GRC AC10.0 (ruleset): Logic between Functions in Access Risks

[Former Member]

Dear all,

What is the logic between functions in an access risk (in my opinion this is an AND logic):

Example1: RiskID: PTP001

Function1: M00001 (Maintain Purch orders)

Function3: F00001 (A/P manual postings)

When running an SOD audit, SAP will see this one as M00001 AND F00001 , until here I understand.

But now I want to make BIdimensional SOD:

Example2:

(FUNCTION1 OR FUNCTION2) AND FUNCTION3:

Function1: M00001 (Maintain Purch orders)

Function2: M00002 (MASS maintain purch orders)

Function3: F00001 (A/P manual postings)

Is it possible to create Example 2? Is this an option in 10.1?

Kr,

Roy

[alessandr0 · Accepted solution]

Hi Roy,

this is not possible in the same access risk. What you can do is creating two access risk to achieve your "bidimensional SOD".

Risk 1:

Function1: M00001 (Maintain Purch orders)

Function3: F00001 (A/P manual postings)

Risk 2:

Function2: M00002 (MASS maintain purch orders)

Function3: F00001 (A/P manual postings)

In the end you have your scenario but dedicated into two different access risks.

Alternatively you can try to set up a combined function that contains Function 1 (Maintain PO) and Function 2 (Mass Maintain PO) with OR as logical function. As I have never tested I am not absolutely sure if this is possible.

Let us know if you need further details.

Regards,

Alessandro

[Former Member · Accepted solution]

Hi Alessandro,

I had a feeling this would be difficult. Thanks for your answer! We are going to test the outcome.

Kr