GRC Implementation

[Former Member]

Hi

I am planning to go for GRC implementation for one of our company.  There are two companies having ECC system implemented. One of those company have implemented the GRC ver 5.3 and another want to implement now. I need to have below clarifications:

(1) Can I have multiple rule book in single GRC instance ?

(2) A single GRC instance having multiple rulebooks need to connect multiple SAP instance as one-one basis. Is it possible ?

(3) The GRC license is based on number of roles , or number of users or number of GRC instance ?

Please suggest

Regards

Vimal

[Former Member]

(1) Yes You can have.

(2) You can connect a Single GRC instance with multiple SAP instances.

Note: The only issue is in CUP it considers the default Rule book while performing the Risk analysis.

(3) It depends on the contract between the customer and SAP. for some customers it depends on their revenue, for some depends on users.

Best Regards,

Rama

[Former Member]

Hi

Thanks for quick reply.

I just want to understand that each rulebook of GRC instance (having multiple rulebooks) can connect to corresponding ECC server. TO get more clarity, please confirm as below

Single GRC Server                                                                          ECC Servers

===============                                                                         ============

RuleBook-Division-1     ---------------------------------------------------->  ECC Instance 1

RuleBook-Division-2     -----------------------------------------------------> ECC Instance 2

RuleBook-Division-3     -----------------------------------------------------> ECC Instance 3

(1)  Is it possible  ?

(2)  Does is complex or easy to configure and maintain ?

(3)  What need to be taken care during the configuration ?

Regards

Vimal

[Former Member]

Hi VImal,

Practically Its not possible to connect one-on-one in AC 5.3.

But we can have Multiple RuleBooks, link the Rules to Each system and use them according to your requirements.

When you are working on RAR you can select the Ruleset while running the Risk analysis.

Challenges: You will face challenges when you are working with ERM and CUP, as ERM & CUP of AC 5.3 doesn't have the option to select the Ruleset.

It considers the "Default rule set for risk analysis" that is configured in RAR.

Best Regards,

Rama

[madhusap]

1. Yeah you can create multiple rulesets as per ur requirement. But SAP advises to use standard rules as starting point and then build your rules on your own requirement in your customized ruleset.

2. In single GRC system you can have multiple rulesets. But for risk analysis during user provisioning, you need to configure the default ruleset in GRC 5.3

3. Software is basically dependent on Revenue & structure of your individual licence agreement with SAP.