Role Owner Defination

[Former Member]

Hi All ,

We are currently implementing GRC 10 and since I only have brief exposure would like to some advice on the role owner definition in GRC .

In our organization we have two approve for each of the business domain. After checking in SDN I believe this is possible with defining the approver during the role upload via NWBC .

Approver [ Alphanumeric(12) ]

Alternate Approver [ Alphanumeric(12) ]

If this is true would the notification would be going to both approver or only to the Primary Approver. 

Regards

Amir . 

[former_member193066 · Accepted solution]

Alternate approver is used for escalation notification can be sent only to 1 approver.as standard settings.

but can also modify it to send to alternate approve for that you need to customize notification.

Regards

Prasant

[madhusap]

Hi Amir,

For each role you can maintain multiple role owners as well as Alternate owners. But you need to confirm whether all role owners need to approve or if anyone of them approves then request can go through.

These settings you can make at Role owner stage level (Any one approver or All approvers) . Basically if you maintain 2 people as Role owners for one role both will get Email notification.

Alternate owner is someone who will approve the request if the request is not approved by main role owner within the time setup at the stage level as per your requirement.

Mail will go to alternate owner once your request gets escalated, but for this you need to schedule Email Reminder Job.

Regards,

Madhu.

[Former Member]

Hi Madhu and Prasant  ,

Thank you on your feedback , i going to propose to have a Shared User ID and Group e-mail for the 1st approver while the 2nd approve would be in individual users whom can act as backup  . In this way the e-mail notification would be send to a group mailbox for the each business ICF Approves and they can login to their shared account to approve the request which send to their mailbox .

Is is something workable solution .

Regards

Amir .

[Former Member]

Amir shah wrote:

Hi Madhu and Prasant  ,

Thank you on your feedback , i going to propose to have a Shared User ID and Group e-mail for the 1st approver

Amir,

Yikes. A shared user ID as role approver?? What kind of audit trail does that provide? When the auditors show up to ask, "who approved that user for that inappropriate role," you have no accountability, because anyone with access to that shared account could have done it.

What kind of auditor signed off on shared IDs in the first place? That is a very poor control.

Please tell me you will reconsider.

Gretchen

[Former Member]

Hi Amir,

Going with shared user ID to be used among the owners is NOT at all a choice to go with. It would definitely challenge Audit, you should be thanking Gretchen.

You can rather create an user group; say owner_group (or something unique) for this purpose and then you can put all the corresponding owners in there.

Then, you can configure that anyone from the group can approve the request for role_owner_stage.

Alternate owner would come in picture where the primary approver is out of reach or not responding to the requests or so called to escalate; just like Prashant and Madhu have explained.

Hope this should be clear now.

Regards,

Ameet

[Former Member]

Hi Ameet and Gretchen ,

Both of you indeed right the shared ID is a bad idea  , guess i need research more on GRC instead taking the vendor feedback. I will do more research on how this is done via msmp workflow as i was told customization needed for such changes .