Re: Virsa Compliance Calibrator & Pre-defined SOD Rule Set

Hi All,
We have installed the Virsa Compliance calibrator 5.1 in our sandbox environment. When we goto the "Rule Architect" tab under Compliance calibrator using tcode /virsa/zvrat it brings up the page with Rules information.
Per the Virsa documents that i read they have mentioned that there are pre-defined SOD Rules (Transaction codes and Tcode objects) that we can use in the Rule Architect.
My question is how do i enable and use those pre-set SOD Rules that Virsa provides by default. I do not see them under the Rule architect tab though. Can someone give some pointers to use these pre-set SOD rules.
Thanks & Regards
-Murali

Hi Laziz,
Thanks for your patience in replying to my CC 5.1 queries. I did follow your steps for the Generate Rule & Background Job-> Schedule Analysis and scheduled the job immediate.
However, when i looked up the status of the scheduled analysis Background Job-> Search pulls up the job i scheduled at the top it reads "Job scheduler Status: unknown error" . I clicked on "View Log" button and it shows some messages as shown below (Note: I am just posting some parts of the error msgs below. but it still goes for 1 page...)
May 16, 2007 1:09:07 PM com.virsa.cc.xsys.bg.BgJobDaemon init
INFO: *** BgJobDaemon loaded
May 16, 2007 1:11:09 PM com.virsa.cc.common.util.ConfigUtil setDefaultJ2EEParam
WARNING: Cannot get Application URL: null. PLEASE SET 'Background Daemon URL' IN CONFIGURATION TAB
java.lang.NullPointerException
     at com.virsa.cc.common.util.ConfigUtil.setDefaultJ2EEParam(ConfigUtil.java:203)
     at com.virsa.cc.common.util.ConfigUtil.getBgJobStartURL(ConfigUtil.java:192)
     at com.virsa.cc.xsys.bg.AnalysisDaemonThread.run(AnalysisDaemonThread.java:45)
     at java.lang.Thread.run(Thread.java:534)
May 16, 2007 1:24:37 PM com.virsa.cc.extreport.JarClassLoader loadClassData
FINEST: class name: com.virsa.cc.extreport.ReportPack50SP1_01.ReportPack50SP1_01 class: com/virsa/cc/extreport/ReportPack50SP1_01/ReportPack50SP1_01.class
May 16, 2007 1:24:37 PM com.virsa.cc.extreport.JarClassLoader loadClassData
FINEST: Jar Entry length=1568 compressed size=1568 actual read=1568
May 16, 2007 1:24:37 PM com.virsa.cc.extreport.JarClassLoader loadClassData
FINEST: class name: com.virsa.cc.extreport.ReportPack50SP1_01.CrtActbyRsk_Act_RskLvl class: com/virsa/cc/extreport/ReportPack50SP1_01/CrtActbyRsk_Act_RskLvl.class
May 16, 2007 1:24:37 PM com.virsa.cc.extreport.JarClassLoader loadClassData
FINEST: Jar Entry length=13210 compressed size=13210 actual read=13210
May 16, 2007 1:24:37 PM com.virsa.cc.extreport.JarClassLoader loadClassData
FINEST: class name: com.virsa.cc.extreport.ReportPack50SP1_01.CrtRolbyRsk class: com/virsa/cc/extreport/ReportPack50SP1_01/CrtRolbyRsk.class
May 16, 2007 1:24:37 PM com.virsa.cc.extreport.JarClassLoader loadClassData
FINEST: Jar Entry length=19287 compressed size=19287 actual read=19287
May 16, 2007 1:24:37 PM com.virsa.cc.extreport.JarClassLoader loadClassData
FINEST: class name: com.virsa.cc.extreport.ReportPack50SP1_01.CrtProfbyRsk class: com/virsa/cc/extreport/ReportPack50SP1_01/CrtProfbyRsk.class
May 16, 2007 1:24:37 PM com.virsa.cc.extreport.JarClassLoader loadClassData
FINEST: Jar Entry length=12807 compressed size=12807 actual read=12807
May 16, 2007 1:24:37 PM com.virsa.cc.extreport.JarClassLoader loadClassData
FINEST: class name: com.virsa.cc.extreport.ReportPack50SP1_01.UsersbyOrgLevels class: com/virsa/cc/extreport/ReportPack50SP1_01/UsersbyOrgLevels.class
May 16, 2007 1:24:37 PM com.virsa.cc.extreport.JarClassLoader loadClassData
FINEST: Jar Entry length=18557 compressed size=18557 actual read=18557
May 16, 2007 1:24:59 PM com.virsa.cc.common.util.ConfigUtil setDefaultJ2EEParam
WARNING: Cannot get Application URL: null. PLEASE SET 'Background Daemon URL' IN CONFIGURATION TAB
java.lang.NullPointerException
I am not sure whats causing this and it's been 2hrs since i scheduled the user analysis but i don't see any data still appearing in the fron-end..Any pointers again???
Thanks
-Murali

