Working of Mitigation policy

[plaban_sahoo6]

Hi All,

@ GRC 10.1 sp11

config: i have copied the standard application GRAC_BRF_MIT_POLICY, to a custom application Z_GRAC_BRF_MIT_POLICY. In decision table,  I have included RISKLEVEL as input column and MITIGATE_RISK is the name of my Output column.

i do not want Medium level risk to be considered as Risk.So, i have made value of MITIGATE_RISK as 'Yes'. I have also made my custom function id assigned to 'Request Mitigation policy' , in SPRO->...Maintain AC Applications and BRFplus Function Mapping, and removed the Standard function id.

FYI, Medium level Risk id is appearing under the Risk violation tab

So, after Request submission for a user(with role containing medium level risk ), i get 'green button' for 'Risk Violation'. So, it suggests my Mitigation Policy has considered Medium Level risk, as not to be considered as Risk

But, if i make value of MITIGATE_RISK as 'No', then also i get 'green button' for 'Risk Violation'.

Could you help me know on the working of Mitigation policy. i found lot of posts on SCN, but i got confused by my results.

Regards

Plaban

[Former Member]

Hi,

You cannot change the color of the risks (Red or Green) as its hard coded, please refer note - 1798452.

For element "Mitigate Risk" you have mentioned value is set as "YES", can you tell me were did you change in specific.

Did you change domain values (not editable as its from bound data).

In the decision table after entering Conditions and Result, please maintain "Table contents" for risk level that needs mitigation and risk level which doesn't need mitigation.

Thanks,

Antony Rajan.

[plaban_sahoo6]

hi,

it is not about the color. 

whether i make value 1(yes) or 2(no), it always shows No risk found. I have maintained "Table contents" for risk level that needs mitigation and risk level which doesn't need mitigation.

Regards

Plaban