Role Analysis Report

I'm a user of the GRC 10.0 module, and have a question around the role analysis report.  I’ve run a risk analysis violations report, and noted SoD/violations for 1169 roles, out of 35214 total roles (see attached screenshot).  That said, my understanding is that some of these ‘violations’, by risk category, could in fact be false positives? Is this correct? If correct, how do we know for certain that there are role violations for the 1169 roles? Is there another maneuver, report or analysis we can do to assure us that we’re looking at 1169 roles with real violations? Any help would be greatly appreciated. 

Hi Joe,
As Alessandro suggested, you need to run Access risk analysis reports on role level.
It will show you what exactly is the violation and at what level.. at action, permission, critical action, critical permission et al.
This report will even let you see the corresponding risk IDs, Rule IDs and risk criticality levels like medium/hig/critical and so.
Hope this is clear now
Regards,
Ameet

Similar Messages

  • Role analysis report not displaying data

    Hi experts,
    I'm trying to get data out of all reports from the dashboard and so far all of them work except for the Role Analysis report. When I execute the report all information comes blank and under "Number of Roles Analyzed" shows 0. Is there any way to farther test this report? I see a lot of information on the community but mainly the solutions are "execute job sycn" and check parameter 1025 for default ruleset. Is there any other thing I can do to get results here?
    Note: I also try generating all roles, running an all system risk analysis and just fyi SOD is working for User and Role level.

    Screen is attach, as far as steps go well after running Authorization Synch, Repository Synch and Action Usage Synch from SPRO I went to NWBC ->Reports & Analytics and under Access Dashboards I click on "Role Analysis" and I get the attach screen.  All the other reports under Access Dashboards works (except for "Alerts") but Im guessing thats because I dont have any alerts or something like that.  Any help is always appreciated

  • Role Analysis at Action Level - Summary Report - Question

    When running the Role Analysis Summary report at the Action Level, will the report show tcodes  that run in the background   from the tcodes specified in the role on the report?

    Hi Varun,
    Does this also apply on alert monitor report - say we have one tcode defined as critical action or is in one SOD risk, and the tcode is run indirectly, will it show in alert or not?
    Example, we have seen one tcode showing as executed, but the user authorization doesn't have the tcode access at all. So I was wondering how did it come in alert report.
    Regards,
    Sabita

  • Management report - Role analysis

    Hi guys,
    So here's my issue, I inadvertently scheduled a role analysis without specifying the project roles which are about 200 +.  Thus, role analysis under the management report view constantly shows the  results of the analysis of about 2000 + roles which is a combination of both SAP delivered roles and project roles. Every subsequent batch and full syncs I've scheduled seemingly gets aggregated with the initial sync which has all the SAP delivered roles.
    Question.
    1. I understand I have to purge the database at the backend. The basis team strongly advices against this. Can I possibly purge the role analysis in the CC front end? What are my options here? I only want to see the role analysis of our 200 + project developed roles.

    Dear Adewale,
    I understand your requirement, please check the following.
    There are two ways to see Role based Risk Analysis, and both depends upon your requirements.
    1) Suppose, You have a requirement to see consolidated Role based Risk Analysis of a particular system. That means you want to generate a report for all the roles and want to see which roles are violating, mitigated, critical, high, medium and low in your system. For this you can go to Informer tab and generate Role based Risk Analysis Report.
    In this report the advantage is that you get a pie chart and bar graph. But you can not generate reports on the basis of some particular roles, because there is no such functionality provided in CC 5.2
    2) In other case if you wish to generate a Role based Risk Analysis report by specifying a condition like (z*), Here you also have option to select Report Type, risk Level etc  but yes, there is no functionality to see the result in graphs or charts in CC 5.2
    So in both ways your requirement to generate project roles risk analysis report in graph format can not be achieved. For this you only have two options.
    1. Raise an enhancement request to SAP Support.
    2. To go with the second option mentioned above, select report type to be management summary and export the results to excel and generate graphs manually.
    I understand this is painful.
    Best Regards,
    Amol Bharti