Similar Messages

Update on Management View in VIRSA Compliance Calibrator 5.2

Hello,
is there a way to delete the Data for the Management View in VIRSA Compliance Calibrator 5.2 and then make a full new data load.
When I select Full Synchronisation and Management Reports in the Schedule Analysis, the system does not update the Management View correctly, the Management Report shows still roles which are already deleted in the SAP-System.
Thanks

Hi,
You can do a Full sync of Users and Roles first which will be ovewrite and then run the Batch Risk Analysis Management Reports.
You can try this exercise first if it does not work then go ahead with Alpesh's advice.
Thanks
Darshan

SoD rule set Download issue

Hi All,
While downloading the SoD rule set (Global), I am not getting the data for Function-Action and Function-Permission, except these, rest of the data are coming.
But, I can get to see these data under tables: GRACFUNCACT and GRACFUNCPRM.
so obviously we can't have these data exported from table and to get converted into .txt format to upload SoD.
GRCFND_A is at SP14.
Please help in getting this issue resolved.
Thanks,
Ameet

Hi Ameet,
You have to reactivate it each time you install a SP in order to get the updates.
If you develelop your own SoD ruleset you wont use the SAP standard functions and risk, so reactivate the BC Set wont cause any problem.
If you change the standard functions and risks (which is wrong) such changes will be overwritten when reactivate the BC Set.
After reactivating the BC set you'll be able to download SoD rules fom the logical system SAP_R3_LG.
Cheers,
Diego.

4.6C to ECC 6.0 upgrade - Issue with Virsa Compliance Calibrator

The issue is that phase IS_SELECT during the PREPARE is not detecting VIRSA as an add-on. This of course will result in VIRSA not being upgraded and the system will be unstable ( note 989368 ). Also, I can't choose to delete the add-on either.
We installed the compliance calibrator before SAP purchased VIRSA. So, the tool was installed through transports, not SAINT. I assume this is why phase IS_SELECT is not seeing the tool.
Any ideas?
-Scott

Received a reply from SAP. Since VIRSA was installed through STMS the IS_SELECT phase will not see the add-on. I had to do the ECC 6 upgrade as normal and then install VIRSA 4.0 for SAP 700 systems through SAINT.
I had to clear SPDD and SPAU as much as possible for /VIRSA/* objects. However, there were six objects I could not clear. This did not cause any issues.
Notes 1006083 and 985617 are needed for this procedure.
Thanks for all the suggestions.
-Scott

Virsa compliance calibrator

Hi All
Can anyone help. I want to know if anyone has any documentation/ and or screen shots on Versa, as I know nothing about it.
Thanks in advance. You can send info to [email protected]
Mark

Hi Leandro
Thank you for your reply. I require as much info on 5.1 as you can get. I know nothing about the compliance calibrator and I want to rectify that.
Thanks
Mark

SAP IS-Media SoD Rule Set

Hi Everyone
I would like to know if anyone have a rule set for the IS-Media SAP solution, specially for the M/SD and M/PS modules

Hi Ricardo,
A few years ago I was looking for IS specific rule sets also, but it seems that there is no SAP standard developed version openly available. I know some GRC implementing specialists (and audit companies) have built up so called "Starter" rule sets for IS solutions, but to get your hands on it, you would have to involve them in your project and allow them to devise a custom governance framework and rule set for your company (i.e. pay for their services and intellectual property).
From personal experience, if you have a confident understanding of the SAP standard rule set, you could relate IS specific t codes to the standard ECC tcodes and make custom functions and risks similar to the ones in the SAP standard rule set.
In addition, I would also get function specialists, Internal and External Audit involved and see if any risks have been reported in regards to your IS-Media transactions/processes and see if you can write your own rules up with the information at hand.
If you feel you have little confidence in trying to device your custom rules and instead need the professional help, it may be worth reaching out to your auditors or the GRC specialists to help you devise the ruleset.
Hope that helps.

