CC Ruleset change

Hallo Everyone
in our company we have two Systems , one for production and one for testing.
I am trying to change the ruleset by adding one critical transaction .
In the test system it is working perfectly put not on the production .
On test system we have SP09 and on production SP06.
The steps i follow is -->Rule architect and over Functions i am searching one existing Funtion where we have the Finance critical Tx and add the transaction.
Then i generate the rules..
i tried also creating a new risk with a new function and adding the transaction there. Again it only works in the test system .
Are there any suggestions about what could be wrong ?

Hi David,
Could you please verify the content of the following tables in both envirnonments where you have defined the new risk Id with the critical transaction?
VIRSA_CC_RISK
VIRSA_CC_RISKFUNC
VIRSA_CC_FUNC
VIRSA_CC_FUNCACT
VIRSA_CC_FUNCPRM
VIRSA_CC_CRACT
VIRSA_CC_CRPRM
Compare the content.
Furthermore, which RTA versions do you have installed in the backend of your test and production environment?
Hope it helps. Best regards,
Imanol

Similar Messages

2011 Q3 Ruleset update by SAP

The 2011 ruleset update has now been incorporated into 5.3 Support Pack 17 and 10.0 Support Pack 5 which are both in released status. Please see sap note "1604722 Risk Analysis and Remediation Rule Update Q3 2011" for a full summary of the changes made. Please see sap note "1352498 Support Pack Numbering - GRC Access Control" for information on the support pack numbering for Access Control.
As indicated in this note, the ruleset changes are incorporated into 5.3 SP17 and 10.0 SP 5. For new customers implementing Access Control, the rules contained in these support packs contain the most recent version of the delivered ruleset. See sap note "1033326   Risk Analysis and Remediation Rule Upload guidance" for information on how to find the files in 5.3 and upload. In 10.0, you will activate the appropriate GRAC_RA_RULESET* BC_SETS applicable to your system.
For existing customers, you will need to review the updates made per the Word document included in sap note 1604722 and manually make the changes to your ruleset that you believe are applicable in your environment. It is highly recommended that existing customers DON'T reactivate the BC_SETS in 10.0 or reload the text files in 5.3 as it will overwrite your customization. The only option then is to manually make the changes using the Rule Architect functionality.
Please see related sap notes below for previous ruleset updates and other guidance around rulesets.
1446680     Risk Analysis and Remediation Rule Update Q2 2010
1326497     Risk Analysis and Remediation Rule Update Q2 2009
1173980     Risk Analysis and Remediation Rule Update Q2 2008
1083611     Compliance Calibrator Rule Update Q3 2007
1035070     Compliance Calibrator Rule Update Q1 2007
1061380     Compliance Calibrator Rule Update Q2 2006
986996     GRC Access Control- Best Practice for Rules and Risks
1373465     Rule Upload and Rule Import - Explanation of functions
Jayne

Hi Jane
I know you are no longer involved in this area but I would like to get your opinion. A lot of consulting houses that implement GRC AC recommend that the customer copy the Global ruleset and then only make changes on the copied ruleset. What is your feelings around this. Is it not better (specifically in GRC AC 10.0 that has change logs) to use the Global ruleset?
Chantel

Doubt in Execute Rule Set Action

Hi,
I have seen the following documentation in help doc regarding Execute Ruleset action
'The Execute Ruleset and Execute Flow Ruleset rule script actions result in evaluating and executing another ruleset u2013 either a rete ruleset or a flow ruleset. This action is similar to invoking a ruleset, except that the current value of objects, including variable definitions, are available to the ruleset being invoked (instead of their initial values). If the invoked ruleset changes the value of any of the objects, these are reflected in the initial Flow Ruleset'
I have a rule flow set invoking another rule set in its action script. I need to pass a variable defined in rule flow set to invoked rule set. I did this with following action
Execute Ruleset RuleSet1 On var1.
My doubt is how do i access this in invoked rule set? I didnt see this in invoked rule set.
Regards,
Dhana

