GRC AC 10 SP13 - User Risk Analysis Returns No Violations

[Former Member]

Hello

I had a question regarding the expected results of a user risk analysis run on a user assigned two roles with the same conflicting transaction codes, SU01 and PFCG. One of the roles with violations, ZS:GB_SM_GRC_SOD_TEST, has been mitigated. The other, ZS:GB_SM_GRC_SOD_TEST_2, has not been mitigated. The roles have the same risk(s) since they are identical.

When I run a user risk analysis, I thought that violations would show for the unmitigated role, ZS:GB_SM_GRC_SOD_TEST_2. Instead, the user shows no violations. I'm assuming this is because both roles have the same risk(s) since they are assigned the same transaction codes, SU01 and PFCG.

Are these the results I should expect? I could see an argument both ways because the one role was not mitigated but the associated role technically is mitigated in another role. I've included screen shots below as a reference.

[neerajmanocha · Accepted solution]

Hi Stacey,

This is a right behavior. When you have 2 roles (Test1 & Test2) with same tcodes and mitigate only one role (say Test1) and try to run the Risk analysis at ROLE level, you will see the actual difference in RESULTS for both the roles.

However, when it comes at USER level (considering you have including Role level mitigation in User Analysis),  it is always a Risk (irrespective of the role from where it comes) for a USER. Here Role level mitigation will now turn towards USER level with Risk ID. User is mitigated now with particular risk and that is irrespective how many roles has that same risk. So system will show all the roles as mitigated, because user is mitigated for that risk.

This does not sound good, if we mitigate one user with one role for one risk and do the same activitiy for same risk for different roles.

Thanks & Regards

Neeraj

[Former Member]

Hi Stacey

I faced the similar issue.After troubleshooting I found that the Logical Groups was not correct instead of SAP_ECC group you need to activate SAP_R3 group in BC set and make sure that all your connectors are mapped to this group.

This should resolve your issue.

Regards

Pradeep

[Former Member]

Hi Stacey,

Good Question..

Hi Experts,

Just to add on 

User: U1 ( Role 1 and 2)

Role1: ZS:GB_SM_GRC_SOD_TEST         (SU01 N PFCG)  Mitigated by control M1

Role 2: ZS:GB_SM_GRC_SOD_TEST_2    (SU01 N PFCG)

If we execute User Level Risk Analysis, Risk doesn't appear. Now if check 'Include Mitigated Risk' then the Risk appears but if select Detailed view on results screen we see that 

Role 2: ZS:GB_SM_GRC_SOD_TEST_2   also appears as a Mitigated Role by Control M1. which is not the case here.

Regards,

Arun Singal

[Arif1]

Hi,

as you mitigate one role and T-code is same in another role so, those t-code is mitigated for the assigned user. here no violation is coming based on T-code not role.

thanks/

Arif