on 02-08-2016 11:10 PM
Hi Experts,
My access requests are getting approved even if risks are not mitigated in the access request.
parameter 1062 set to No
1072 Yes
In SPRO maintain application mapping -> request mitigation policy is set to default.
working on GRC 10.1 SP12
Please can someone help me here?
Regards,
Ram
Did you set risk analysis mandatory for SOD_OWNER stage ?
Thanks
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.
Hi Ram Krishna,
SAP has released Note for this and please follow this note steps and and do the changes
1614290 - Risk Analysis Mandatory for Access Request
SAP delivers a predefined Application and BRF rule mapping that decides the Risk Mitigation policy for GRC. You can either delete this mapping or change the BRF mapping as per your requirement to enforce the Approver to Mitigate the risk in a request.
The configuration is available through the below mentioned path.
SPRO =>Governance, Risk and Compliance =>Access Control =>Maintain AC Applications and BRFplus Function Mapping and check the mapping for application "Request Mitigation Policy".
With Regards
Trinadh Bokka
Hi Experts,
Is there a way to make mitigation of high risk mandatory but we can have unmitigated medium and low risk in a ARM request?
Our Business requires us to provision access request for medium and low risk without mitigation. They just want us to make the mitigation of high risk mandatory while provisioning.
Currently we have a setup which will not allow any access request to be provisioned with open risks (irrespective of the critical level)
Thanks
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.
Hi,
Please check parameter 1072 (Risk Analysis - Access Request) is set to YES
1072 - Mitigation of critical risk required before approving the request
Regards,
Rakesh Kirve
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.
Please check this note if it helps : 1667440 - AC10 - Workflow Stage Task Settings for 'Approve Despite Risks'
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.
Hi Harsha,
Thank you for your response.
I am trying these notes. I think both of them suggest to delete the Request Mitigation Policy
Below path needs to be followed.
SPRO =>Governance, Risk and Compliance =>Access Control =>Maintain AC Applications and BRFplus Function Mapping and check the mapping for application "Request Mitigation Policy".
1667440 - AC10 - Workflow Stage Task Settings for 'Approve Despite Risks'
1614290 - Risk Analysis Mandatory for Access Request
Will update once the issue is resolved.
Regards,
Ram
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.