Hi Dhana,
'The Execute Ruleset and Execute Flow Ruleset rule script actions result in evaluating and executing another ruleset u2013 either a rete ruleset or a flow ruleset. This action is similar to invoking a ruleset, except that the current value of objects, including variable definitions, are available to the ruleset being invoked (instead of their initial values). If the invoked ruleset changes the value of any of the objects, these are reflected in the initial Flow Ruleset'
What we mean by the stmt above is - In case the action "Execute Ruleset" or "Execute Flow Ruleset" is used, all those global definitions which are modified at the ruleset level will retain their changed value when the other ruleset is evaluated.
This needn't be specifically mentioned using the "ON" option.
This option is provided for a user to pass the current value of objects alone. "except that the current value of objects... are available to the ruleset being invoked"
Your other question related to passing the variable definition created at the flow ruleset level, to be passed to the other ruleset - such a mapping is not yet possible. You will have to define this as a common(global) definition.
Hope this clarifies your doubt.
Best Regards,
Arti

RAR definition documents (from a non-tech perspective)

Prior to actually putting in ruleset changes and mitigating controls into RAR, they are usually defined in spreadsheets, and then reviewed and approved. I was wondering if anyone here could provide me with a sample/template, especially towards defining the mitigating controls.
Much appreciated.
Santosh

The following site has quite a bit of information about SAP FI-CO tips:
[http://www.sap-img.com/sap-fi.htm]
It has some of the more widely used tcodes and tables used in FI-CO, as well as information about why/what/how things are posted to FI and/or CO (not all FI postings go to CO and not all CO postings go to FI). The one area that it doesn't really cover is Enterprise Controlling (EC) of which Profit Center Accounting (PCA) is a submodule.

Scope of GRC for Functional Guy...

Helo ,
I am SAP SD guy ..I have 2.5cyrs. of experience in SAP SD but right this moment i am into SAP GRC implementation project. Is there any bright scope for SAP GRC or else after this impelmentation project i have to go back to SAP SD to for my bread...
David...

Hello David,
Below are some general scope for SAP GRC Access Control.
RAR
1) GRC Configuration
2) Ruleset Design
3) Ruleset Configuration
4) Mitigation Process Design
5) Ruleset Changes Process Design
6) User Training
CUP
1) Workflow Design
2) Workflow Configuration
3) Approver List Process Design
4) Testing Workflow
5) Mitigation Approval
There's more things that I cannot think of at the moment. If you wish to know more, I suggest you read some articles on the phases involved in GRC components. Basically anything requires GRC, and you can be doing audit on CRM solutions with SD knowledge or designing process control, or even designing the ruleset that is used in SAP GRC Access Control. I hope this helps a little.

Team for GRC implementation.

Hi,
I want a information on team for GRC implementation. I mean to say, team members should be of what skill sets for respetive modules.
Is it possible for a pure technical person to take up GRC implementation.
Please suggest.
Thanks in Advance.
Regards,
Pravin

Hi,
Pls find some general scope for SAP GRC Access Control/Implemenation
RAR
1) GRC Configuration
2) Ruleset Design
3) Ruleset Configuration
4) Mitigation Process Design
5) Ruleset Changes Process Design
6) User Training
CUP
1) Workflow Design
2) Workflow Configuration
3) Approver List Process Design
4) Testing Workflow
5) Mitigation Approval
Also chk this link;
1. http://www.sap.com/solutions/grc/index.epx
2. https://www.sdn.sap.com/irj/sdn/bpx-grc
3.pls Go to http://service.sap.com/instguides and search for SAP soultions and then SAP GRC.
There are a lot of PDF documents on Installation, Configuration, Userguides, Master Guides of
SAP GRC applications
Regards
CSM Reddy

The changed ruleSet can't work!

Hi, there
I have invoked a decision service in my bpel process successfully. But now I am trying to change my rule condition to change my business process in running-time. the problem is when I have changed the condition in Rules Author (based on WebDev) the business didn't change according to the new condition, unless I redeploy the bpel process.
Why?

Hi Juan,
The path was an example for the standalone BPEL PM installation. If you have
SOA Suite installed then the directory is
${ORACLE_HOME}/j2ee/<OC4J instance>/applications/......
I'm not sure if i understand the second part of your posting. When you launch rule
author from BPEL console and modify some rule, then after the dictionary is saved
the next BPEL process instance will pick up the new rules.
You need to save to the exact same dictionary version. If you choose another version of the dictionary then the BPEL process will indeed not pick up the modificaitons and you have to redeploy.
Support for file-based rule repositories was added as a kind of developer
convenience to get started without a WebDAV server installation.
For production uses we encourage to use a WebDAV rule repository.
For the file based repository we leave it to the user to synchronize the rule dictionaries that are part of a decision service deployment with the original ones.
Last ut not least, when you modify a rule, make sure that you save the changes
in rule author and when you're finished with all modifications, make sure to save the rule dictionary.
Regards,
Ralf

