GRC AC ARA v10 SP13 - Org Rule Org Level Missing

Hi Experts!
Testing ARA Organization Rules soon and have noticed that one of my key Org Levels, $BUKRS, is missing. I have not yet used this functionality on this system. I am already doing the following:
running the authorization sync job daily (we are in the middle of multiple project builds)
checked the target systems USORG table for Org Level $BUKRS entry.
active ruleset function has that Org Level $BUKRS entry and it appears on the Risk Analysis reports
All other Org Levels are available to use except for this one. Any ideas!
Thanks in advance.
-john

Alessandro,
Ran both sync jobs again, but it is still not (see below). Checked the logs to be sure it completed.
We do have two different ECC system connectors (One Production landscape, the other Project landscape), but both have the USORG table for Org Level $BUKRS entry.
Any other ideas? Is there a GRC ARA GRAC* table I can update or check for this?
Thanks,
-john

Similar Messages

GRC 10: How to upload Org Level Rules in GRC 10?

Hello Friends,
we have implemented GRC 10 recently but missed to move org level rules from GRC 5.3 to 10. I don't see an option to load org rules in SPRO. Can you please let me know how can i load org rules from 5.3 to 10 with out disturbing the existing risks / functions? or is there an option to update tables directly for org rules?

Hi Colleen Lee,
Thank you for your response. Yes i see Master Data > Exception Access Rules > Organizational Rules and i am able to create org rules but i am trying to find an option to upload all at a time as we have around 50 org rules and have 2600 lines in it. creating manually will take so long and looking for alternate.
Thanks & Regards
Pradeepthi

GRC BRM: Update Org Levels of derived roles

Dear GRC experts,
we are using the GRC BRM Master Derived concept and have around 100 Master roles in place.
I understand that the Org Levels of derived roles are only once set per Org Value Map during the initial (Mass) Derivation.
If we add a transation like VA01 to a Master role this also adds some new Org Levels to the Master role. Via "Propagate to Derived roles" the new transaction and object values are added into the Derived roles.
For the new Org Levels these are added also but the values are not the one from the Org Value Map of the Derived role but exactly the same values of the Master Role.
Using "Derived Role Org. values Update" does not help us here to update the corresponding Derived roles as no change to the Org Value Map has been done.
In case a Master role has 40 different Derived roles associated this would require to update manually any of the Derived roles for adjusting the new Org Levels.
Does anybody know how to automate this task?
Many thanks for your help!
Regards,
Markus

Hi Markus Richter
Once you maintain the imparting role and propagate to the derived role, the derived roles will inherit the new org values from the imparting. So that at least has the org values in the derived roles but not the correct values
Next up is to try to use the Mass Maintain Roles to update the derived roles with correct values from the org map (ensure org maps were updated first) mentioned in post
Mass Child role Org value update in GRC 10
Does this work for you as an approach?
Regards
Colleen

Migrate SAP GRC AC 5.3 SP13 (System A - System B)

Hello all,
currently we have setup 2 SAP GRC AC 5.3 SP13 SAP instances (DEV / PRD) for the customer's SAP ERP system landscape. Those systems also contain some customer business functionality.
Because of business requirements the PRD Java Instance needs to be deleted and built up again from scratch with another WebAS Java Release Version (same SID, same Hardware, etc.).
Our plan is now to setup a dedicated Java instance which will contain the PRD installation of SAP GRC AC (new SID, different hardware, etc.) to avoid similar problems in the future. Therefore we have to migrate all of the RAR data from the "old" Java instance to the newly setup Java system. We especially need to migrate all of the RAR analysis data (e.g. SoD violation analyses of previous months, etc.), otherwise we would loose all of this information when the "old" installation is deleted and built up again.
I have checked all of the SAP documentation for SAP GRC AC 5.3 and only found these clues:
In document "SAP GRC AC 5.3 Configuration Guide v3.16 - Chapter Utilities -> Export Utility / Import Utility" it only says
something about exporting / importing rule sets, mititgating controls, etc. Can these tools also be used to export / import
analysis data too ?
In document "SAP GRC AC 5.3 Installation Guide v2.2 - Chapter Post-System Copy Configuration" it only says something about
steps to be executed if the SAP GRC AC installation was done via system copy. But there is no information about migrating RAR analysis data.
In document "SAP GRC AC 5.3 Operations Guide v2.1 - 7.2 Backup strategies" it says that in order to restore the system "you need to back up all tables with the following prefixes: VIRSA and VT". Can we simply do a backup of all of those tables, import
them into the database of the new system and the use the export/import utility to move all of the configuration etc. from the old system to the new one ?
Regards,
Benjamin
Edited by: Benjamin Schlotz on Jun 30, 2011 11:57 AM

