Ruleset Maintenance in DEV or PROD?

[patrick_weyers]

Hi all,

What's your thoughts on where to maintain the production ruleset?

I can see advantages in both variants:

- Maintaining the ruleset in DEV and transporting through Q to PROD has the same benefits of any other customizing that should not be done on the PROD system.

- However, the GRC 10 approval workflow for ruleset changes (functions, risks, ...) is quite nice on PROD.

Now, if I wanted to use the approval workflow on DEV already (and customize the ruleset there), I would have to setup a "production" workflow on the DEV system, which is less than ideal.

What's your favorite approaches?

Thanks and cheers,

Patrick

[Former Member]

Patrick,

I would discuss the options with internal audit/ internal controls group if you have one. My personal preference will be maintaining the ruleset in DEV and transporting through QA to PROD. Unless there is a compelling reason, such no transport option, that is going to provide better change control and is worth the tradeoff on the workflow side. My guess is that your internal auditors would expect to see a more compelling reason for changes to be made directly in PROD. This is among the improvements I am most looking forward to when we upgrade from 5.3  to 10.x next year.

Gretchen