have the requestors assigned to different ones as well.

2.You do not need to install portal but you will need to facilitate some access to the front end components through activating the NWBC Netweaver Business client or using a web browser to view the internet facing services in SICF.

3. I don't believe that your GRC license automatically entitles you to the Oversight product suite as they are still separately marketed, however the GRC Process Controls and Risk Management modules can be included if you have a full enterprise GRC license from SAP.

4. You could certainly manage to archive the reports using standard SAP ABAP functionality (SARA). However, If you mean the standard Batch risk Analysis, then I think you'll find that the offline content is overwritten with the latest and only the summary data is retained in the historical data tables for trend analysis. From an audit perspective, historical detailed data is not partuicularly useful since they are more interested in current exposure. Auto archiving of the SPM logs is available as standard.

Regards,

Simon