Hello Sunny, hello Frank,
thanks for the quick replies.
I did know about the SNOTE regarding the post migration steps, but the To-Do's Frank posted had some additional info in them.
One question remains still open though:
How to actually migrate all the GRC AC RAR data (incl. old analysis data) from System A to System B
Our intended course of action would be:
1. Deploy SAP GRC AC on System B (same Version, SP-level etc. as in System A)
2. Export all VIRSA* and VT* tables from DB of System A, import them all in DB of system B
3. Export all configuration, etc. from System A, import it into System B (using the export / import functionality within RAR)
4. Do all the post-migration tasks described by you
Would you agree with that course of action / know any pitfalls, etc ? We need to have all the "old" RAR analysis data from System A in System B after the migration because System A will be shutdown and deleted.
Regards,
Benjamin

ERM -- unable to determine matching org. level for BRGRU in the system

Hello,
I have a problem.
When I trY to import in the ERM (SAP GRC AC 5.3 SP5) a mass import of roles (derived roles) using the template Organizational Template.
Some of the roles gives me this error:
"Role not imported; unable to determine matching org. level for BRGRU in the system".
In the file I put for example
ZAPVAPINTE BUKRS 0083
Am I doing it right? or do I have to put $BURKS?
Best regards.
Pablo Mortera.

I have found that when you run the background job "syncronization of the organizational values" it pulls the org value name and all "values" assigned to it. If you don't have values specified (on the table level) for the org name, you get this error. We have many fields that we use values for these fields but they aren't specified in the table.
For example: We have the org value "PLVAR" with the values "AL", "01", "02", "03", and "GB" assigned to it. You can actually see these values in the backend system using SE11. We do not get this error on this org value. However, we have another org value "SACHZ" that we use, but we do not have any values assigned to it on the table level, so it is giving us this error. We are trying to find out how to populate the "values" field since this was not done through configuration.
Here are the steps: (1) Go to SE11 in your backend system. (2) Put your org value (example: PLVAR) in the "DATA TYPE" field and click display. (3) Double click on the Domain name. (4) Go to the Value Range Tab and click on the "Value Table" name if there is one. This is the table that has the org values assigned in it - normally done through configuration. (5) go to Utilities --> table contents --> display. (6) execute the table contents. These are the values that the sync job pulls over. If there are no values there or if there is no "values table" name, you get the error. If there are values there, you don't get it.
We are working with our technical team to get the values in these fields to see if that works. Another quick way to see if there are values assigned to the org field is to use "Org Value Mapping" in ERM. Select the "derived org level field" you want to see and click on the "org value from" magnifying glass. If no values are there, a "values table" hasn't been populated in SE11.
It doesn't make much sense to me though because we can still use values for these fields for our derived roles....we just don't populate the table with them.
I'll update this message if we find a solution.
Thanks,
Peggy

User group [$CLASS] not an Org level field in IA, whereas it is in DA

Hi All,
We have an authorization problem that we faced while SAP Upgrade. In the development system while we upgraded all the roles, we did not face any issue. User group field [$CLASS] was actually an org level field in that system and the roles were upgraded based on that condition.
When the Integration system was up and the upgraded roles were transported to IA, we noticed that they ended with a warning. On checking the logs we found out that User group [CLASS] actually was not an Org level value in the INtegration system, whereas it was an org level field in the development system.
Can someone tell me the reason why it is different? Is there any settings we have to change to make User group an org level field in IA. Thanks a lot for your help.
Vijith

Hello, I ran into this also and found these notes to explain why this is suddenly an org value and how to fix it:
http://search.sap.com/notes?id=0001580048
http://search.sap.com/notes?id=0001739055
Basically, GRC 10 add-on makes the user group an org value and the note instructs how to undo this manually, but there is a required pre-requisite because you cannot modify this for SAP delivered fields normally.
You know what else would be nice.... maybe there's a note that explains why Account Type is an org value. It REALLY should not be, IMO.

Mass Role Import -- 9000 derived roles with 9 org Levels, how to get TXT

Hello,
I hava a problem.
I want to use the (Mass Role Import) Bulk Role Import element in the ERM (SAP GRC AC 5.3 )for importing SAP roles (I only found that way to import roles from SAP).
I have 100 primary roles and more or less 9000 derived roles with 9 org Levels.
Is there a way to get this 9000 derived roles with their 9 org Levels in a TXT file?. Or do I have to do it manually this part to insert it in the "Bulk Role Import ".
Can someone help me?
Thank you in advance.
Pablo Mortera.

