GRC AC 5.3 RAR Violation duplications

[Former Member]

Hi SAP Experts.

I have a doubt related with Management View reports.

Imagine a case in that one single user has 4 derived roles for two different SoD functions like these:

- Function A

     Role 1 derived for Society X

     Role 2 derived for Society Y

- Function B

     Role 1 derived for Society X 

     Role 2 derived for Society Y

In addition, there is a Risk R1 between these functions(Function A & Function B).

My doubt is if I go to the Risk Violations report if I select the option "count by Risk" the user will be counted only one time for the risk R1, but if I select the option "counted by permission" it will appear 4 violations due to the different combinations of the Authorization objects for each society. Is that true?

Thanks in advance.

Regards.

[Former Member · Accepted solution]

Yes Chemi, it should show like that.

Regards,

Sabita

[Former Member · Accepted solution]

Hi Sabita.

Thaks a lot for your answer. It was really helpful.

Do you know any SAP Note that explain that situation?

Thanks in advance.

Regards.

[neerajmanocha · Accepted solution]

Yes, Chemi. We do have SAP Note for this.

Refer to SAP Note 1179717, below section.

"

o  Total Number of Violations - This number is dependent on what you
   choose under "Violation Count By".

   -  If you choose Violation count by Risk, it will only count a
      violation once within each 4 digit risk ID.

   -  If you choose Violation Count by Permission, it will show the
      number of total violations down to the 9 digit rule ID.

      For example:

      User Jayne Doe has the following conflicts:

      P00100001 - Transaction F-04 and FK01

      P00100002 - Transaction F-04 and FK02

      P00200001 - Transaction F-04 and MIGO

      If you choose Risk Violation Count by Risk, it will show 2
      violations (risk P001 and P002), where if you choose Risk
      Violation Count by Permission, it will show 3 (P00100001,
      P00100002 and P00200001).

"

SAP Note 1179717 - "Risk Analysis and Remediation - Management Reports"

Thanks & Regards

Neeraj