BRF+ Trigger via Event, change on field value, etc

Hi,
I'm implenting BRF+ for SPM Claims & Returns Process.
It took me a while to understand how I can set up an application, Function from type event, Rulesets, rules, etc but at the end it seems that it is a tremendous improvement compared to BRF!
So far I have triggered the BRF+ via the CRMV_EVENT_CUST table calling a function module that triggers the BRF+ Function and receives an CRM Log message but this solution is not sufficient for all locations I want to call the BRF+.
At first I want to call the BRF+ for the Entryvalidation: Entering a Claim with a item net value below a threashold should not be saveable.
The second call should be to decide if the Claim will be automatically approved or set to manual investigation: This is a check that will lead to a item status change.
The third and last check will be fullfilled by saving the Claim document: a whole set of business rules have to run and set maybe an incompleteness or process some error messages.
I neither any information in SAP Documentation, nor on any ressource on the net any information about customing the BRF+ Solution.
Is there any customizing in the system, as it is for BRF, that allows me to trigger the BRF+ for Business Transaction Category, Business Transaction or ItemCategories?
Furthermore, is there an option to call BRF+ via customizing that "listens" to a field change as Reason Code ( CODEGRUPPE, KATALOGART,CODE in the Subjectprofile?)
Can I define Events that trigger the BRF+ as in the BRF customizing?
When I search the IMG for BRFPLUS, I find a couple of entries, but doubleclicking on this search results doesn't jump to the customizing step.
It would be very helpfull to get some input in these topics.
Kind regards,
Sven

Hi Tiwari,
yes, the screenshot was from CRM-Financial, but available in CRM Transaction Processing:
And I agree to your statement that there is no such customizing, because I neither found this Customizing, except:
Using the search in the customizing IMG, you will find 3 customizing entries with BRF+ or BRFPLUS, but clicking on them you will land in Nirvana, and not in the proper customizing tree.
But still the overall trigger for my message here is, that the BRF could be triggered via Customizing that doesn't seem to exist for BRF+ and that's strange!
I hope someone knows how the replacement of BRF with BRF+ is intended from this customizing point of view. I have to trigger a lot of different functions and using the old BRF I could trigger this Events using this customizing setup.
Thanks,
Sven

Order of variables in calculation manager 11.1.2.2 rulesets

Hi,
We are in the process of migrating all our 11.1.2.1 HBR Sequences to 11.1.2.2 Rulesets. While migrating the sequences to rule sets I came across an issue where the order of the variables displayed in the Ruleset designer "Variables" tab doesn't match the order of the rules in the rulesets. This is not the case with the HBR sequences in EAS where the variables are associated with rules with valid Index.
Eg:
EAS
Order of rules in the Sequence: RuleA, RuleB, RuleC
Order of variable in the Launch Variables Tab: VarA1,VarA2,VarB1,VarB2,VarC1 ( Assuming that VarA1,VarA2 and VarB1,VarB2 and VarC1 are variables associated to rules A,B and C respectively.
Calc Manager
Order of rules in the Sequence: RuleA, RuleB, RuleC
Order of Variables in the Variables tab: VarC1,VarA1,VarA2,VarB1,VarB2 ( Random)
My case is more complex because I'm running the same rule for different values for a particular runtime prompt 38 times and they have to run in a order. Now I couldn't associate the rule with the variable that I'm changing.
I tried creating the sequence from scratch rather than importing it from 11.1.2.1 but no luck. Please help!

Raj,
I opened up the .xml file from the Ruleset export and the "Seq_index"( which specifies the rule to which the variable belongs) and "seq" number (which specifies the variable order) are in the correct order as the rules order in the ruleset. But still the variables are not displayed in correct order in the "Variables" tab of the ruleset.
Eg.
Rule order in the rule set: R1,R2,R3
<variable_references>
<variable_reference id="3772" name="*R1v1*">
<property name="seq"> *2* </property>
<property name="seq_index"> *1* </property>
</variable_reference>
<variable_reference id="3770" name="*R1v2*">
<property name="seq"> *3* </property>
<property name="seq_index"> *1* </property>
</variable_reference>
<variable_reference id="3771" name="*R2v1*">
<property name="seq"> *4* </property>
<property name="seq_index"> *2* </property>
</variable_reference>
<variable_reference id="3773" name="*R2v2*">
<property name="seq"> *5* </property>
<property name="seq_index"> *2* </property>
</variable_reference>
<variable_reference id="3774" name="*R3v1*">
<property name="seq"> *6* </property>
<property name="seq_index"> *3* </property>
</variable_reference>
Displayed order of variables in calcmanager: R2v1,R2v2,R1v1,R1v2,R3v1 (Note that the variables belonging to the same rule are showing up in correct order).
It will be very difficult to me to modify the seq# and index in the xml file as I have 40 rulesets with each having 20 rules and around 5 variables for each rule.
Thanks,
Swaraj.

