GRC 10.0 Mitigating Control : Risk Id not Mandatory

[Former Member]

Hi experts,

We are implementing SAP GRC AC 10.0 (SP8) and we found that when we create a Mitigating Control, Access Risk Id (2nd Tab) is not mandatory.

Is it normal or we missed something in the customizing?

It was mandatory in 5.3 version.

Thanks for your help.

Best regards,

Nicolas

[Former Member]

Hi Nicolas,

The only difference we found is the Organization which is mandatory in GRC 10 and not available in 5.3. However we had Business Unit there in 5.3.

In both the systems when we try to save a Mitigating control with out Access Risks, it throws an error message. I have not come across any specific customization for this setup and found it to be the natural system behavior. The screen shots are attached for reference.

Let us know if this info helps.

Rgds,

Sri

[Former Member]

Hi Sri,

Thanks for your reply.

In your screenshot, I see that you add a row and try to save with this row left at blanck. In this case, I get an error message too.

But if you try to save a mitigating without adding a row, you will see that you are able to save the mitigating control. It was not possible in 5.3.

Best Regards,

Nicolas

[Former Member]

Hello,

Risk id is not necessary for creating mitigating control in GRC10. its normal

Rajesh.