  • Role Based Risk Analysis Report

    Hello All,
    When I executed the Risk Analysis report for a role with SOD Risk Level = ALL and Report type = SOD at Authorization Object level, the results come back as "NO CONFLICT FOUND".  this is the correct response.
    However, I executed the Risk Analysis report for the same role with SOD Risk Level = HIGH and Report type = SOD at Authorization Object level, the results come back SOD conflicts based on the conflicting transactions.  Is there a bug with analyzing roles using this option?
    Also, when I click on the Detail Report button, I received object data that does not appear correct.
    Please Help.  Thanks.
    Edited by: Michael Johnson on Apr 8, 2009 8:54 PM

    Hi Babiji,
    Are you using any specific tools for SOD's? If you are using GRC tool, then it can be done using compliance calibrator Role level Risk analysis.In addition to what Sneha has said,
    To find out the conflicting roles in CC version 5.2 the path is INFORMER->Risk Analysis->Role level.In Virsa 4.0 you have the option of carrying out risk anaysis at role level by executing the t-code /N/VIRSA/ZVRAT.
    In section Analysis type, choose Roles and enter the list of roles.
    In section SOD Risk level, choose the appropriate risk.
    Then choose the appropriate report type and report format before executing it.
    This will display all the roles with the levels of risk associated with it and then you can mitigate these as per your organizational policies & procedures.
    Thanks,
    Saby..

  • SRM Global Spend Analysis Report

    Hi Team,
    Does anyone have any prior experience creating SRM Global Spend Analysis Report in BI 7.0.
    I couldnt find the data source in SRM for Global Spend report, but I have the Infoobjects and cube from BI Content. Can anyone provide a step by step instruction on how to create this report in BI. Do I need to create Custom Datasources?
    I am using SRM 5.0 and BI 7.0 with support pack 10.
    Thanks
    Anita.

    Hi
    I don't think you need to create custom datasource, as all the information is available in the system.
    I have not tried this ever. Here are few details, which might help.
    <b>Global Spend Analysis</b>
    <u>Accurate spend information helps you to optimize your supply base and, by indicating potential for demand aggregation across business units, enables you to control your procurement cost and negotiate better contracts with your suppliers. Global Spend Analysis now uses mapping information provided by SAP Content Integrator. The category mapping functions of SAP Content Integrator allow you to map products and categories to a standard category hierarchy (or schema). This could be an internal customer-defined schema or an external one, such as eCl@ss or UN/SPSC. Grouped key mapping for partner data delivers information on identical suppliers, which appear under separate IDs in the procurement systems. Both kinds of key mapping information are made available to SAP BW. The consolidated InfoObject technology in SAP BW then enables unified reporting across diverse master data entities in a heterogeneous system landscape, based on the mapping information delivered by the SAP Content Integrator. For mySAP SRM 3.0, the data extraction tools of MDM, which feed the master data into SAP Content Integrator, only support SAP R/3 systems. Therefore, the global spend scenario in combination with SAP Content Integrator only provides an out-of-the-box solution for mySAP SRM’s classic scenario.</u>
    <i>Refer to few links as well.</i>
    <b>http://help.sap.com/saphelp_srm50/helpdata/en/6d/0f343e47fd6b2ee10000000a114084/frameset.htm
    http://help.sap.com/saphelp_srm50/helpdata/en/3c/014b03cc304d2ea89d4540dc98b6e3/frameset.htm
    http://help.sap.com/saphelp_srm50/helpdata/en/99/4dded1f9e1433a88bd510e631ee335/frameset.htm
    http://help.sap.com/saphelp_srm50/helpdata/en/4d/fa243dfe075c59e10000000a114084/frameset.htm</b>
    <u>Refer to few OSS notes as well.</u>
    <b>956062 SRM 3.0 SP 11 (Stack 07/2006): Release and Information Note
    759396 No totals display in report 0SR_FIC01_Q0009
    751772 New roles for the purchase analysis as of BI Cont 3.5.2
    649491 New roles for BW content for SRM as of BW 3.0B
    87080 COMPUTE_INT_PLUS_OVERFLOW in report RSTABL10
    624726</b>
    Hope this will help.
    Please reward full points, incase it suits your requirements.
    Regards
    - Atul

  • How to understand Permission level SoD analysis reports?

