Application Development and Automation Discussions
Join the discussions or start your own on all things application development, including tools and APIs, programming models, and keeping your skills sharp.
I think SAP has provided the Standard roles as templates which need to be tailored to meet the requirements for your Company.
It is not recommendable to use them directly and talk to your Security team who will work on drafting new roles based on the requirements.
Make sure that you properly segregate the tcodes when creating the new roles as some SAP standard roles may contain SoD conflicts.
I dont think you upload the roles into SAP GRC, you rather upload the GRC rulesets applicable for SoD conflict management for all the roles and users in the SAP System.
GRC tools are one way of automating some controls. They offer more functionality and greater ease of use than the standard tools do.
They certainly aren't needed but they do have benefits in some situations. Segregation of duties analysis is easier than doing it manually or configuring RSUSR008_009_NEW
GRC as a subject (rather than a product) can be managed in many ways, including using pre-existing SAP tools.
Best justification is your organization risk strategy.
It can be usefull in many situation. There is cost involved, I often seen organization justifies cost against the security policies and prevention, protection strategies. It also depends on your company's goal that which product that you would use.
SAP has standard reports which can also serve the same purpose however this tools would facilitate you to achieve more efficiently.
SAP GRC is a very broad SoD tool that is intended to establish the following in the SAP and non SAP Systems in the Organization:
Access Controls
Process Controls
Risk Management
Global Trade Management
Implementing Green Practices(Making your company Environmental friendly)
and other areas where there is Social and Corporate responsibility
I think what you are talking is only from the Access Controls perspective and it is only one of the applications to deal with and SAP GRC does give outstanding solutions available with the latest version 5.3 in the following:
Risk Analysis and Remediation
Enterprise Role Management
Compliant User Provisioning
Super User Privilege Management
So SAP GRC applications has so much breadth and width that it extends to all directions of Corporate Governance and Risk Management and you can't acheive with a few reports in SAP.
Bluesky
