GRC AC Help

Question

Hello community!
I´m working in a new GRC AC implementation, I never did it before and in a first momment I thought it should not be so hard,well... looks like I was wrong. In a first moment I should implement only BRM and ARM. Users should be able to manage roles from all plugged systems through GRC AC and also your the default workflows for access request and approval.
I´m following the guide http://www.sdn.sap.com/irj/scn/go/portal/prtroot/docs/library/uuid/80063a8e-1da6-2e10-aaa5-fda1f0936c37?QuickLink=index&… for BRM but seems like some steps are not present.
I´m wondering if someone with implementation experiance can give me answers for the questions bellow:
1 - How long in average a project for ARM and BRM implemetation takes? Considering an almost "default" implementation.
2 - Can someone send me a schedule task for the AC implementation? So I can use it as a base for my schedule.
3 - I purchased the "Implementing SAP Governace, Risk, and Compliance" book from the SAP Press website. Basically the book and the guide aforementioned are my references. If someone can contribute commenting or sending new references I would really appreciate.
Thanks in advance,
Pedro

Answer 1

Hi Podro,
See my answers embedded below.
Pedro Botega wrote:
1 - How long in average a project for ARM and BRM implemetation takes? Considering an almost "default" implementation.
It really depends on how many systems you are going to be connecting to the GRC system and of what types (i.e. ECC, SRM, BW, Portal, non-ABAP etc). Additionally it also depends on how complex your custom Access Approval workflow may be. In addition, if you are a big company, you may phase your Go-lives by regions, hence lengthening the effort not just technically, but in terms of finalising and agreeing the GRC business processes, test phases and training etc.....in short, there is a lot to think about and consider.
2 - Can someone send me a schedule task for the AC implementation? So I can use it as a base for my schedule.
Most companies retain this as their own IP, so probably not. However, from experience, a simple implementation of GRC AC with ARA/EAM from start to finish should not take more than 3 months (being very generous here!). A full on implementation involving all 4 modules (ARA, EAM, ARM, BRM) can be simple and last a generous 4/5 months if the approval flows are designed simple (or the SAP delivered workflows are used).
However, if the landscape gets technically complex (number of target systems and 3rd party systems etc) and the approval flows get complex, you could be looking at a 5-10 month project. Sometimes the customer could have multiple test phases and dry runs, making the project last longer(!). If you are implementing BRM to build your rules from start to end, expect some challenges, hence adding time. Needless to say, delays are easily caused by technical gremlins within the product itself. Start befriending SAP Support marketplace and digging for new SNOTES
Some companies offer a Rapid Deployment capability (both SAP and 3rd Party specialists). This would be worth researching into if you wish to save some money in terms of implementation costs.
3 - I purchased the "Implementing SAP Governace, Risk, and Compliance" book from the SAP Press website. Basically the book and the guide aforementioned are my references. If someone can contribute commenting or sending new references I would really appreciate.
Personally, I would start reading the documents on this page SAP Access Control 10.0 and obviously dig around this SCN forum, there are enough talented individuals sharing their experience on this thread and alot of your future questions are likely to have been already asked/discussed/answered on this forum also