AC 10- BRM Unable to delete Role in Stucked Phase: Request Approval Pending

[Akshay_G]

Hi Folks,

I am setting up BRM in GRC AC 10 SP05.

As per the post-install steps i have created, a role owner user, also maintained it as Role Owner in AC Owners.

As I am using the default 7 Step role methodology, I have set up a default MSMP workflow for role approval as:

1) Process Global Settings: Process ID SAP_GRAC_ROLE_APPR

5) Stage Settings --> Agent ID --> GRAC_ROLE_APPROVER

    Task Settings --> Any one Approver, Approve, Reject etc.

Then I saved/simulated and activated the workflow.

Next i defined a technical role and assigned Role Approver (created earlier) and also tagged it as Assignment Approver and Role Content Approver.

I defined the role, maintained authorizations, analyzed risks, derived role and Inititated Approval Request.

Now the approval request should go to the Role Owner (who is also the Role Content Approver) so that he/she can approve it and i can generate roles.

But the approver hasn't received any such request in Workflow Inbox.

So when i am checking the request status, by clicking on Instance Status i see that Path is GRAC_DEFAULT_PATH but no approvers are displayed over there.

Also audit log just says that Role Submitted for approval.

This seems strange, what have i missed out?

I can't even delete the role as it is locked (approval pending).

Please help to:

1) Delete this role

2) Route the request correctly to the role owner so that he may approve it.

Regards,

Akshay.

[Colleen · Accepted solution]

Hi Akshay

Request 1

You can cancel workflow request via program below

GRFNMW_BATCH_STALE_REQUEST

Select the MSMP process Id. I generally enter 0 day for Period to capture all workflows in progress

Request 2

Have you checked/completed the workflow configuration for agent assignment and event linkages?

• Governance, Risk and Compliance > General Settings > Workflow >Perform Task-Specific Customizing

Look at the SAP Help information on the IMG task to explain what you need to do

[Akshay_G · Accepted solution]

Hi Colleen,

Much thanks for the prompt response.

Request 1:

I tried executing the program to cancel workflow request with correct inputs, but on execution it says "No Instances to Cancel". I even tried doing by including option "Abort if could not cancel"

Unfortunately, the status is still the same. Pending for approval.

How can I get through this?

Request 2:

I just changed the role methodology and removed the approval step and was able to create a technical and a business role. I will now go through what you have recommended to include role approval as well in my role designing process.

Colleen, Can you suggest me one advise?

We are exploring GRC AC 10 for our client. I have already got Test Cases/Functionality testing done for EAM & ARA which is working absolutely fine. Now we are trying to catchup with BRM and will conclude with ARM (Provisioning) then we are planning to implement in our landscape.

The issue is that this exploration started long back and was halted after we upgraded GRC AC to support pack 09. We observed that post upgrade the NWBC menu's disappeared. This was a known issue and we followed the SAP's correction but due to time crunches we had to restore the system back to SP05 in order to test functionality and present it to the business.

Can you please advise about GRC upgrade. I am learning that a lot of corrections have been included since then?

Thanks Much

Regards,

Akshay.

[Colleen · Accepted solution]

Hi Akshay

I can't really comment on upgrade, especially in relation to your landscape. I found that going to the lastest SP (or at least n-1) removes quite a few issues (whether you call them enhancements or bugs). However, you then find yourself with a new set of challenges

If you are going to consider SP (which, being on 5 at the moment and 13 is available, I would consider it) you will need to regression test your EAM and ARA to ensure you do not introduce errors.

Possibly look at KB articles

• 1798871  - How to remove the unwanted Work Items from Work Inbox
• 1742041  - Cancelling the requests stuck due to Workflow error

They both mention another program - GRFNMW_MANUAL_INSTANCE_CANCEL

Check transaction GRFNMW_DBGMONITOR_WD - MSMP Instance Runtime Monitor  to see what status is (if still looking for agent)

Possibly because you have changed configuration to remove workflow it may be cancelled?

[Akshay_G · Accepted solution]

Colleen,

Thanks for pointing in the right direction. I was able to get through the issue.

1) Program GRFNMW_MANUAL_INSTANCE_CANCEL cancelled the MSMP workflow request successfully, after which i was able to delete the role.

2) Will check for workflow configuration for agent assignment and event linkages now, to include approval in Role Designing Process.

3) Thanks for providing feedback on GRC SP Upgrade. I think we will cover up the basic GRC AC Functionality for all the 4 modules and present it to Business and then will upgrade GRC. Yes you are absolutely correct, we will have to do thorough testing this time.

Have a nice day!

Best Regards,

Akshay.