    Hi ,
    We would like to confirm whether our understanding is correct in analysing the SoD analysis reports at Permission Level
    Below is an example on how functions are configured at permission level
    Under Function 0C0004 we have t-code as below
    VA01 - Create Sales Order with Auth Objects
    B_USER_STAT  - ACTVT 01 AND
                                ACTVT 06 AND
    K_CKBS_CO-PC - ACTVT 01 AND
                                 ACTVT 06 AND
    V_VBAK_AAT - ACTVT 01 AND 02 AND 06 etc.,
    Similarly we have another Function GA0001  with t-code as below
    F-03- Clear G/L Account
    F_BKPF_BLA  - ACTVT 01 AND
    F_BKPF_BUK -  ACTVT 01 AND
    F_BKPF_KOA - ACTVT 01 AND
    We have defined Risk betwee GA0001 & OC0004 with RISK ID 0045.
    Does this means that a User / Role which are having t-code VA01 with the above permission values should be thrown as a conflict if the same user/ role is having t-code F-03 with the above permission values.
    Do we need to understand the conflicts are only  between two transaction codes and their permission values? or
    Do we need to understand within the transaction code permission values also there are conflicts i.e. if a user is having  01,02 & 06 for V_VBAK_AAT in VA01 also.
    When SoD reports are thrown for a User/ Role it just provides the Rule ID number and the t-codes conflicting followed by the permission values of the t-codes as below
    004500101 : Transaction Code Check at Transaction Start  Transaction Code     Create Sales Order (VA01)   OC00004
    004500101 : Transaction Code Check at Transaction Start  Transaction Code      Clear G/L Account (F-03)      OCA00001
    004500101:  B_USERSTAT : ACTVT : Activity      Delete(06)                          OC00004
    004500101:  F_BKPF_BLA : ACTVT : Activity      Create or generate(01)      GA00001
    004500101: B_USERSTAT : ACTVT : Activity      Create or generate(01)      OC00004
    004500101: F_BKPF_KOA : ACTVT : Activity      Create or generate(01)      GA00001
    004500101: V_VBAK_VKO : ACTVT : Activity      Create or generate(01)      OC00004
    In the above scenario what exactly we need to understand ? Whether the conflicts are between t-codes & their respective permission values or the conflicts are intra conflicts i.e between permission values as well?  User should not posses both 01 & 06 for Auth Object B_USERSTAT and remove the access to any of them.
    Please provide your suggestions in our understanding.
    Thanks and Best Regards,
    Srihari.K

    Hi Sri,
              In RAR the conflict is always between Actions not permission. Permission level data is only for your info. All permission level details out of the box are not configured you have to activate it and fill in the value in the field. Now based on the value you feed in it will pull out the details.
    eg: if you enter * it will show all values, If you enter 01 it will show all  values with 01. 
           So to summarize the permission level details you need to configure based on needs and are not linked to conflicts they just show AS IS permission level details.
    Thanks,
    Darshan

  • GRC_10 Risk Analysis Report

    Hi,
    i should extend the risk analysis report with more details from diffrent tables, they hold special role details.
    I havent found an idea how to do this.
    Could i extend the standard report for risk analysis with more columns?
    Is there something like user.exits or enhancement-points?
    thank you very much indeed
    best regards
    Alex

    Hi Alex,
    did you have a chance to look at standard SAP Help information about different types of reports and information available?
    If not yet -please take a look at:
    Risk Analysis Reports - SAP GRC Access Control - SAP Library
    What exactly information you would like to add to reports?
    Standard reports can by customized by adding some additional fields which are hidden in standard view.
    There is also an option to add custom fields and data,
    Lets us know,
    Filip

