Question Re: GRC Reports and Analytics in Additional Q&A

GRC Reports and Analytics

former_member251721 — Mon, 19 Sep 2016 08:30:19 GMT

Hi Folks

For the much experienced GRC 10 Consultants I would like to ask: what are the most, say 10 or 20, GRC reports a GRC/SAP Security Consultant will run on daily, weekly, monthly or annually as part of GRC/SAP Security work operations.

regards

Massoud

Re: GRC Reports and Analytics

alessandr0 — Mon, 19 Sep 2016 13:31:22 GMT

Massoud,

I work with several clients and this depends on the setup. Each company is different and uses different processes and functionalities. Therefore there is no guideline what and how often should be analyzed. E.g. if you are using Access Request Management to provision users, then you maybe want to check open requests, overdue requests, maybe you are using SLAs, then you need to check them, etc. etc. etc.

Hope this helps.

Regards,

Alessandro

Re: GRC Reports and Analytics

former_member251721 — Mon, 19 Sep 2016 22:33:32 GMT

HI Alessandro

Thanks for the reply. May be I should have been more specific.

I am new to GRC10 hence the question. But I have history with older versions.

If you for example look at the header " access management" under the Reports and analytic you will see there are over 47 reports. Surely, not all of them will be used on the operation of GRC on daily or weekly basis by the GRC consultant or other stake holders/responsible who need GRC for its reports. ?

regards

Massoud

Re: GRC Reports and Analytics

alessandr0 — Tue, 20 Sep 2016 11:36:02 GMT

Massoud,

as I mentioned it depends on the setup. Personally I do use these reports once I have to check something. E.g. with the UAR History Report or UAR Status Report I check the status after I have ran UAR reviews. Others like Requests with conflicts and mitigations can be used to analyze requests.

Rather than the Reports and Analytics tab I more often use the application "Search Request" and "Provisioning Logs".

It all depends on your function and what you need to check. There is no right or wrong.

Regards,

Alessandro

Re: GRC Reports and Analytics

Former Member — Tue, 20 Sep 2016 12:06:49 GMT

Massoud,

As a GRC admin, my experience is much like Alessandro's: I too use the Search Request function more often than the reports on the Reports and Analytics tab. It is only when specific questions arise, such as questions about the mitigated objects or the available mitigating controls, that I need to run any of those reports. They are more for the business, and it is your job as the GRC expert to figure out which of those reports will meet the needs of your business users. If you do not yet know what the pain points of your business users are, you might need to ask them. We run the SOD reports on users and roles and distribute them monthly as a courtesy to our key users, and the User Access Review reports are run during UAR periods. There is no way that Alessandro or anyone here can tell you which ones will be helpful to you or to your users. That is for you to figure out, by running them and seeing what information is returned. That is why they pay you the big bucks

Gretchen