SAP GRC Interview Questions

SAP Governance, Risk and Compliance solution enables organization to manage regulations and compliance and remove any risk in managing organizations key operations. As per changing market situation organizations are growing and rapidly changing and inappropriate documents, spreadsheets are not acceptable for external auditors and regulators.

SAP GRC helps organization to manage their regulations and compliance and you can perform following activities −

• Easy integration of GRC activities into existing process and automating key GRC activities.

• Low complexity and managing risk efficiently.

• Improve risk management activities.

• Managing fraud in business processed and audit management effectively.

• Organizations perform better and companies can protect their values.

• SAP GRC solution consists of three main areas: Analyze, manage and monitor.

• SAP GRC Access Control
• SAP GRC Process Control
• SAP GRC Risk Management
• SAP GRC Audit Management
• SAP GRC Fraud Management
• GRC Global Trade Services

To mitigate risk in an organization, it is required to perform risk control as part of compliance and regulation practice. Responsibilities should be clearly defined, managing role provisioning and managing access for super user is critical for managing risk in an organization.

SAP GRC Process control is used to monitor task and reports in real time and you can generate compliance status of controls in place as per business processes and aligning business processes to perform risk prevention and mitigation.

SAP GRC Risk management allows you to manage risk management activities. You can do advance planning to identify risk in business and implement measures to manage risk and allow you to make better decision that improves the performance of business.

Risks come in many forms −

• Operational Risk
• Strategic Risk
• Compliance Risk
• Financial Risk

This is used to improve the audit management process in an organization by documenting artifacts, organizing work papers, and creating audit reports. You can easily integrate with other governance, risk and compliance solution and enables organizations to align audit management policies with business goals.

SAP GRC Fraud management tool helps organizations to detect and prevent frauds at early stage and hence reducing minimizing the business loss. Scans can be performed on huge amount of data in real time with more accuracy and fraudent activities can be easily identified.

SAP Fraud management software can help organizations with following capabilities −

• Easy investigation and documentation of fraud cases.

• Increase the system alert and responsiveness to prevent fraudent activities to happen more frequently in future.

• Easy scanning of high volumes of transactions and business data.

SAP GRC GTS software helps organizations to enhance cross border supply within limits of international trade management. It helps in reducing the penalty of risks from International Trade Regulation authorities.

It provides centralize global trade management process with a single repository for all compliance master data and content irrespective of size of an organization.

Yes, using T-code: EWZ5

Authorization objects are groups of authorization field that are used to regulate activities in SAP system. All the objects come under Authorization class and grouped by different functional areas like Finance, accounting, etc.

SAP GRC access control uses UME roles to control the user authorization in the system. An administrator can use actions which represents the smallest entity of UME role that a user can use to build access rights.

One UME role can contain actions from one or more applications. You have to assign UME roles to users in User management engine (UME).

User management engine (UME). When a user does not have access to a certain tab, the tab will not display upon user logon when user try to access that tab. When a UME action for a tab is assigned to that particular user, only then he will be able to access that function.

All available standard UME actions for CC tabs can be found in the tab “Assigned Actions” of the Admin User.

CC.ReportingView

Description: Compliance Calibrator Display and Reporting

CC.RuleMaintenance

Description: Compliance Calibrator Rule Maintenance

CC.MitMaintenance

Description: Compliance Calibrator Mitigation Maintenance

CC.Administration

Description: Compliance Calibrator Administration and Basis Configuration

Risk Analysis and Remediation (RAR) −

In GRC access control, you can use Risk Analysis and Remediation (RAR) capability to perform security audit and segregation of duties (SoD) analysis. It is a tool which can be used to identify, analyze, and resolve risk and audit issues linked to regulatory compliance.

Access control and process control shares the compliance structure in below areas −

• In process control solution, controls are used as mitigation control in access control under SAP GRC 10.0 solution.

• Access control and process control share same organization.

• In process control, processes are used as business processes in access control.

• Process control and access control are integrated with access risk analysis to monitor segregation of duties SoD.

• GRC Role assignment
• Process Control planner
• Risk Management Planner
• Central Delegation

Internal audit management allows you to process the information from Risk management and Process control to use in audit planning. Audit proposal can be transferred to audit management for processing when required and audit items can be used to generate issues for reporting. IAM provides you a place where you can perform complete audit planning, create audit items, define audit universe and create and view audit reports and audit issues.

In Internal Audit Management work center you can perform various activities −

• Audit Universe contains auditable entities
• Audit Risk Rating
• Audit planning to define procedure for audit compliance
• Audit issues from audit actions
• Audit reports to see what risks are there on auditable entities

Audit Universe contains audit entities which can be classified as Business units, Lob’s or departments. Audit entities define the audit planning strategy and these can be linked to Process control and Risk management to find risks, controls, etc.

Audit Risk rating is used to define the criteria for an organization to find risk rating and establish ranking for risk rating. Each audible entity is rated as per management feedback in ARR. You can use ARR to perform the below −

• You can find set of auditable entities and risk factors

• Define and evaluate risk scores for risk factor in each auditable entity.

• As per risk score, you can rate the auditable entity.

• You can also generate an Audit plan from ARR by comparing risk scores for different auditable entities. Selecting the high risk score auditable entities and generate audit proposal and audit plan proposal.

Reports and Analytics Work center is shared by Process Control, Risk management and access control. The Process Control Reports and Analytics work center consists of Compliance section in GRC application.

In compliance section, you can create various reports under Process Control.

