GRC RAR 5.3 False Postives Post 4.6C to ECC Upgrade

[chris_hall2]

GRC 5.3_16

We have just gone through an upgrade on R/3 from 4.6C to ECC.  We have uploaded the objects and ran and incremental sync for user/role/profile as well as an incremental user analysis and Generated the rule set.  Now running the risk analysis at the user level we are receiving false positives.  There are objects within the results that have activity type 01 and 02 identified but when we go to the actual role in PFCG this object only has 03.  I have also verified the rule is not enabled for checking actvt 03.

Any idea's what has been missed?

Thank You in advance

[Colleen]

Hi Chris

Have you checked the user buffer via SU56 in ECC to see if they are getting the activity from a different role?

Regards

Colleen

[chris_hall2]

Hello Colleen,  yes that thought crossed my mind and validated.  I have also created a few sample users in QA and ran the same analysis and get the same results.  I also connected our GRC development to QA and ran the analysis on the same user in QA and go the exact same results.

[Colleen]

Hi Chris

are you running online of offline risk analysis?

That aside, possibly worth trying to run full sync on QA to see if you need to refresh all the data in GRC

Are you able to try batch risk analysis to see if you get same result? If so you could possibly run JAVA trace and then debug to see how the system in identifying the risk

Regards

Colleen

[Former Member]

restart ECC, delete the risk analysis data, restart GRC and re-run the jobs. could be timing issue or something to do with your upgrade. I faced a similar issue like this and resolved using the method I am proposing. good luck.

[chris_hall2]

I have not attempted a batch risk analysis as of yet.  I was trying adhoc online and offline and both had the same result.

[chris_hall2]

Restarting ECC 24hrs post upgrade is probably not an option at this point.  We are going to upgrade SP levels in our GRC dev system in the coming days to see if this will help.  Just thought maybe I am overlooking something at this point.