GRC PC 10 - Automated vs Semit Automated Controls

[Former Member]

Hello

We are trying to get a better understanding of how GRC handles automated and semi automated controls. We ran a test where we ran jobs for both and didn't notice any difference.

Can anyone clarify how GRC handles these control types differently?

[Former Member · Accepted solution]

Hi Stacey,

PC enables customers to capture their expectations of how these controls (Automated and Semi automated) should be configured, and how transactions should occur.

Correct configurations ensure that business process steps that those configurations control will always comply with customers intentions; broader transaction monitoring can then be used to cover those situations where configuration-based controls are not enough, or to look for fraud at the margins.

So in continmuation to what Silky has commented, I would like to add-up:

PC semi-automated monitoring can also help individuals to perform the control function e.g. a person responsible for reviewing and approving purchases might want to look at background information on the requester, vendor, pricing trends, etc. before making a decision. Workflow can route the requisition itself to his or her inbox, but PC automated monitoring can provide the additional information needed to actually reach good decisions.

Semi-automated: HR Payroll report listing new employees scheduled to run monthly and sent to appropriate user via workflow to verify.

Automated: configuration check to verify that no changes have been made affecting status and posting to reconciliation accounts

Hope this helps.

Regards,

Ameet

Message was edited by: Ameet kumar

[former_member197694 · Accepted solution]

Hi Stacey,

Both automated and semi-automated controls can be to schedule it with the function "Automated monitoring" in PC10.

Automated Controls:CCM is a solution to continuously monitor automated controls in real time. A good example are controls based on configuration settings. Using CCM a control owner can be notified when these settings change. Controls monitored by this solution save time and money to the organization, as they are triggered only when needed, allowing the process and control owners to focus on other tasks in the mean time.

Semi-Automated controls:For example a system generated report needs to be reviewed and signed-off, can also be monitored using CCM.

BR

Baithi

[Former Member]

Hi Stacey,

Hope you werw able to get your queries answered with the suggested solutions.

now be kind to mark as answered and close this thread unless you have any questions.

Regards,

Ameet

[former_member205878]

Hi Stacey,

The basic difference between Automated and Semiautomated Control is -

1. In Automated Control issue is created and in Submitted Status. Here you can assign a remediation plan for the issue and also other activities like reassigning the issue.

2. In Semiautomated Control the issue will be in draft status and remediation plan cannot be assigned. Here the issue should be submitted. Here the issue recieved by the tester to check and confirm it is issue else he can void it.

In Configuration it is not possible to separate the task between automated and semi automated.

The differentation happens in the code and sends for testing or for remediation depending upon whether control is automated or semi automated.

I hope I am able to explain you the difference.

Regards,

Silky Sharma

[Former Member]

Good day Silky,

I would like to ask if you mean the 'control automation' within local control? In my tests in PC10.0 I've made this into semi-automated, but the control tester is stil unable to review the item in his work inbox.

The work items still enter the work inbox with the status of submitted and control owners automatically have the ability to remediate or void the issue.

Thank you.

Best Regards,

Raphael R. R. Ramos