GRC - The bigger picture

Question

Hi guys, what kind of framework or approach do you use when trying to implement GRC in an organization ? Of course we know SAP has access controls, process controls, RM, repository etc... but i do not think any companies can implement all of them together.. is there interesting implementation which you guys like to share?

Answer 1

Dear Peter,
Access Control : Unfortunately, the cost in money and resources to ensure compliance with access control, segregation of duties, and compliant user provisioning on an ongoing basis can be overwhelming for many companies.
As access control, proper segregation of duties, and compliant provisioning must be managed by a solution that spans all core business processes across all enterprise application software. A central policy repository can then ensure consistency across the enterprise.
Third, the solution must be able to demonstrate compliance across the enterprise. It must maintain auditable records that internal and external auditors as well as regulators can use to verify compliance. Some relevant audit questions in the access control area include the following:
• What access risks are monitored?
• Which access risks have been properly mitigated?
• Who has access to a given system?
• Who granted access and when?
• Was it properly approved?
Process Control :The solution must enforce accountability and enable transparency so that business owners and executives can ultimately sign off on their attestations with confidence. As a result, compliance issues such as access control, proper segregation of duties, and compliant provisioning must be managed by a solution that spans all core business processes across all enterprise application software. A central policy repository can then ensure consistency across the enterprise.
From an IT perspective, this enterprise readiness translates into a number of requirements. First, IT managers want an application delivered with a predefined best-practice library of comprehensive cross-process and cross-application policies. On one hand, this vast number of policy rules must be easy to enhance and to adjust as the business changes. On the other hand, rules must be granular
enough to address all of the details of enterprise application software, catching all the violations without producing false positives.
Second, the solution must empower employees across the enterprise. Efficient and effective collaboration between business and IT is one of the keys to success here. Automation and dynamic workflow options not only ensure reliability and repeatability of the solution by avoiding manual errors and establishing institutional
knowledge; they also accelerate processes and increase efficiency. Third, the solution must be able to demonstrate compliance across the enterprise. It must maintain auditable records that internal and external auditors as well as regulators can use to verify compliance. Some relevant audit questions in the access control area include the following:
• What access risks are monitored?
• Which access risks have been properly mitigated?
• Who has access to a given system?
• Who granted access and when?
• Was it properly approved?
Repository: A central policy repository can then ensure consistency across the enterprise.
From an IT perspective, this enterprise readiness translates into a number of requirements. First, IT managers want an application delivered with a predefined best-practice library of comprehensive cross-process and cross-application policies. On one hand, this vast number of policy rules must be easy to enhance and to adjust as the business changes. On the other hand, rules must be granular
enough to address all of the details of enterprise application software, catching all the violations without producing false positives. Second, the solution must empower employees across the enterprise. Efficient and effective collaboration between business and IT is one of the keys to success here. Automation and dynamic workflow options not only ensure reliability and repeatability of
the solution by avoiding manual errors and establishing institutional knowledge; they also accelerate processes and increase efficiency.
Third, the solution must be able to demonstrate compliance across the enterprise. It must maintain auditable records that internal and external auditors as well as regulators can use to verify compliance.
Some relevant audit questions in the access control area include the following:
• What access risks are monitored?
• Which access risks have been properly mitigated?
• Who has access to a given system?
• Who granted access and when?
• Was it properly approved?
Based on the above facts you can decide whether or not you will have implement all or not.
Regards,
Naveen.