AC10: can't create mitigating control in workflow

[Former Member]

Hi

I am not able to create a mitigating control in AC 10.  I have also enabled Mitigating Control Maintenance parameter 1061 to "YES".

I have enabled the default workflow for this SAP_GRAC_CONTROL_MAINT.

We are able to see the request for the approval of the control in the workflow inbox of the MC Owner but on approval the control is not available in the list of mitigating controls.  Can anyone please assist.

[Former Member · Accepted solution]

Hi,

An issue similar to this was reported to SAP and it has been fixed.The code correction's are documented in the note no

1733419:- Mitigation control not created or updated if workflow is on

But  this is not yet released for the customer it is still in process and as per the responsible person it will be released soon.

The tentative date for the release is set as 25/6/12.

Thanks and regards

Japneet Singh

[Former Member · Accepted solution]

Thanks Japneet

Highly appreciated for the feedback.  I will check for the Note next week.

Regards

Don

[Former Member · Accepted solution]

HI ,

The note has been released for the customer ,you can impliment the note and see how it goes .

Thanks and Regards

Japneet Singh

[Former Member]

Hi,

Has the problem been resolved,Please update.

Thanks

Japneet

[Former Member]

Hi Japneet

Implementing the note has resolved the issue with the workflow in mitigating controls which is now creating them.

Now however, we have a related issue.  We need to implement 2-stage workflow for the approval of mitigating control, however the mitigating control is created as soon as 1st approval is done. 

1st stage -> mitigating control owner approval

2nd stage -> internal audit approval (PFCG group)

The control however is created after 1st approval from mitigating control even though the workflow correctly goes to the 2nd stage after the 1st approval.  How can this be happening?

Regards

Donald

[Former Member]

Further to this, I enabled MSMP debugging and got the details from the log file as below, which is showing an extract.

The thing I can see is that there is an message on the creation of the controls that says "Control is locked by user MC_OWNER", MC_OWNER would be the mitigating control owner.  Is this a standard message or could it be part of the problem?

Still don't know how to resolve it though

1. 20120621195119.9381730 :005056BC28ED1EE1AEFB4D0B4314DE1E:GRAC_DEFAULT_PATH:20120621195053.5972950 :002:00001:TS76308031::WF-BATCH:MSMP/GRAC_DEFAULT_PATH/20120621195053.5972950:MSMP_TECH:146:GRFNMW:End of path reached (instance 005056BC28ED1EE1AEFB4D0B4314DE1E, path: GRAC_DEFAULT_PATH/20.120.621.195.053,5972950); calling exit
2. 20120621195119.9406550 :005056BC28ED1EE1AEFB4D0B4314DE1E:GRAC_DEFAULT_PATH:20120621195053.5972950 :002:00001:TS76308031::WF-BATCH:MSMP/GRAC_DEFAULT_PATH/20120621195053.5972950:APPL_DEBUG:009:GRFN_WD_MD_COMMON:Creating Control: CONTROL/L/50000397
3. 20120621195119.9552530 :005056BC28ED1EE1AEFB4D0B4314DE1E:GRAC_DEFAULT_PATH:20120621195053.5972950 :002:00001:TS76308031::WF-BATCH:MSMP/GRAC_DEFAULT_PATH/20120621195053.5972950:APPL_DEBUG:233:GRPC_ENTITY_API:Control is locked by user MC_OWNER
4. 20120621195119.9556300 :005056BC28ED1EE1AEFB4D0B4314DE1E:GRAC_DEFAULT_PATH:20120621195053.5972950 :002:00001:TS76308031::WF-BATCH:MSMP/GRAC_DEFAULT_PATH/20120621195053.5972950:APPL_DEBUG:233:GRPC_ENTITY_API:Control is locked by user MC_OWNER
5. 20120621195119.9560190 :005056BC28ED1EE1AEFB4D0B4314DE1E:GRAC_DEFAULT_PATH:20120621195053.5972950 :002:00001:TS76308031::WF-BATCH:MSMP/GRAC_DEFAULT_PATH/20120621195053.5972950:MSMP_TECH:147:GRFNMW:End of path reached (instance 005056BC28ED1EE1AEFB4D0B4314DE1E,path: GRAC_DEFAULT_PATH/20.120.621.195.053,5972950); returned from exit
6. 20120621195119.9584730 :005056BC28ED1EE1AEFB4D0B4314DE1E:GRAC_DEFAULT_PATH:20120621195053.5972950 :002:00001:TS76308031::WF-BATCH:MSMP/GRAC_DEFAULT_PATH/20120621195053.5972950:APPL:530:GRFNMW:Approval path processing is finished, end of path reached
7. 20120621195119.9596690 :005056BC28ED1EE1AEFB4D0B4314DE1E:GRAC_DEFAULT_PATH:20120621195053.5972950 :002:00001:TS76308031::WF-BATCH:MSMP/GRAC_DEFAULT_PATH/20120621195053.5972950:MSMP_TECH:148:GRFNMW:End of request reached (instance 005056BC28ED1EE1AEFB4D0B4314DE1E, ext. ID SAP_GRAC_CONTROL_MAINT/CONTROL/L/50000397); calling exit
8. 20120621195119.9602640 :005056BC28ED1EE1AEFB4D0B4314DE1E:GRAC_DEFAULT_PATH:20120621195053.5972950 :002:00001:TS76308031::WF-BATCH:MSMP/GRAC_DEFAULT_PATH/20120621195053.5972950:MSMP_TECH:149:GRFNMW:End of request reached (instance 005056BC28ED1EE1AEFB4D0B4314DE1E, ext. ID SAP_GRAC_CONTROL_MAINT/CONTROL/L/50000397) - returned from exit
9. 20120621195119.9608810 :005056BC28ED1EE1AEFB4D0B4314DE1E:GRAC_DEFAULT_PATH:20120621195053.5972950 :002:00001:TS76308031::WF-BATCH:MSMP/GRAC_DEFAULT_PATH/20120621195053.5972950:APPL:506:GRFNMW:Request is closed

