ARA report

Question

Hello,
Just configured GRC 10.1 system
done all prerequisite.
I need few help
1) when i run Risk analysis for a user if i select for permission level work fine,for action level also fine, for critical action also fine.But when i select critical action and permission both it only show me risk which are with critical action nothing for permission level.
2)In remediation view i have selected role remove option it created access request for role removal.But when i cancelled that request it still shows in report that a request with Request number is already created for role removal, even though i cancelled the request .
Regards,
Prasant

Answer 1

Hi Prashant,
SAP delivered rule set doesn't contain any critical permission so if you are running the risk violations reports on standard one, you won't see any risks on the same.
So, yes you are right about creating a function ID which would contain only permission but no actions and while mapping this function to the risk ID you can define the risk as "critical permission" and then you would see the reports only critical permission level.
The first time you mentioned you are unable to see the risk reports at critical permission, I realized that you are using SAP delivered rule set and not the custom one.
About cancellation of the request:
I have very well gone through with your post. But after cancelling the instance there can't be any possibility that you could still see the request at not cancelled status; as I am also using AC10.1 with SP06 (not sure which SP are you on) so sometimes by cancelling the requests' instance manually, in order to enforce this action I check with the report: GRFNMW_MANUAL_INSTANCE_CANCEL and if this shows that the request is cancelled then it is cancelled for sure. So, my advice was just to run this report and check for your request once.
Could you kindly furnish the snap shot for your request status under this report...?
Regards,
Ameet