Append Existing Ruleset with HR Risks & Rules

Our current ruleset does not contain HR risks and rules as it was not part of first implementation. Now we will add HR functionality in ECC and need to add it to our ruleset.
Can I do it like this?
1. Export our current ruleset in Configuration - Utilities - Export
2. Somehow add HR risks & rules that I can download from SAP's original files on SAP Service - Support Portal (as in the installation guide) to the file
3. Import the appended ruleset again in Configuration - Utilitiy - Import
After checking the GRC Configuration Guide and other docs it is still not clear to me. Is there a specific document that can answer my question?
Thanks.
Joe

Hi Joe,
If you have imported standard rule set text files into GRC during first implementation then as part of R/3 function_action, function permission etc., HR related functions and risks also will get uploaded into RAR System and hence you need not change the rule set again. Just check whether those functions and risks are enabled or not.
If you have fully customized rule set then the steps you have mentioned are correct. After uploading the changed files it is better to do a full synch for user, role and permission and run one full Synch batch risk analysis for the entire rule set.
Before making the changes of the rule set, keep a copy as a back up for the rules. Ensure to open the text file in word pad or edit plus and make changes accordingly. Because even a space variation in text file might not result in generation of the new rules.
You can refer to the Import/Export options of utilities in the configuration guide
Thanks and Best Regards,
Srihari.K

Permission level ruleset download.

Hi,
We have unmitigated risks showed up when the risk analysis is done by action level, and those transactions showed up in the transaction usage history(stats) reports, but we use permission level risk analysis in AE and CC, so these risks dont show up and we didn't have to mitigate at the time of provisining.
Now I'm in a stage where I need to prove that unmitigated risks are not really risks as per permission level. Because of the no.of risk ids showed up, i'm looking for some easy way to prove this instead of going by each risk id auth object values and comparing with user access in sap system.
Also, looking for any way to download clean permission level rule set., so I could develop program for comparision. So I tried to download using 'Search permission rules'' report, but the format is not great, would require lot of changes in order to use downloaded for manual comparision in the excel.
Thanks
Laks

SAP_ALL,
Add SAP_ALL to the Permission level ruleset, before downloading.
It will solve your problem.
Thanks,
Lakh

CC 5.2 - Adding delivered rules as second ruleset

We are in the process of upgrading from CC 5.1 to 5.2. In addition to carrying over the custom ruleset that we have created for the company, I have been asked to load the delivered rules as a second ruleset, so that the folks in the compliance department can use them for comparison. I have created rulesets by uploading the 7 files (business_processes.txt, function.txt, risks.txt, etc.) and generating the rules. I have also created entire rulesets from scratch, but I have never done both in the same system, though I understand it can be done. The ruleset we are using right now was built from scratch and has been fine-tuned for the company's needs, so I want to keep it intact. What I would like to know is how I go about uploading the delivered rule files without affecting my existing ruleset. I've already seen a note that says none of the functions or risks can have the same IDs across rulesets, so I'm prepared to make those changes to the upload files. Any assistance will be much appreciated!
Thanks,
Dave

Dave,
You've already considered the main hangup most would encounter with loading another ruleset into CC 5.x-- the need for unique Ids within the elements of the ruleset.
One key item that needs to be specified is the default ruleset because the file upload only uploads into whatever has been specified as the default ruleset. Your current default ruleset is likely your customized ruleset. Create a new ruleset to contain the GRC delivered rules, and temporarily set that as your default ruleset. Perform the upload of the text files (and as you note, a prerequisite is to make sure that all of the business process, function, and risk Ids are unique from what already exists). You can then switch the default ruleset back to normal and proceed with generating the rules in background.
Note that you'll want to do this at a time when there is very little expected activity in the system as it's pretty likely that end users of CC will not realize that the ruleset is different as they perform ad-hoc analysis. Also, Access Enforcer risk analysis is always tied to the default ruleset, so for a few minutes at least, if anyone performs risk analysis in AE, they would receive incorrect results.

