When approver on vacation determine a substitue

[Former Member]

Hi experts,

when an approver goes on vacation and can in this time not edit access requests, is it possible to determine a substitute for the time of his absence?

Thank you and kind regards

Büsra

[madhusap · Accepted solution]

Hi Busra,

You can make use of ADMIN DELEGATION option so that requests of the approver who is on leave can be approved by another approver.

Go to NWBC -> Access Request Administration -> Admin Delegation

Regards,

MAdhu.

[alessandr0 · Accepted solution]

Hi Busra,

beside what Madhu mentioned the user himself can also set a delegation to a substitute. It is also the recommended way from compliance point of view. Admin delegation works exactly the same way but as an admin defines a deputy it is not recommended to do so. Most auditors will ask for evidence while auditing the system. Hence train your users to do in advance.

My Home > [My Delegation] > Approver Delegation

What I like most with this functionality is that you can define the delegations in advance. I already know that I am out of office end of this year so I already set a delegation to my substitute. Also it is possible to set more than one delegation in advance.

Regards,

Alessandro

[Former Member]

Thanks you Gretchen and Alessandro!

We will discuss the possibilities within our team and hopefully find the best way to use this !

[Former Member]

Thank you experts for replying to my question.

In this context an other question crosses my mind.

How does this work with the authorizations?

Must my substitute has the role as an approver or should we make a workaroud like giving him just for this period of time this role ?

Thank you guys!

Kind regard,

Büsra

[alessandr0]

Hi Büsra,

personally I think all users should have a minimum of authorization which also includes to approver access requests either as manager or role owner. Hence I recommend to give the authorization to the user.

As a user can only approve requests assigned or directed to him giving the authorization isn't an issue from compliance point of view.

Regards,

Alessandro

[Former Member]

Busra,

At our organziation we only grant the ability to approve requests at the manager stage to managers. We do not want managers delegating to just anybody. We suggest that they delegate to their own manager wherever possible, but when not possible, to a manager peer at their own site.To be honest, it is a bit of a struggle, so we are planning an email communication to the managers with the holiday season approaching, to remind them of the importance of doing a delegation in GRC before all planned absences. Some of them seem to think that executing a DOA for release authority means they have a delegate for any situation, and of course, our GRC has no way of knowing if you have executed a DOA agreement. We have less of an issue with role approvers, as most roles that require role approval have multiple approvers configured, and any one can approve.

Regards,

Gretchen