Digital Signatures in Access Requests

[Former Member]

Hi GRC experts,

I have googled and found very little on the topic of using Digital Signatures (E-signatures) as sign-off within GRC.

The question has been raised as a business requirement and my assumption is that this would be a development of the Access Request. I know very little about customisation of this and welcome any ideas whether theoretical or based on practical experience.

I can see that I can add an attachment but this would be an image of the digital signature not an actual signing as approval of the Access Request.

Thanks very much,

[Former Member · Accepted solution]

Hi Andy,

Any chance of sharing what you have found out already in regards to Access Requests?

I know that the whole idea of approving a request with the "Reaffirm" option set on the stage was to force people to enter their GRC login credentials to verify that they are the actual approver. There is a note to describe this:

http://service.sap.com/sap/support/notes/1743835

However, unsure how many people accept this simple method as a E-Signature method. Some want complicated solutions.

The only other thing I could find directly in relation was a note about Digital signature spoofing.

http://service.sap.com/sap/support/notes/2067859

This note is interesting, it is a few years old so unsure if any specific changes have come into place (apart from the re-affirm option).

http://service.sap.com/sap/support/notes/1616879 -

The note states that there is no 21 CFR Part 11 document available for GRC Access Control.  It's up to each company to certify Access Controls if they deem it to be covered under

FDA. Unsure if this is from a system perspective or a functionality perspective.

Look forward to hearing your thoughts.

[Former Member · Accepted solution]

Hi Harinam

Sorry for the delay in responding!

In the end we agreed that this would be a development, and even had this confirmed in a message by SAP. As yet I have not had to progress it. I would imagine this question comes up frequently as it is a compliance system and often used in industries that do rely on Digital Signing.

Andy