Regarding Rules, Functions and Risks

Question

Hello,
1. Does SAP provide a standard ruleset for SoD? Does it come with the AC 5.3 .SCA?
2. What is the relation between Rules, Risks, Functions and Business Process?
Thanks.

Answer 1

Hi Gautam,
Just to make it more explanatory, lets take few examples for each entity:
1. Business Process (BP):
It can be a department, group or an independent functional unit in an organization. E.g Finance or HR or Material Management.
2. Function:
It can be a set of activites or say set of simlilar activities in a BP. E.g in SAP Security - SU01 and PFCG combination can be termed as a function - "User and role maintenence" .
3. Risk:
It can be a combination of 2 or more functions which when given to a single user, can be harmful to the organization.
4. Rule:
It is generated from Risks automatically. E.g if A and B are 2 funtions in a risk R, such that:
                   A has transactions X and Y and
                   B has transactions M and N
so there can be multiple rules generated here for Risk R , with the combinations like X and M rule, X and N rule, Y and M rule, Y and N rule etc.
5. Ruleset:
As the name suggest, is a set of Rules, generated from Risks. Two Rulesets may contain same, similar or dissimilar risks, based on the lanscape for which you want to use the ruleset. E.g you might have ruleset R1 having Risks 1 to N in your development system and you might have ruleset R 2 having Risks 1 to M in your Production system.
Hope this makes it a bit clearer to you know. For more dependencies within these entities and how they behave with eah other, I would suggest if you create each of them and then observe their linkages. The config guide from SAP would be more than enough for this purpose.
Regards,
Hersh.
http://www.linkedin.com/in/hersh13