GRC risk anlaysis results include inactive permission rules

[Former Member]

Dear GRC experts,

We have unexpected results from Risk Analysis report: the user have ACTVT 03 for SE16, and we don't want it to be caught in the risk analysis. We have made SE16 ACTVT 03 permission to be inactive, but it still shows in the risk analysis. Is there something that we are missing? Please help us.

We have GRC 10.0 SP19.

Thanks in advance for your time and help.

Regards,

Emma

[former_member192902]

Hi Emma,

Here is two things need to explain

1. You have inactivated at permission level and running the risk analysis report at Action level (as per screen shot)

2. when you inactive at permission level system will not show any risks at permission level but system will show at action level if T-codes are active/Enabled

You just run the risk analysis at permission level and check whether system showing any risks at permission level.

With Regards

Trinadh Bokka

[former_member182655]

Hi Emma,

You don't write about risk generation, so I have to ask you.

Have you regenerated your risks after changes?

It might be the reason.

Regards,

Artem

[Former Member]

Hi Emma,

    Check out the roles. The roles must be having "*" in ACTVT. The system cannot behave differently. Definitely there is some leakage of access. Check out the permission you have made as active in BS03 function and the permissions maintained in the roles showing up in the risks.

Thanks,

Fazil