SAP GRC AC ARM -Access Request approval

[FilipGRC]

Dear Community Members,

my question relates to practice advise in respect to risk analysis type on access request.

Can anybody share experience with type of analysis on access request.

According to SAP HELP we have: In the Analysis Type dropdown list, select the relevant analysis type.

• You use Risk Analysis to determine violations pertaining to the authorizations assigned to the role. For example, when the authorizations result in segregation of duties violations.
• You use Impact Analysis to determine authorization violations pertaining to other roles. That is, the authorizations for the selected role, in combination with authorizations for another role, result in violations

In particular I am interested when I have requested Role A and Role B with both creates SoD risks, would this be catch by access risk analysis during request creation? Assuming user have no role at backend.

Thanks,

Filip

[alessandr0 · Accepted solution]

Dear Filip,

your assumption is correct. Eventhough there is no role assigned for an existing user or if it is a new user account the risk analysis does still work. It's more a "simulation" or a "What if" analysis.

Let me know if you want to know more in particular.

Regards,

Alessandro

[adesa28]

Hi Filip: Answer to your question is - YES.

When you are creating a request for a user - the system will run the analysis on user level - in simulation mode, so, it will capture risks from both the roles.

Also, as Sweta said above, you may run the risk analysis on user simulation level before creating the request so you know what to expect when the request is created.

Regards

Ashish

[Former Member]

Hi Filip,

Yes, your understanding is correct.

Risk analysis in the access request is intended to find out any sorts of risks associated to the roles in the request inaddition to the roles assigned to the user already.

When Risk analysis is performed, it will take into account all roles which are added to request and show the correct results.

You can also run the simulation to see what will happen if the role is assigned to user beforehand.

Regards,

Shweta

SAP - GRC