Updating Compliance Calibrator Rule Set

The business has decided to change a few rules by removing a couple of custom tcodes from the rule set. In DEV I go into the Function and remove the objects associated with the tcode and disable the tcode. After running the rule set update there is still some sort of tie. I have created a test ID in DEV with a known issue around each of the changes. I'm not getting a different result when running compliance calibrator.
Any ideas?
We are running R/3 4.6C and compliance calibrator 4.0

Can you please check the following demo?
[Virsa Compliance Calibrator Application for SAP v5.1 Demo|http://www.sdn.sap.com/irj/scn/elearn?rid=/library/uuid/d2f1cf9c-0d01-0010-2dac-aedd3c4f7f5b&overridelayout=true]
Please give more details on the step where you got stuck.
Regards,
Dipanjan

Compliance Calibrator for multiple SAP systems

I was wondering if anyone could assist me with my query. We are currently performing an implementation of Virsa CC for a client and have begun to configure a CC DEV system they have installed with their custom SoD rule set. The DEV CC system (sitting on a stand alone NetWeaver box) is "connected" to four SAP systems (DEV, QA, HR DEV & HR QA). When we are building "functions" (i.e. raise purchase orders) in CC it asks us to define a SAP system when we are entering the transaction codes. We've been configuring the functions with SAP DEV as the system, however when we run the analysis of results we would like to get results from QA as well. It appears that the risk analysis only works for the system that you have defined the functions in (i.e. we get results for users in DEV but not for users in QA).
My questions are as follows:
- Do you need to define all the systems you wish to run a risk analysis for within the function (i.e. function = Raise purchase orders. DEV ME21 & QA ME21)?
- If so, is there an easy way to convert our functions so that they point to QA as well (we've noticed that we can't edit the SAP system once the function is saved)?
- Is it possible to export the functions and then define the SAP system when importing them back into CC (we've noticed with the SAP delivered rule set that SAP DEV was automatically defaulted)? This is particularly relevant as we would like to export the rules from the DEV CC system and import them to the PROD CC system without having to manually create the rule set again; and
- Is it possible to export the rules and manually change the SAP system reference and import them back into CC (i.e. do a "replace all" DEV to QA)?
Any help would be greatly appreciated.
Thanks,
Alexi

In order to perform what your are trying to do in CC 5.2, you will need to go to configuration and setup a logical system, such as SAP R/3 and define all the appropriate systems for the logical system. Then, when modifying the functions, you will need to set the tcode (action) to the logical system defined, such as R/3 or APO, etc.
The cross-system functionality only comes into play if you want to analyze the SOD where a conflict would occur if a user had access to one function in one system (for example - purchase order processing in APO) and a conflicting function in a different system (for example - Vendor Master in R/3).
If you simply want to check who has violates a risk against multiple system - the logical system is the best way. You can have an logical system by system type - R/3, BW, APO, SRM, etc.
To convert this over, you can export the rules and during the export you have to define the new system when exporting the file. If that doesn't work, I'd just delete everything out, and use the upload files to reload the rules with the correct data.

Compliance Calibrator 5.2 Install Question

I am at a customer site installing Compliance Calibrator. We have followed the installation steps as outlined in the CC5_2_Install_700.pdf and everything has been going smoothly. We have restarted our instance and now we are trying to verify that it has installed properly. On page 44 of the guide, it says:
The Virsa Compliance Calibrator banner appears. This verifies that your installation was successful. There is no content below the banner until you:
- create JCo destinations.
- assign a role, provisioned to perform all Virsa Compliance Calibrator transactions, to a back‐end user account.
However, when we go to the URL as described in the guide, we get the netweaver login screen, but when we try to login, it doesn't show us the banner as described above. Instead it appears that the login has been rejected, though no rejection error message is displayed.
What step may we have missed?
Thanks,
Santosh Krishnan

Also please check what Language you have set for the user you are logging in with.
You must have created one user to access Virsa CC. Please check language option. If it is empty, kindly set to English
This should solve your problem.
Regards,
Faisal

FBL5N - in Rule set - It is a Display customer line items

Dear All,
We observed that FBL5N - Display customer line items in Standard SoD rule set under function AR07 addressing a risk of S022.
Unless there are t-codes of FD03 or FB02 this t-code does not allow to change the payment terms of the customer.
We are having a challenge from the client that FBL5N is a display t-code and why it is there in rule set.
Has anybody came across this scenario? If yes, what is the underlying risk for this FBL5N independently.
Is there any SAP Note for this t-code like ME23N from SAP.
Thanks and Best Regards,
Srihari.K

Hi Christian,
We checked the authorization objects as well enabled in GRC rule set as below:
F_BKPF_BUK - Docume t Authorization document for company codes - 01 or 02 - Enable.
Inspite of this access, FBL5N cannot be used to change the document for payment terms and assignments without FB02 t-code
assignment in the role.
Independently FBL5N cannot be used for any change or create activity except Display customer line items.
Please advise
Thanks and Best Regards,
Srihari.K

Downloading a single rule set out of N rule sets.

