ARQ: Risk Mitigation Mandatory and Request Forward causing problem???

[former_member184114]

Hi,

I have a scenario where in, at a certain stage, "Risk Mitigation" is made mandatory and also "Forward Request" option is available at this stage for the same approver.

What is happening is that, when this approver tries to approve the request without mitigating the risks, it gives error message and request can not be approved. This is fine and going as per the configuration.

Now the same approver is trying to forward the request to some other person for some business reasons (with "WITH RETURN" check box checked and disabled). This request is reaching to the desired recipient as expected. But the problem is that, when after providing his comments (a business requirement before mitigating risks, if need be) if he tries to approve (submit) the request, application gives the same error message that: "Request can not be submitted. Mitigate Risk XYZ"!

Due to this, request can not be submitted and sent back to main approver! I noticed that, the request still lies on the same stage and the same stage configuration is being considered for this forwardee too!

This is keeping the request hanging as this forwadee is not authorized to mitigate the risks.

Can any one please help me resolve this?

Regards,

Faisal

[Former Member · Accepted solution]

Hi Fazal,

I don't see any configuration issues in here but the authorization issues at the approver where the request was forwarded (for business reasons, as mentioend by you).

And ofcourse, if the approver doesn't have the authorizations to mitigate the risk then he will not be able to submit or to mitigate the risk. You need to provide him/her with the respective authorizations.

Ameet

[former_member184114 · Accepted solution]

Ameet,

Thanks for your reply.

The requirement is that, the forwardee (to whom the request is forwarded) is not supposed to mitigate the risks and just have to provide the justifications (if needed). Then it must be sent back to the main approver, who is supposed to mitigate all the risks at his level.

May I know how to achieve this? Or is there any better way to configure this?

Regards,

Faisal

[former_member184114 · Accepted solution]

can you please help me?

[alessandr0 · Accepted solution]

Faisal,

forwarding a request means that the request still remains at the same stage. Actually you just forward to someone else to get someone else's approval. I have a similar scenario where the responsible for mitigation forwards the request to a process owner to get some clarification. The process owner makes some comments and sends the request back via forward option.

As "Submit" always indicates an approval it's wrong from my understanding and therefore we use the forward button.

Also forwarding a requests with return means that someone else gives the approval, but for your information it comes back to you. You can also see that in the Audit Log, as the forwardee (as you called him) gives his approval.

So as I understand you correctly you would like to send the request to someone else to get some information and then send it back to the approval for mitigation and final approval. Therefore the "with return" option is not correct from my understanding.

Hope you understand my consideration in that case.

Regards,

Alessandro

[former_member184114 · Accepted solution]

Alessandro,

Thanks for your reply.

Now I see (as confirmed) that we have technical limitation or application design that when we forward a request, it DOES NOT change the stage (even I noticed this). So I was thinking that only we have "SUBMIT" button to send it back to the main approver.

But as you said, this forwardee can use the same "Forward Request" option instead of "Submit" button. This looks the option here which suits the situation.

But can you please tell me if we can do something to inform the forwardee that he must select "Forward Request" option and not Submit button?

Because, this submit button is visible and he can click it without knowing! And then this error message of Mandatory risk analysis then appears!

Is there any work around?

Please advise.

Regards,

Faisal

[alessandr0 · Accepted solution]

Hi Faisal,

not with standard functionality. For example you can change the notification template for forwarded requests which contains some information. But this might affect all requests which are forwarded (e.g. also when a manager forwards the request). Alternatively you can change the error message that says you have to forward the request to someone else, but this is also a global setting and it will be seen by all users).

Personally I would take an eye on trainings so that the users are well informed and know the process. If you make the comment option while forwarding mandatory the user who forwards the request can type in some short comment that he seeks for more information. Then the user knows he has to provide some information and sends the request back.

What I do not understand: to how many users do you forward a request? And also how many users do mitigation?

If it's only a handful of users it might be enough to provide some trainings and documents.

Regards,

Alessandro

[former_member184114 · Accepted solution]

Alessandro,

Thank you very much for sharing this again.

I got it now. Just to check quickly, may I know how I can set comments mandatory while forwarding the request?

Please advise.

Regards,

Faisal

[alessandr0 · Accepted solution]

Faisal,

as far as I know it cannot be achieved with parameters or customizing. Hence you ned an ABAPler who sets the field as mandatory. Maybe can help you with that.

Regards,

Alessandro

[former_member184114 · Accepted solution]

Alessandro,

I noticed that after mitigating risks, when the approver tries to approve the request, still the error message appears to mitigate the risks and all the risk ids are shown in the error message!

From my experience and system behavior, I believe that the risk analysis is not performed automatically by the application (in the background or so) as soon as the risks are mitigated due to which, risk violation report is not updated and this error message is shown.

May I know if we can do something about this? Like, available risks should be removed from "Risk Violations" tab as soon as risks are mitigated and then request should be allowed to submit?

Hoping to listen from you.

Regards,

Faisal

[alessandr0 · Accepted solution]

Hi Faisal,

as the systems checks for the last risk analysis you have to re-run after mitigation. Please be aware that the risk analysis is a real-time analysis and hence you have to run manually again.

As soon as all risks are either mitigated or remediated the request can be approved.

I do not know any configuration to avoid that and personally also not recommend.

Regards,

Alessandro

[former_member184114 · Accepted solution]

Ok, I would go with this standard way