Question Re: SAP GRC 10.1 – Mitigation Control Missing in Additional Q&A

SAP GRC 10.1 – Mitigation Control Missing

pedro_carvalho2097 — Fri, 22 May 2015 10:26:32 GMT

Hello experts,

We are in GRC AC 10.1 SP7 and for ARA module we are creating a mitigation control. But after create this master data no mitigation control are showed on the list.

In NWBC->Master Data->Mitigating Controls we created a simple mitigation control test with:

Mitigating Control ID: unique in the system
Name
Description
Organization: created by SPRO > Governance, Risk and Compliance > Shared Master Data Settings > Create Root Organization Hierarchy
Process: created by SPRO > Governance, Risk and Compliance > Access Control > Maintain Business Processes and Subprocesses
Subprocess: created by SPRO > Governance, Risk and Compliance > Access Control > Maintain Business Processes and Subprocesses
Notes

Owner and Monitor are indicated and associated to the Organization;

Only AC component are activate (we not have PC component);

We are not using WF approval (parameters 1061 = NO and 1062 = NO);

If we going to SPRO > Governance, Risk and Compliance > Shared Master Data Settings > Set Up Structure: Expert Mode we can see the mitigation control created below Local Control;

This will impact naturally when we will try to mitigate the risk after a risk analysis;

Anyone knows why we cannot see and use the mitigation control that we just have created?

Best regards

Re: SAP GRC 10.1 – Mitigation Control Missing

alessandr0 — Tue, 26 May 2015 09:34:44 GMT

Dear Pedro,

strange issue - can you please check the following:

- limitation of authorization (GRAC_MITC)?

- check your queries (do you have a filter active)?

From my point of view the mitigating control is saved but your are just not able to see it.

Let us know.

Regards,

Alessandro

Re: SAP GRC 10.1 – Mitigation Control Missing

pedro_carvalho2097 — Tue, 26 May 2015 10:13:08 GMT

Hi Alessandro, thanks for your reply.

I check the points you mentioned:

- Limitation of authorization (GRAC_MITC) = * . The user has SAP_ALL profile;

- Queries: there is no queries activated or any filters apply;

What controls this view? This could be something in webdynpro?

What tables should I consider to analyze?

Thanks

Re: SAP GRC 10.1 – Mitigation Control Missing

alessandr0 — Tue, 26 May 2015 12:01:04 GMT

Pedro,

check table HRP1000 and HRP5354.

Regards,

Alessandro

Re: SAP GRC 10.1 – Mitigation Control Missing

Former Member — Wed, 27 May 2015 03:46:36 GMT

Hi Pedro,

1. have you created mit. control from NWBC. then it should appear, after you assign Monitor and owner, as defined in your Child Org. unit.

Pre-requsite: Define owners in child org. unit

2. Local Controls in Shared Master data means that they can also be used in PC. Since you are not using PC, it is no meaning viewing that.

Regards

Re: SAP GRC 10.1 – Mitigation Control Missing

Former Member — Wed, 27 May 2015 06:38:20 GMT

Hello Pedro,

Did you create the Subprocess - whcih I couldnt find in above screenshots.

Do the following:

1. Create the Business Process and subprocess in --> NWBC--> Master Data--> Business PRocesses.

2. Create controls under Sub Process, As you use only AC, you can create all your control under one Subprocess. For e.g - IT Process --> IT Subprocess --> List of 30 controls.

3. Now goto NWBC --> Master Data--> Organizations--> Assign Subprocess--> Assign Control.

4. You will see all the controls will appear under Mitigation COntrol tab once assigned this way.

Rajesh

Re: SAP GRC 10.1 – Mitigation Control Missing

pedro_carvalho2097 — Wed, 27 May 2015 08:13:12 GMT

Hi Pablan,

The owner was assign in Child Org.Unit and in the creation of the mitigation control but still with this the mitigation control still not appear.

Regards

Re: SAP GRC 10.1 – Mitigation Control Missing

pedro_carvalho2097 — Wed, 27 May 2015 08:19:20 GMT

Hi Rahesh, thanks for your reply.

Hi follow your indications but because we are not using PC component I´m not able to see Buiness processes in master data (NWBC--> Master Data--> Business PRocesses).

What is the purpose of creating processes and subprocesses in NWBC if those were created in SPRO?

Thanks

Re: SAP GRC 10.1 – Mitigation Control Missing

pedro_carvalho2097 — Tue, 02 Jun 2015 16:25:04 GMT

In this case the mitigation control only appears if plan variant of the organizational structure is set to 01. In our case we are using plan variant 013 because we need to import organizational structure from our back end system (in there is set to 013 and we need to replicate this in GRC system for a request approval flow purpose).

Any idea how we can set a different plan variant that is not 01 and maintain the mitigation control functionality on?

Why standard have this behavior between different plan variants and at same time allows changing the plan variant.

Thanks and Regards

Re: SAP GRC 10.1 – Mitigation Control Missing

former_member219087 — Sun, 24 Apr 2016 16:33:00 GMT

Hi all,

I would like to know in which table the org structure is saved in GRC AC 10?

or where we can find the information maintained in master data (org structure)

Kindly let me know

Regards

Re: SAP GRC 10.1 – Mitigation Control Missing

Former Member — Mon, 25 Apr 2016 04:53:12 GMT

Hello Basis kaar,

Check the tables HRP1000 and HRP1001.

For further information, you can start your search by typing HRP* in SE16/SE16n

Regards,

Deepak M

P.S: Please go through the rules of SCN and try searching for the same question in forum and then post the discussion as a separate thread please instead of continuing in the old disuccion. Thanks in advance.

Re: SAP GRC 10.1 – Mitigation Control Missing

Former Member — Tue, 26 Apr 2016 01:08:18 GMT

Hello Pedro,

Please Check this note

190062 - Plan Version recommendation for Mitigation Control

Regards,

Deepak M