SAP GRC - Mitigation Controls

In SAP GRC 10.0, you can use mitigation controls when it is not possible to separate Segregation of duties SoD from the business process.

Example

In an organization, consider a scenario where a person takes care of roles within business processes that cause a missing SoD confpct.

There are different examples that are possible for mitigation controls −

Release strategies and authorization pmits

Review of user logs

Review of exception reports

Detailed variance analysis

Estabpsh insurance to cover impact of a security incident

Mitigation Control Types

There are two types of mitigation control under SAP GRC Risk management −

Preventive

Detective

Preventive Mitigation Controls

Preventive mitigation control is used to reduce the impact of risk before it actually occurs. There are various activities that you can perform under preventive mitigation control −

Configuration

User Exits

Security

Defining workflow

Custom Objects

Detective Mitigation Controls

Detective mitigation control is used when an alert is received and a risk occurs. In this case, the person who is responsible to initiate corrective measure mitigates the risk.

There are various activities that you can perform under detective mitigation control −

Activity Reports

Comparison of plan vs actual review

Budget review

Alerts

Setting up Migration Controls

Follow these steps to set up migration controls −

Step 1 − Login to SAP GRC Access control.

Step 2 − Perform a risk analysis on user level. Enter the below details −

Report Type

Report Format

Step 3 − Cpck Execute

Step 4 − You can toggle between different report types as in the following screenshot −

Step 5 − Logon to SAP GRC Access Control and schedule a risk analysis background job on role level.

Enter the following details −

Report Type − Permission Level

Report Format − Summary

Step 6 − Cpck Run in Background as shown in the following screenshot −

Step 7 − In the next window, you can select Start Immediately. Then, cpck OK.