How to Carry forward Open Issues after Sign-off in SAP GRC Process Control

[former_member205446]

SAP Process Control (PC) offers sign-off functionality to formalize accountability for the status of internal controls across the organizational hierarchy. Some companies use the sign-off process to support certain regulatory requirements such as the Section 302 attestation required by the Sarbanes-Oxley Act of 2002. Other companies use sign-off primarily as a method of letting upper management know the organization owners who report to them have reviewed internal control test results and are aware of open and closed issues related to the tests.

 

This blog talks about the Carry forwarding work open issues open Issues including assessment, testing and remediation plans , which are not yet processed in the timeframe, before Sign-off. Certain activities are performed automatically by the system, and no involvement by the business user is required. However, it is important for selected users (for example, those supporting other users) to understand what happens and why.

 

It is common that some evaluations, open issues, and remediation plans cannot be completed or closed before sign-off. To produce meaningful historical reports, however, these items should continue to be shown as open as of the end of the sign-off period, while enabling issues and remediation plans

 

Carry forward job is scheduled before Sign-Off by following the IMG:

GRC-> Process Control-> Sign-Off-> Carry Forward Open Issues After Sign-off

 



From my experience, I have seen several customers insisted on documenting the whole process.

As a reference, the end to end process to Carry forward Open issues after Sign-off in Process Control is illustrated below.

 

Consider, for example,

Organization "TEST_SIGNOFF_ORG" existed under Corporate Organization.



Relevant sub-process 'TEST_SUBPROCESS1_SIGNOFF' and ''TEST_SUBPROCESS2_SIGNOFF' existed under the Organization 'TEST_SIGNOFF_ORG'.



Sub-process Design Assessment created for January 2017 timeframe for the sub-process

'TEST_SUBPROCESS1_SIGNOFF'.



 

 

Remediate issue workflow task exists in user 'Siddhant Sachan' inbox.





The status of the workflow task is 'No Carryforward'.



Similarly, Sub-process Design Assessment is created for the sub-process 'TEST_SUBPROCESS2_SIGNOFF' in January 2017 timeframe.

 

The relevant 'Remediation Plan' reaches the inbox of the user 'Gaurav Chaudhary'.





 

The status of the Remediation Plan is 'No Carryforward'.

 



Now Sign-off is planned for the January 2017 timeframe.

 



Relevant sign-off owner completes the Sign-off workflow for the Organization ' TEST_SIGNOFF_ORG'.

 







In SM37, we can verify that the job is created in Active Status to carryforward the objects.

 



& successfully finished.

 



The previous workflow id '619771' and '619798' are logically deleted after sign-off from user inbox and new work item id(s) '619854' and '619857' are generated.

Both work items are regenerated in relevant 'Issue Owner' and 'Plan Owner' inbox after Sign-Off.



Swi1 logs for your reference.





Same work item appear in the Inbox of the 'Issue Owner'- Siddhant Sachan.



The carry forward status is 'Carry forward without Target Timeframe'.



The plan owner 'Gaurav Chaudhary' also has the 'Create Remediation Plan' to process.



The carry forward status is 'Carry forward without Target Timeframe'.

 



The plan owner 'Gaurav Chaudhary' also has the 'Create Remediation Plan' to process.



The status of the task is 'Carry forward without Target Timeframe'.



The end result is that users will continue to be able to work on open issues and remediation plans, and close them in a period after sign-off without impacting reporting as of the sign-off date.