ARA: Excluded Roles considered for Risk Analysis???

[former_member184114]

Hi,

There are certain role which are to be excluded from risk analysis or some business reasons. To achieve this, I have added entries for these roles in SPRO and saved them.

Actually, these roles are available in all the systems. Therefore, under "System" column I have selected "ALL" and saved the entries.

I ran risk analysis for a specific business process (above roles are belonging to this business group) and surprisingly found that, those roles which are maintained as "Excluded", as shown in the risk analysis report as violating!

Thinking that "ALL" option does not work, I maintained (excluded) these roles for specific systems in SPRO. Ran risk anlaysis, but with no luck.

Then I ran risk analysis for excluded role(s), I am still getting the violations for these excluded roles!

May I know why system is considering these "excluded" roles at the time of risk analysis?

Please advise.

Regards,

Faisal

[former_member204479 · Accepted solution]

Hi Faisal,

I am assuming you have excluded the roles from 'Maintain Exclude Objects for Batch Risk Analysis'. This is for exclusion from batch analysis that populates the offline risk data.

When you are running the risk analysis report are you running an online report or an offline one?

The exclusions will impact the offline reports not the online ones.

Thanks

Sammukh

[former_member184114 · Accepted solution]

Sammukh,

Correct me I am wrong.

This "Maintain Exclude Objects" will only affect the management reports but not the ad-hoc risk analysis.

Meaning, whatever objects we maintain as "excluded" in SPRO will NOT be considered while updating management report via batch risk analysis.

In all other ad-hoc risk analysis, these objects would be considered and highlighted.

Please advise.

FYI...

In my configuration 1027 is set to "NO".

Regards,

Faisal

[former_member204479 · Accepted solution]

Ideally batch risk analysis data impacts the management dashboards and reports under the reports and analytics tab.

The reports under Access management tab are realtime reports thus do not consider batch risk analysis data.

Thanks

Sammukh

[alessandr0 · Accepted solution]

Faisal,

if you activate 1027 you can choose "Offline Data" in your risk analysis. Hence you won't see your excluded objects in the analysis with offline data. If you have 1027 set to NO it is always performing an online analysis which doesn't consider the excluded objects.

All other was mentioned by Sammukh.

Let us know if its clear.

Regards,

Alessandro

[former_member184114 · Accepted solution]

Alessandro,

Now I set 1027 to "YES" and performed risk analysis for an object which is maintained as "Excluded" in SPRO->GRC->AC->ARA->BRA->Maintain Exclude Objects for Batch Risk Analysis.

I selected "Offline Data" check box and performed risk analysis. Now system is showing as "No Violations" for that object.

I need a bit help to understand this "Offline" risk analysis.

May you please elaborate and help me understand, with example?

Regards,

faisal

[alessandr0 · Accepted solution]

Hi Faisal,

you can schedule the batch risk analysis in your GRC system with program GRAC_BATCH_RA (SPRO > GRC > AC > ARA > Batch Risk Analysis > Execute Batch Risk Analysis). The batch risk analysis is required for offline risk analysis and management reports.

Did you run the batch risk analysis before you run your report?

Regards,

Alessandro

[former_member204479 · Accepted solution]

Hi Faisal,

For offline / real time analysis explanation also review the SAP note 1580877. This gives the summary.

Thanks

Sammukh

[former_member184114 · Accepted solution]

Hi Sammukh,

I saw this note and I could barely understand the "real" difference and need.

Secondly, I found one thread  on SCN which discussed this before and there was a reference to one note:

#1126251: Risk Analysis and Remediation - Offline vs On-line  Analysis

I tried to search this note on service market place. But got error: "Document is not release"

Not sure why this is not available.

Regards,

Faisal

[former_member184114 · Accepted solution]

Alessandro,

Yes, Batch Risk Analysis is run from the path you have shown.

Secondly, I am running first Risk Analysis from NWBC->AM->Risk Analysis->Role Level

Then after that I am running Batch Risk Analysis.

Regards,

Faisal

[former_member184114 · Accepted solution]

Alessanrdo,

if you activate 1027 you can choose "Offline Data" in your risk analysis. Hence you won't see your excluded objects in the analysis with offline data. If you have 

Now I set 1027 to "YES" therefore, "Offline Data" option is available (earlier grayed out).

If I choose "Offline Data" while performing risk analysis for an excluded object, Report says "No Violations"

If I choose "Offline Data" while performing risk analysis for an object WHICH IS NOT EXCLUDED and it has violations, Report also says "No Violations"!

How come this is possible

Can you please advise?

 If you have 1027 set to NO it is always performing an online analysis which doesn't consider the excluded objects.

When this is possible? Meaning, in Risk Analysis (Ad-Hoc) or at the time of Batch Risk Analysis?

From the SPRO > GRC > AC > ARA > Batch Risk Analysis > Execute Batch Risk Analysis, it is very clear that application will ONLY consider the objects maintained here at the time of running Batch Risk Analysis.

Then it means that in Ad-Hoc analysis, these "Excluded" objects are considered?

Regards,

Faisal

[former_member184114 · Accepted solution]

Alessanrdo,

I think the "excluded" objects in path:

SPRO->GRC->AC->ARA->BRA->Maintain Exclude Objects for Batch Risk Analysis

itself says that the objects will NOT be considered while performing Batch Risk Analysis (Analytic Reports). It seems to be working fine for me.

I dont think that the objects maintained in above path will have any importance while performing Risk Analysis from NWBC->AM->Roles Analysis) and will NOT be considered.

Please correct me, if required.

Secondly, I found 2 relevant posts here on SCN:

Both of them are talking about the offline mode of running risk analysis. Actually I have not used it yet therefore, wanted to know the real usage of it. These posts seem to be giving the details of "Offline" mode analysis.

I believe this will not be used in my scenario as there is no such requirement and real need. Therefore, I think I should disable it (Offline Data) option from the analysis screen just to avoid any confusion.

Currently all our risk analysis is taking place "Online". There is no "real" need to use "Offline".

May you please let me know in which scenario this would be useful?

Regards,

Faisal

[alessandr0 · Accepted solution]

Hi Faisal,

you have to consider the setting based on your business requirement. Sometimes it is required to have offline analysis, e.g. for very huge reports or when you are remediating violations you have to have the same baseline.

Personally I am not using the offline analysis as I want to see the real situation for the time when I analyze. But as mentioned it depends on your requirements. If you haven't had this option I assume it isn't required.

Best regards,

Alessandro

[former_member184114 · Accepted solution]

Alessandro,

Thanks for your reply and sharing the thoughts.

Even I dont see any business need now for me. Therefore, I am going to disable it now.

But may you confirm if my understanding is correct "exclude" objects?

Regards,

Faisal

[alessandr0 · Accepted solution]

Hi Faisal,

yes I confirm - had the same thoughts.

Regards,

Alessandro

[former_member184114 · Accepted solution]

Thanks

[former_member184114]

Any help please?