06-03 GRC Training - Risk Owners

GRC Training
for
Risk Owners
June 3, 2013
Agenda
Training Session Agenda

Mins
Overview
SOD Project
GRC System
Risk Owner Role
Break
5
Training Materials and GRC

Documentation 5
Risk Owner Role in detail
45
GRC Reports demos / hands on
30
SOD Project Overview
Project Overview
What were the Project Goals

What is an SOD
Why SOD is Important
Project Scope, Team and Approach

GRC Overview
SOD Project Goals

Build a standardized framework of SAP
security roles across all VPF areas which
includes :
Redesigning SAP access roles to be job-based
Ensuring there is adequate Segregation of

Duties
One person does not have end-to-end access to a
business process
Where possible, data entry and approvals are
segregated
Includes some re-assignment actions between jobs,
remediation
Controls in place
Why SOD is Important to

MIT
Prevention of fraud and abuse!
Protecting MITs financial data:
Ensuring adequate access controls are in place
Would you know if a breach occurred?
Business area and specific job focus :
Business Owner: is responsible for work conducted
within the business area. Needs to :
Know what the people in the business area can do
in SAP
Ensure procedures are in place to minimize any
risks
Business Users: should only have transactions
required by their current job
Background
MIT approach to SAP Authorizations
Approach to SAP security has been largely unchanged since implementation
in late 1990s
Distributed
responsibility
Authorizations granted and removed by

several hundred primary authorizers
Segregation of duties not considered
when granting authorizations
Designed around
people, not roles
Not linked to a persons job or

employment status
Individuals with more access than needed
to perform their jobs
Relies on manual
processes
Individuals retain authorizations related

to past jobs, unless manually removed
Requests via email, phone calls
Limited controls and

documentation
No formal controls to identify and address

segregation of duties conflicts, security
risk
Delay in implementing
corrective action
Limited system and business resources

Other implementations have taken
Defining SAP Roles
Project Goal Before and

After
New
Legacy
Employ
ee 1
Customer
Creation
Employ
ee 1
Employ
ee 2
Invoice /
Billing
Vague system for requesting access

No access reports for managers
Employees retained access after transfers
Access determined arbitrarily
Employ
ee 2
Job Role
Job Role
1
2
Custom
er
Invoice
Creatio
/ Billing
n
Lower Risk
High Risk
Segregation
Segregation of
of Duties
Duties
Method
Approach
Access and risks defined, documented,

and monitored
Defined process for modifying access
Defined roles for access ownership and
risk ownership
Mitigation reports
SOD/GRC Project Overall Status

Overall Project Status:
Notes
By 5/9/2013 all but Laurie Farinella
On Target
SOD/GRC Project Progress to Completion
GRC System Overview
SAP GRC Suite
SAP Access Control
SAP Automated Solution:

Access Control
Access Control Analysis
Emergency Access
Management
Emergency Access
Management
Emergency Access
Management
GRC Documentation
Overview
Training Documentation:
Roles and Responsibilities Risk Owner

Flowcharts (5) with detailed step-by-step
descriptions
GRC Report Job Aids
Terminology used in the GRC System and for SAP
Access
Roles and Responsibilities All
Steps for performing an SOD analysis
Associated change request Forms / Checklists
Business events triggering an SAP access change
Additional Documentation:
FireFighter procedures
Risk Owner Role Overview

GRC Processes
Owner
Risk
Involvement
1
2
3
4
5
New or Amended Roles

Very Light
Mitigation Analysis/Design
Medium
New User / Role Provisioning
Very Light
FireFighter Maintenance/Use
Very Light
Periodic Compliance reviews
Medium
BREAK 1
BRIEF 5 MINUTE BREAK
Risk Owner Role Overview

GRC Processes
Owner
Risk
Involvement
1
2
3
4
5
New or Amended Roles

Very Light
Mitigation Analysis/Design
Medium
New User / Role Provisioning
Very Light
FireFighter Maintenance/Use
Very Light
Periodic Compliance reviews
Medium
Risk Owner Role Detail

