how to setup a report for every mitigating controls? We added monitors but the monitor doesn't have any reports to run.
and what is the roles & responsibility of a monitor?
These mitigation reports are to be defined by consultants, which are either standard SAP Transaction codes viz. ME33 QA33 etc. or Customised T codes. These reports can be standard SAP or Customised reports for mitigation controls.
The monitors will periodically get alerts from GRC to review the Mitigation reports and they have to run the reports and take appropriate action as required in Mitigation control.