SOD for Composite Roles

[former_member187795]

Hi All,

I have a risk analysis scenario as described below.

User has selected 3 composite roles in the request.

Role owner performed risk analysis.

Risk analysis report has High level risks and Medium level risks.

When i drill down to the report, risks are between

First Composite Role - Child Role 1 with

Second Composite Role - Child Role 2

Apart from that everything is fine.

Now if the role owner wants to reject the role causing risks, he should reject entire composite role rather the single roles with in it.

As per role design this is fine. But from risk analysis point of view, rejecting a composite role with 20 other roles just for this one role which has risks is not justifiable.

Anyone has come across this kind of scenario?

Any good practices while creating SOD rules with Composite role design?

Please share your views.

Regards,

Sai.

[alessandr0 · Accepted solution]

Dear Sai,

we have similar cases in our enterprise and there is only one approach from my point of view: change the composite roles. Since it is not possible to reject a single role in a composite you have to change the composite assignments.

Just for your information: I am changing composite roles daily to avoid SOD conflicts as users have several composite roles assigned.

As a very good approach we are trying to avoid "critical" single roles in composite roles. For example Sales Order Entry, Customer Masterdata Maintenance, Payment Execution, etc. isn't assigned in a composite role. This "critical" single roles are assigned to users.

Basically I say a composite role should cover 80% of all required roles for a function. Critical assignments should be given based on the end user.

Hope this helps.

Regards,

Alessandro

[former_member187795 · Accepted solution]

Dear Alessandro,

Thank you so much for sharing your views.

I will try to put forward the same point of view in our project to avoid Critical single roles to be included in composite roles. This would be the best possible approach as of now for our scenario.

Will discuss and update you client views on this.

Regards,

Sai.