Audit trail for Mitigated users

[Former Member]

When we need to change a monitor for a mitigated user, we expire the record today and then run User Simulation and re-add the mitigating control for the start day the old record was expired and with a different monitor.  If I go back to see the history showing who monitored previously and who monitors now.  The old record is gone.

Should GRC do this?

Our auditors want to see that this user was mitigated from the time the conflicts were assigned and also they need to go back and check that the monitors performed and posted their required reports.  They cannot see the old mitigation record if it is deleted.

Thanks,

Becki Ramsey

Hexion

[Former Member]

Hi Becki,

Maybe try running program GRAC_DOWNLOAD_MIT_ASSIGNMENTS to download the MC report? I haven't tested it, but this may give you all the MC assignments since the beginning of time.

Or try the Mitigation Control Report from the Reports and Analytics workspace of NWBC.

MC reporting is extremely lacking in GRC 10.  As a workaround, I would try using the above reports and matching up the validity dates (FROM) to manually match the MC to the actual Monitor a specific time.

-Ken