Hi Mike,
what kind of TA´s are in your role. Is it possible to integrate a "dummy" TA (without conflicting
your SOD)?
In my example I have CO TA´s bundled in a role:
Role: ZXXXX_O:CO_ORDERMANAGER_CRE - CO Order Manager Pflege
with
KO01 Create Internal Order ...
KO02 Change Order ...
KO04 Order Manager ...
KOK2 Collective Proc. Internal Orders ...
KOK4 Aut. Collect. Proc. Internal Orders
update this role with TA KO01 and KOKRS will be available for derivation.
Done this manually without import in ERM.
Reg,
Ulrich

Can we do risk analysis at org level

Hello experts,
can we do risk analysis in sap grc at org levels.
sanjay

Hi Sanjay,
In RAR , under the Tab informer -> Risk analysis , you can trigger the risk analysis at Org Level.
Regards
-Ranjiv

Org Level, fund center/cost center level restriction for tcodes????

I am looking to see whether org level restriction and cost center/fund center level restriction is possible for certain set of transactions.
I am using USOBX table for this analysis. This table has a check flag field ( same as in SU24) which says whether the Tcode (program) does the authority check for certain auth objects. Example- X (checked but not maintained in USOBT). This table pulls up several authorization objects under the 'X' category. However, when I do the System trace for the same tcode, all the objects (marked as X) are not captured. Instead only a few are captured.
Can we rely on the USOBX data or should we do system Trace for every tcode. I am just pulling a report and not creating roles at this point. So trace is time consuming. But data reliability is equally important.
My objective is to verify whether org level and cost center/fund center level restriction is possible or not for some tcodes.
Do you have any suggestion to achieve this faster (through USOBX or any other means)?
Thanks in advance
Kee

I would suggest you to check USOBX_C and USOBT_C instead of USOBX and USOBT as it will have your customization as well and not just the standard ones given by SAP.
Also when check field is X ...it means the object is checked but not maintained for the t-code as you already said but I am not sure how much it will help you as the they will not be pulled by PFCG when you are creating the role until you change the object to Check / maintain . When you do that the check field will be Y and not X. So basically it is the Y one which you need to see.
Going for trace is time consuming for every t-code and I am not sure if it really needed. When your roles are in testing phase and are tested by the functional team or the team which needs it and if they are missing some object, you can run a trace and find the missing object....
I am not sure on what basis you want to change some field to Org level ...but typically it is done if you want to do segregation of roles based on these org level. There could be various other reasons and it is better to talk to your functional counterparts before changing a field to Org level.
for ex : If you want to segregate on company code, you will create co. code as Org level and create roles for different company code.

How to Inactive Item Status at Org Level

How to Inactive Item Status at Org Level and what are the implications of doing so.
What are the prerequisits before inactivating an item status.
The Procedure I am following is
Changing the Item Attribute control to Org Level for Item Status
Log on to Organization Items and Selecting the Item Status as Inactive.
Can any one please let me know what are the pre requisits before Inactivating an Items and The procedure I am following is correct.
Thanks
Srinivasa Garikipati

Hi;
Please check serial attribute and org attribute problems with item master and see its helpful
Also you can check:
http://oz1-n.blogspot.com/2009/06/interview-questions-for-oracle-11i-apps.html part
1. Once an item is assigned to an organization, is it possible to remove this association at a later time?
2. How do I inactivate an item?
Regard
Helios

New Org Level impact in existing roles

Hi,
I would like to set/create 2 fields as organizational levels. For example KLART and DOKAR. Checking these I realized there is a big amount of roles "affected" by this change.
Because I plan to use the organizational level only for new roles , I would like to know which impact could have this change for existing roles, should one modify the existing roles after creating the Org Levels ? or in contrast they still work as always an no changes / adjustments is needed?
Thanks and regards
FedeX

Thanks Bernhard,
I have a question
As I mentioned before my goal is that the existing roles keep working after running that program... and do not want to perform any adaptation....only if there is a real error that avoid work correctly.
In these 2 cases the role will keep working properly ( I mean restricting in the way that it uses to do).
1) In case field is copied to the Orglevel area after running the program and the value(s) will stay in both places (OrgLevel and Original place)
2) In case field is NOT copied to the Orglevel area after running the program but the value still in the original place .
right?
Thanks
FedeX

