SAP GRC AC 5.3 : RAR for HR Position Based security

[Former Member]

1. Are there any other impacts in RAR, if we use Position based security in SAP HR. In RAR we can see the risks based on the users / roles that have conflicts. If we use PBS, how does RAR work to display the conflicts.

2. I know we can assign mitigating controls to users who have conflicts so that we can filter them in RAR reprots. How does this work in PBS model ?

Thanks

[Former Member · Accepted solution]

Hi Arunachalam,

If you do the HR object analysis and analysis type is USER ANALYSIS, then the expired and locked users option will be taken into consideration. It is same as user analysis. The expired and locked user option is only for user level analysis not for any other like role, profile etc.

If you do the HR object analysis and analysis type is Object Security Only or Manager analysis , then the expired and locked users option will NOT be taken into consideration.

I hope this information will help you.

Regards,

Yukti

[jitan]

Hi Arunachalam,

Answer to your points are as follows:

1. There are no major impacts but surely there are few points to consider when you switch to PBS.

     a. You can perform risk analysis on HR Objects (Position, Job & Org Unit) using HR Objects adhoc risk analysis reports. 

    b. However using position (job or orgunit) mitigations for users are not possible as you can do for role mitigations which you can use by choosing the configuration parameter 'Include Role Profile Mitigations'

2. As explained earlier you will not be able to use position based mitigation for users. However you can still mitigate users directly for the risk coming from indirect provisioned roles. And also the position can be mitigated seprately for HR object risk analysis report.

You can also refer to note # 1473582 for more details on this topic.

Best Regards,

Jitan Batra

[former_member225453]

Hi Arunachalam,

In GRC RAR, you can execute the SOD analysis for HR object (using position or job based). After you login into GRC RAR application, please navigate to Informer (tab)   > Risk Analysis   > HR Objects.

Hope this helps!

Regards,

Shreya

[former_member225453]

Hi Rithesh,

For evaluating the risks associated with HR position, try performing Impact Analysis against the Users where the HR org or position changes has been made.

In the Request, there is a button for Impact Analysis. Please refer the Note. 1638140 to get a clear idea of Impact Analysis and Risk Analysis.

Also, try running Risk analysis at HR Object level, mitigate any HR Object (like Position) and then try to run the User Level Risk analysis for those users which are on same Position.

Hope this information helps!

Regards,

Shreya Gupta

[Former Member]

Hi Shreya,

Thanks for this information, I have seen the Note but this talks about GRC 10, but unfortunately we are using GRC 5.3 AC.

[former_member225453]

Hi Arunchalam,

Yes, RAR works on Postion Based as well.

HR mitigations only are attached when running the HR level analysis.

You can do Impact Analysis on Position based.

Regards,

Shreya

[Former Member]

HI Arunchalam,

Please refer to the SAP note 1099011. I hope it gives you some relevant information regarding PBS.

Regards,

Yukti