HI All,
We have defined 4 Rule sets for one particular system. Out of these one is the global rule set. Now, my requirement is to have oe more rule set, with 80% rules from global and then add the rest 20% myself. Would like to know if there is any way we can achieve this efficiently, other than creating manually all the 80% rules from GLOBAL rule set.
Thanks a lot in advance.
Regards,
Hersh

HI Jose,
Well what you guided was perfectly fine an true in case of making changes to GLOBAL rule set. But any idea how we can make a new rule set out of the custom rule set i have already made.
I have , in all 4 rule sets present at the moment in GRC - GLOBAL, CUST -1,2 and 3. Now, my requirement is to have a copy of CUST1 into new rule set CUST4, and I manually later on need to update CUST4 for some more risks in it. The problem i am facing is whenever i download the existing rule sets, it is not giving me an option to download just CUST1, but all of four rule sets get downloaded together. Whereas, i need just a copy of CUST1. Any ideas on this?
Regards,
Hersh.

GRC Upgrade 4.7 to 5.3 - Rule Set Upload

Questions about upgrade from 4.7 to 5.3
Work in corporate conglomerate that consists of 4 independent business units each with own SOD rule set:
u2022How do we upload each independent set of rule sets so they can coexist within GRC 5.3?
u20224.7 mapping of files to 5.3 naming conventions u2013 see 4.7 rule set download below
CONFIG
CR_PROFS
CR_PROFST
CR_ROLES
CR_ROLEST
CR_TRANS
CR_TRANST
SOD_OBECT01
SOD_OBECT02
SOD_OBECT03
SOD_OBECTT
SOD_TCODE
SOD_TCODET

Alpesh
We are trying to upload our existing SOD 4.7 rules using the 5.3 the configuration tab u2013 rule upload. We are having difficulties associating old 4.7 SOD files names to the 5.3 SOD file names. Is this the correct location within 5.3 to associate a physical system to a specific set of SOD rule sets? If not could you please point us to correct location within 5.3.
Thanks

Rules Set Issues and Information

Hi every one,
I am running a Rule Set.
In Job Console it still shows processing after a while, instead it should be showing completed status, when I expand the rule set in job console to watch the problem it shows that 1 rule is in still processing.
I ran the rule again and still the same issue, but this time when i expand the rule set, the order in which the business rule should execute is changed and a different rule is shown in processing which is being completed in the last attempt.
1)Does any one have any clue how to solve this issue? Or what is causing this Issue?
2)The rules in rule set runs in the same sequence as defined in rule set? or they just run randomly? why job console shows as if these rules are executed randomly??
Regards.

Hi Mehmet,
With due respect, I think the user11978217 might be facing the issue mentioned in Oracle doc. +Hyperion Planning Job Console Shows Incorrect Information About job completion. [ID 1429796.1]+, wherein planning job console shows running status but if we see the sessions in EAS console we don't find any for concerned request.
Hi user11978217,
If you see the last column in Sessions window which is "Request Status", you would see the status of one of the session as running/processing whenever you would execute the Rule Set or for that matter any calculation or request. If the Rule Set is executed completely, this session which was showing status as Running/Processing would disappear, on refresh.
Hope this helps.
Regards,
-SM

Create rules in Compliance Calibrator for HR PD profiles

Hello
In Compliance Calibrator can we create a rule to check PD profile combinations?
Example:
We have 3 PD profiles say 1, 2, 3
We dont want 1, 3 together
Any help on this, is greatly appreciated.

Alexander,
Thanks for your prompt response. But the note available from SAP is not included SCM?
<b>Note 1033326 - Compliance Calibrator 5.2 Rule Upload</b>
SOD Action and Permission level rules are provided for R/3, APO, ECCS, CRM
and SRM. HR and Basis rules are included in the R/3 but also broken out
separately.
Could you tell me what all other modules are included in the standard ruleset?
Thanks in advance
Eric

Compliance Calibrator SOD Conflict (FI01 and FB05)

I was hoping that someone could provide some insight as to why the "FI01 - Create Bank" and "FI02 - Change Bank" transactions would create a risk (in Compliance Calibrator) when coupled in the same security role with the "FB05 - Post with Clearing" transaction. The risk description given by Compliance Calibrator is "Maintain bank account and post a payment from it".
The FI01 and FI02 t-codes appear to only create/change routing numbers or addresses for banks. There is no ability to create or change an actual bank account. This alone doesn't seem to create a conflict when coupled with a posting transaction. Is there possibly some functionality that I am missing?

Hi Joshua,
I strongly agree with you that there is no SOD conflict technically with FI01, FI02 with FB05 although the wording of the SOD conflict in a business sense meaning Maintain Bank Accounts vs Posting Payments sounds more like a Conflict.
I dont see by anyway how you can maintain actual bank account in either FI01, FI02.
FI01 and FI02 - Maintain Bank Info like Bank Address, Bank Key and soforth.
FB05 - Make Payments to various accounts.
Regards,
Kiran Kandepalli.

Re: Virsa Compliance Calibrator & Pre-defined SOD Rule Set

Similar Messages

Maybe you are looking for