Adjust manually changed Object field as per org level values

HI,
I have a role wherein a field maintained at org. level has been changes in object manually. hence it no more follows the the org. level values assigned.
The requirement is "this object should get adjusted for its field to have values as per the org. level values" As I remember there is a SAP standard report that when executed for this role, will correct the object and we will be able to again have it's field values aligned with org. level values.
I am not able to recollect or find the name of the report.
Need help!!
Thanks.
~ Pranali

That this option is available in any authorization which is not copied from a standard one is still a mystery to me...
I normally just check for them to see whether someone toasted the role and solve the root cause problem. Training is the hard way.
Solution: Delete the authorization and open the role again to maintain the org. level.
As this is in a development system generally, there are some pre-requisites though to be able to avoid it. Role admin is a very specialized task and everyone always wants more.
Sandbox systems are cool places to mix the two of them and let people be creative with prototypes etc. Development systems also have feelings and enemies...
Cheers,
Julius

Role Expert: Org values Missing

Hi,
I ran the 3 Backgrnd jobs in sequential way: Org Value/Transaction/Activity Sync jobs and jobs were completed with no errors. I checked the log files and i see no major errors as well.
But after completing the jobs, i tried creating a role and assign the org values to the role. But i dont see the org values under each org levels such as Company Code, Sales org etc..
Did I miss any config steps here?
Thanks
Sundaram

Hello All,
Even we faced this issue and was resolved by running the three BG jobs again but in a sequence as follows:
1. Transaction Sync.
2. Object Sync.
3. Activity Sync.
Please try this and lemme know if you still face an issue with the same.
Regards,
Hersh.

EXTEND VENDOR FROM PURCHASE ORG LEVEL TO CO CODE LEVEL

Dear friends,
I have create a vendor master at purchase organization level using T code mk01, Now want to extend it to company code level, please suggest me how to extend vendor code form purchase oganiztion level to company code,
With regards,
ARABBAS
Note : Please search forum before posting
Edited by: Jeyakanthan A on May 30, 2011 9:48 PM

Hi
MK01 can be used for maintaining the vendor details at the purchasing org level & for general data
FK01 can be used for maintaining the vendor details at the company code level & for general data.
XK01 can be used for maintaining the vendor details at the company code , purchasing org level and general data
if wnat extend vendor at company code level,then use t-code xk01 or fk01
check following link
[Vendor create]
Regards
Kailas Ugale

Vendor - MArk for Deletion at Comp code & Pur Org Level

Hi Gurus
I want a list of vendors (about 150 Vendor) to be Marked for Deletion at Comp code & Pur Org Level
How to proceed ?

hi,
To be able to archive, you must set the deletion flag in the master record. You can set this flag for a complete vendor or for individual company codes or purchasing organizations.
You can archive data from different tables using the archiving object FI_ACCPAYB...
Mark a vendor for deletion centrally as follows:
Choose Master records ->Maintain centrally -->Mark for deletion.
The initial screen appears.
Enter the vendor account number and, if you wish, the company code and a purchasing organization.
If you do not specify the key for a purchasing organization, you cannot delete this area at a later date, should you wish to.
Select ENTER .
The screen for specifying data for deletion appears.
Select data to mark for deletion by clicking next to the appropriate field.
Save your entries by choosing Vendor ->Save.
The system displays the initial screen, with a message confirming that the data has been saved.
Mark a vendor master record for deletion for the Accounting Department as follows:
Choose Master records -> Mark for deletion.
The system displays the initial screen.
Enter the vendor's account number and the company code.
Select ENTER .
The system displays the screen for selecting areas to mark for deletion.
Select the data either in the company code or in all areas to mark for deletion.
If you click next to the All areas field, the system will later delete all data for all company codes and for all purchasing areas in this vendor master record.
Save your entries by choosing Vendor -> Save.
After you mark a vendor master record for deletion, you can still post to the vendor account. This is necessary, since you might still need to clear open items. When you post, the system issues a warning that you are posting to an account that is marked for deletion.
Displaying Archived Vendor Master Data
To display single documents for the archiving object FI_ACCPAYB using Archive Information System you require an information structure that has been created based on one of the following standard field catalogs provided by SAP:
●     SAP_FI_ACCPAY_1 (vendor master data FI)
●     SAP_FIACCPAY_2 (vendor master data SD)
Each information structure must be active and filled.
Edited by: Priyanka Paltanwale on Aug 21, 2008 9:09 AM

GRC AC ARA v10 SP13 - Org Rule Org Level Missing

Similar Messages

Maybe you are looking for