Evaluation Status Dashboard −

Shows a high-level picture of the overall status of corporate compliance throughout different business entities and provides analytics and drilldown capabilities to view data on different levels and dimensions.

Survey Results −

Displays the results of surveys.

Datasheet −

Provides comprehensive information on master data, evaluation, and remediation activities for subprocesses and controls.

In every business, it is required to perform Segregation of Duties risk management starting from Risk recognition to rule building validation and various other risk management activities to follow continuous compliance.

As per different roles, there is need to perform Segregation of Duties in GRC system.

Business Process Owners −

• Identify risks and approve risks for monitoring.
• Approve remediation involving user access.
• Design controls to mitigate conflicts.
• Communicate access assignments or role changes.
• Perform proactive continuous compliance.

Senior Officers −

• Approve or reject risks bet ween business areas
• Approve mitigation controls for selected risks

Security Administrators −

• Assume ownership of GRC tools and security process
• Design and maintain rules to identify risk conditions
• Customize GRC roles to enforce roles and responsibilities
• Analyze and remediate SoD conflicts at role level

Auditors −

• Perform risk assessment on a regular basis
• Provide specific requirements for audit purposes
• Perform periodic testing of rules and mitigation controls
• Act as liaison bet ween external auditors

SoD Rule Keeper −

• Perform GRC tool configuration and administration
• Maintain controls over rules to ensure integrity
• Act as liaison bet ween basis and GRC support center

There are various phases in risk management process −

• Risk Recognition
• Rule Building and Validation
• Analysis
• Remediation
• Mitigation
• Continuous Compliance

• Risk Recognition
• Rule Building and Validation
• Analysis
• Remediation
• Mitigation
• Continuous Compliance

• Reference the best practices rules for environment
• Validating the rules
• Customize rules and test
• Verify against test user and role cases

Risk should be classified as per the company policy. There are various risk classifications that you can define as per risk priority and company policy −

Critical −

Critical classification is done for risks that contains company’s critical assets that are very likely to be compromised by fraud or system disruptions.

High −

This includes physical or monetary loss or system-wide disruption includes fraud, loss of any asset or failure of a system.

Medium −

This includes multiple system disruption like overwriting master data in the system.

Low −

This includes risk where the productivity losses or system failures compromised by fraud or system disruptions and loss is minimum.

The BRFplus decision table does not contain the appropriate condition.

Preventive mitigation control is used to reduce the impact of risk before it actually occurs. There are various activities that you can perform under preventive mitigation control −

• Configuration
• User Exits
• Security
• Defining workflow
• Custom Objects

Detective Mitigation Controls −

Detective mitigation control is used when an alert is received and a risk occurs. In this case the person who is responsible to initiate corrective measure to mitigate the risk.

There are various activities that you can perform under detective mitigation control −

• Activity Reports
• Comparison of plan vs actual review
• Budget review
• Alerts

In SAP GRC 10.0 Superuser privilege management needs to be implemented in your organization to eliminate the excessive authorizations and risks that your company experiences with the current emergency user approach.

• You can allow Superuser to perform emergency activities within a controlled and auditable environment

• Using Superuser, you can report all the user activities accessing higher authorization privileges.

• You can generates an audit trail, which can be used to document reasons for using higher access privileges.

• This Audit trail can be used for SOX compliance

Superuser can act as firefighter and have the following additional capabilities −

• It can be used to perform tasks outside of their normal role or profile in an emergency situation.

• Only certain individuals (owners) can assign Firefighter IDs

• It allows an extended capability is provided to users while creating an auditing layer to monitor and record usage.

You can use following standard roles can be used for super user privilege management.

/VIRSA/Z_VFAT_ADMINISTRATOR −

• Ability to configure Firefighter
• Assign Firefighter role owners and controllers to Firefighter IDs
• Run Reports

/VIRSA/Z_VFAT_ID_OWNER −

• Assign Firefighter IDs to Firefighter users
• Upload, download, and view Firefighter history log

Use T-Code: Transaction: /n/VIRSA/ZVFAT_V01

Below are the key advantages of using Global Trade Services −

• It helps in reducing the cost and effort of managing compliance for global trading.

• It can ease time-consuming manual tasks and helps in improving the productivity.

• Reduces the penalties for trade compliance violations

• It helps you to create and improve the brand and image and avoid trade with sanctioned or denied parties.

• Better Customer satisfaction and improve the quality of service.

• It fastens the inbound and outbound processes by performing customs clearance and also helps in removing unnecessary delays.

For Single role, you can add/delete Transaction codes while in derived roles you can’t add T-codes.

User buffer stores all the authorization of a user.

You can assign 14000 transactions to a role.

Using SM18 Transaction Codes.

Implementing firefighter ID’s consists of following steps −

• Creating Firefighter ID’s for each business process area
• Next is to assign necessary roles and profiles to carry firefighting tasks.
• You shouldn’t assign profile SAP_ALL

Collection of multiple rules is known as rule set. In GRC, we have default rule set known as Global rule set.

Using PFCG_TIME_DEPENDANCY back ground job.

GRC landscape has 2 systems −

• SAP GRC Dev
• SAP GRC PRD and there is no quality system.

SOD is implemented in SAP system to detect and monitor fraud in business transactions.

Table USR40 is used to store all illegal password details.

You need to assign following roles to user to login to GRS system −

• Portal authorization
• Applicable PFCG roles
• PFCG roles for access control, process control and risk management