GRC Processes and Risk Owner involvement
1 New or Amended Roles

Light
Very
Maintain Awareness of new / changed roles
Additional Resource : Events triggering

role changes

GRC Processes and Risk Owner
involvement
2 Mitigation Analysis/Design
Medium
Provide guidance on acceptable level of

risk
When new or amended roles trigger a GRC

Access Risk
Approve Mitigation Controls description /

design
For Mitigation controls assignment to Users -

involvement
3 New User / Role Provisioning

Very Light
Key Concept : use of Composite Roles for a

job
Reduces the provisioning workload and

risk
Role Owner has the responsibility for

this
All the work is now in the Role maintenance

process

involvement
4 FireFighter Maintenance/Use
Light
If Risk Owner is also FireFighter ID owner
Approve Assignment of MIT Users to

FFIDs

involvement
5 Periodic Compliance reviews

Medium
Recertification of Mitigation Control

assignment
Review results of periodic Compliance
reviews
Where unexpected SODs are reported
If Mitigation Control reports have

unusual activity

involvement
Any questions or comments ?
GRC Reports Session

GRC Reporting for Risk
Owners
Goals for Todays GRC Reports Session

Understand how GRC Reporting ties into
your role as Risk Owners
Help you get comfortable with the GRC
Reporting
Introduce you to tools that are available

Have a working session to get familiar with using GRC
Reports
GRC Reports for Risk

Owners
SAP defines Risk Owners as:
The individual employee or employees
who have oversight responsibility
Risk Owners will use GRC Reports to carry
out responsibilities as part of the following
GRC processes:
Process 5: Periodic Compliance Reviews
Status Monitoring (Q10)
GRC Reports for Risk Owners

What is the current risk exposure at MIT
VPF?
01 Risk Violations
Can be run for Users, Roles or Profiles

Does not show what is mitigated
Shows risk counts by Business Processes

02 User Analysis
Can only be run for Users
Shows if risks are mitigated
Shows risk counts by Critical Actions, Roles and

Profiles
Is MIT VPF increasing/decreasing risk

exposure?
GRC Reports: Job Aids

Detailed procedure documents outlining
how to execute each report
Action for each step

Screenshot
Numbered to align with the report number

assigned to each report
Outline page gives info on report use and
different usage scenarios
Include steps for different scenarios
Step numbering diverges for each of the
scenarios
Working Session
Follow the GRC report Job Aids for:
01
02
03
Risk Violations
User Analysis
Violations Comparisons
Working Session
Using GRC Reports to find answers to our
authorizations and SOD questions.
If you have a question, try using the Job Aids
or Reference Documents!
If you still have a question, please feel free
to ask.

06-03 GRC Training - Risk Owners

Uploaded by

Copyright:

Available Formats

06-03 GRC Training - Risk Owners

Uploaded by

Document Information

Original Description:

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

06-03 GRC Training - Risk Owners

Uploaded by

Copyright:

Available Formats

What is the goal of the SOD project?

What is the goal of the SOD project?

What are the responsibilities of a risk owner?

What are the responsibilities of a risk owner?

GRC Training

Training Session Agenda

Training Materials and GRC

GRC Reports demos / hands on

SOD Project Overview

What were the Project Goals

Project Scope, Team and Approach

SOD Project Goals

Redesigning SAP access roles to be job-based

Ensuring there is adequate Segregation of

Why SOD is Important to

Authorizations granted and removed by

Not linked to a persons job or

Individuals retain authorizations related

Limited controls and

No formal controls to identify and address

Limited system and business resources

Defining SAP Roles

Project Goal Before and

Vague system for requesting access

Access and risks defined, documented,

SOD/GRC Project Overall Status

By 5/9/2013 all but Laurie Farinella

SOD/GRC Project Progress to Completion

GRC System Overview

SAP GRC Suite

SAP Access Control

SAP Automated Solution:

Access Control Analysis

Roles and Responsibilities Risk Owner

Risk Owner Role Overview

New or Amended Roles

BRIEF 5 MINUTE BREAK

Risk Owner Role Overview

New or Amended Roles

Risk Owner Role Detail

1 New or Amended Roles

Maintain Awareness of new / changed roles

Additional Resource : Events triggering

Risk Owner Role Detail

Provide guidance on acceptable level of

When new or amended roles trigger a GRC

Approve Mitigation Controls description /

For Mitigation controls assignment to Users -

Risk Owner Role Detail

3 New User / Role Provisioning

Key Concept : use of Composite Roles for a

Reduces the provisioning workload and

Role Owner has the responsibility for

All the work is now in the Role maintenance

Risk Owner Role Detail

If Risk Owner is also FireFighter ID owner

Approve Assignment of MIT Users to

Risk Owner Role Detail

5 Periodic Compliance reviews