[Former Member]

Hi,

Thanks for the detail. I have found some related notes. Can you please try your scenario after implementing these notes.

# 1672668, #1642054

If it does not resolve the issue then I suggest you to kindly raise a OSS message.

Regards

Shaily

[Former Member]

Hi Shaily

Thank you for the suggestion.

However it looks like both these issues have been addressed in Support Pack 08 which we have already implemented.

I have logged an OSS call with SAP and will see what happens.

Don

[Former Member]

Hi Don,

Can you please try again creating the Mitigation control with the same name. From this we will get to know that whether actually that mitigation control is created or not.

If it doesn't allow you to create the control with the same name than it means that there is an entry already existing in the database tables. Please also refresh the screen manually. ( I know you have already tried this 🙂 )

But if it allows you to create the mitigation control with the same name then it means that the previous control was not created. There may by some issue with the workflow.

Please try and let me know.

Regards,

Shaily

[Former Member]

Hi Shailly

I have tried creating a mitigation control with the same name before and did not receive an error when trying to do so. 

In Access Management > Search Requests you can bring up a list of previous requests for mitigating controls and opening on the the requests that relates to should open up the mitigating control created. 

In my case however, when I open up the request number for that related to the mitigating control the error message received is that the control does not exist as per screenshot below, therefore it has not been created.

[Former Member]

Hi Don,

I have gone through your query and could construe that parameter 1061 is set to 'yes'.

Can you please refer to SAP Note:- 1711099 which can help you in resolving it further.

Regards,

Akhil Chopra

[Former Member]

Hi Akhil

Thank you for the response.

The parameter '1061' is set to 'Yes' as per initial message.  The workflow has also been activated.  This should address what the note is referring to.  Workflow message is received by the Mitigating Control Owner and approved without error.  The control is not created after approval. 

I am able to create mitigating controls when the parameter 1061 is set to 'No' however that doesn't use the mitigation control workflow.

Regards

Don

[Former Member]

Hi,

Have you faced any error while approving the request. If yes can you please share the logs.

Kindly also check the audit logs. May be we can get some clue from there.

Regards,

Shaily

[Former Member]

Hi Shaily

There is no error when approving the request from the work inbox.  The audit log doesn't show any error either.

Still however the control is not created.  See the audit log below.

Regards

Don

[Former Member]

Hi Don,

Can you please check the SLG1 logs if its showing up anything.

Also, kindly execute transaction GRFNMW_DBGMONITOR_WD and provide the request number as "key" and check if there are any errors found there. This transaction helps you to debug the workflow followed for each request.

Best Regards,

Smriti

[Former Member]

Hi Smriti

Thanks for the response.  On GRFNMW_DBGMONITOR_WD I can't seem to see any errors in the logs. 

In SLG1 however I see the following message, when I filter under Object txt: GRC - Governance, Risk and Compliance.  Sub-object text: API Access.

Problem class Other

"unknown parent relationship between control and it's parent" next to when requestor for a mitigation control's user name.

Any idea what this error means?

Regards

Donald

[Former Member]

Anyone know how to resolve this?

[Former Member]

Hi,

Can you please let me know which support pack level are you on?

Best Regards,

Smriti

[Former Member]

Hi Smriti

We are on SP08 for GRC 10.

Regards

Don