Ruleset Corrupted

Hi Gurus,
I had to modify few functions in ruleset by moving few t-codes from one function to another another function. When we transported the changes to production one function got updated with the changes and another function never updated. So I manually, updated that function which corrupted the ruleset and now I can't find any SOD's which were present previously.
I am thinking of uploading the ruleset to production directly instead of transporting it but before that, do I need to delete the existing rules in production and do I need to use Overwrite option instead of Append ?
Please advise how should I proceed ?
i Have generated the sod rules already
Regards,
Salman

Hi Salman,
First: when you modified some of the function by adding or reomving, you are definitely adding the entry (actions/permissions) which is already available in some other functions. So, you need to be sure if duplication is there.
Second: You mentioned GRC doesn't have the capability to capture the deleted stuffs in TR, I think it is everywhere. If you deleted some entries and capture the updated data in TR, then obviously during moving the TR, you would not get the deleted entries.
so, if you are modifying rule sets in DEV then better to get it transported to all of the follow on systems which is the best practice instead of uploading it directly in PRD.
You can have multiple rule sets available in system but you need to make only one of those as default for running risk analysis under parameter 1025.
Hope this clears your concerns.
Regards,
Ameet

Compile participant lists based on rulesets error [BPM 11g]

Hi,
I created a Humantask with participant lists based on rulesets, which I followed the steps in the documents: http://download.oracle.com/docs/cd/E12839_01/integration.1111/e10224/bp_hwfmodel.htm#insertedID3. The section is [To specify participant lists based on rulesets:].
I got the error message during compile:
Buildfile: C:\Oracle\Middleware\jdev_bpm\jdeveloper\bin\ant-sca-compile.xml
scac:
[scac] Validating composite "C:\JDeveloper\mywork\TestApp\TestProj\composite.xml"
[scac] FATAL_ERROR: BPM-71504: 对 'oramds:///soa/shared/workflow/TaskEvidenceService.xsd' 进行语法分析时出现意外错误. Cause: oracle.mds.exception.MDSException: MDS-00054: 要加载 oramds:/soa/shared/workflow/TaskEvidenceService.xsd 的文件不存在。. Action: 请确保文件有效且可以访问
[scac] WARNING: in test.task: Task title not specified
[scac] WARNING: in test.task: Error assignee not specified
[scac] WARNING: in test.task: Payload not specified
BUILD FAILED
C:\Oracle\Middleware\jdev_bpm\jdeveloper\bin\ant-sca-compile.xml:236: Java returned: 1 Check log file : C:\JDeveloper\mywork\TestApp\TestProj\SCA-INF\classes\scac.log for errors
Total time: 8 seconds
It said cannot find oramds:/soa/shared/workflow/TaskEvidenceService.xsd. I have tried many times, even for a new generated project (with no code).
Thanks

This is a known issue, I've opened an SR on it already.
The fix is to manually open the generated .xsd files in your project and change the invalid MDS schema path.
Do a search for oramds:///soa/shared/workflow/TaskEvidenceService.xsd and replace it with oramds:/soa/shared/workflow/TaskEvidenceService.xsd
It appears 2 extra leading slashes get generated erroneously by JDeveloper. Removing the extra slashes should fix it.

Is there a ruleset comparison tool available in the market?

Dear all,
I wanted to know if there is a SAP GRC ruleset comparison tool available in the market? As a part of our audit requirement, I would need to compare our current rulesets with the ones from last quarter - To identify any changes/enhancements.
I know Bizrights Approva supports a comparison tool called ExamXML where we can perform a comparison of 2 XML files and figure out the differences/ changes.
Please let me know if any of you has used such a tool for GRC ruleset comparison.
Thanks,
Kunal

>
Kenguru wrote:
> As a part of our audit requirement, I would need to compare our current rulesets with the ones from last quarter - To identify any changes/enhancements. > Kunal
If any auditor is comparing sap delivered rule sets with a companies' grc rule sets (without deep investigations) and reporting the differences in his/her audit report (as white spaces) then the auditor is doing it the wrong way.
The auditor should be aware of the following facts:
1. SAP delivered rule sets are mere best practices (only starting point)
2. Most of the customers modify/update the rule sets as per their requirements
3. Organizational rules are created by customers differently
4. Some customers don't even choose sap delivered rule sets and completely create their own.
So the difference between rule sets is obvious, but these findings may or may not be entirely appropriate to reach to a conclusion for audit purposes.
Best Regards,
Amol Bharti
http://amudee.com

CC Ruleset change

Similar Messages

Maybe you are looking for