  • Mass Role Analysis on RAR

    Hello all, i would like to know if it is possible to get an analysis and report of all Z* Roles using risk analysis.
    It seems that i can just one by one get role analysis and report, so is there a way to get a mass role analysis for example all Z Roles?
    I appreciate your help.
    Thanks

    HI,
    In risk analysis role level screen,for line with role expend drop-down list by defauslt it is ---u have many options there choose--multiple and take your all z-roles into one notepad and save as UTF-8 and upload that file in this screen.
    And run the risk analysis at background and u will get the risk analysis result..
    Regards
    Ravikumar.ch

  • RAR - management view - Role Analysis diagram shows zero

    Hello,
    we were able to run the Full Sync for role/user/role and Batch Risk Analysis user/Role/Profile and Critical Acess to completion successfully.
    In the Informer tab, Managerment View, the risk Violations and Users Analysis shows reasonable figures. However the Role Analysis , it shows zeros for the risk violations and risk violations for user and roles.
    Could someone point out where is likely the problem so i could go and check ?
    Thanks
    CL

    Hi Lee,
    Have you run Management Report Job as well?
    Regards,
    Sabita

  • Purchase Analysis Report

    Hi Experts
    When I Run Purchase analysis report in SAP Business One 8.8 under individual vendor view the Open A/P Invoice (not done Payment) sowing 0.00 in the Applied amount and the purchase amount is showing negative value bacuse it is a credit memo - which is correct.
    But when I run the same report in my customer site who are running SAP B1 2005 PL 43, they are not seeing 0.00 in the applied amount instead they are seeing the same negative amount which is displayed in the purchase amount.which is not correct.
    Please assist me
    Thanks and regards,
    Vinodh
    Edited by: Paul Finneran on Oct 15, 2009 12:36 PM

    Hi Vinodh,
    You may check these threads to see if they have anything related to your question:
    Re: Purchase Analysis Report
    Purchase Analysis Report not shown.
    cant see Purchase analysis report of standard SAP B1
    Thanks,
    Gordon

  • Sales Analysis Report - Items -- blank result

    Hi,
    I'm testing a setup and running the sales analysis report. It works for the Customer version but I get no results when running on Items.
    I'm on SBO 2007A SP01 PL07. There are open and closed invoices for inventory items; no credit memos have been posted. All Item type invoices.
    When I run by Customer, I get the correct data - open and closed invoices for that customer.
    When I run by Items, I get no results. The date range is the same for both reports.
    When I run the purchase analysis on Items, I get data for the same items I am trying to see in the sales analysis.
    Any ideas what could be causing this?
    Thank you,
    Heather

    HI Gordon,
    I left the default settings: 
    - Annual Report, Invoices, Individual Display, No Totals
    - Posting Date:  whole fiscal year
    - Main selection:  left blank/default (group = all, no properties)
    I have double/triple/quadruple-check even the Secondary SElection to make sure there's nothing there.
    I have also run it on Due Date instead of Posting Date, still no results (if run on Items).
    As I mentioned, the selection criteria is what I want but for some reason that one version, Items, does not work. The other 2 tabs work with the same selection.
    Heather

  • Issue while opening the web analysis reports

    Hi,
    One of our user is not able to open a web analysis report with an error messages saying
    "Java.Lang.Exception: Unexpected HTTP status code of 500 received from server"
    "Document does not exist or no authorization to open the document"
    Other users with the same level of access are able to open the report fine and also the same user is able to access the report fine with a test id from his machine.
    What could be wrong? Any suggestions please.
    The only thing I see here, something wrong with userd ID or password.
    Thanks
    Prasad

    Hi,
    I had also faced this problem earlier. I was using HFM as data source for WA reports. After searching I found that there was some change at HFM level. Some dimensions/members had been deleted or added in HFM. And I was using those missing members in WA Grid.
    I had to recreate my reports again as I didn't get any other way to deal with this problem.
    Please shared any other alternative option, if you found while working on this issue.
    Thanks & Regards,
    Mohit Jain

  • Issue in Due date analysis report S_ALR_87012168

    Hi Friends,
    We have a strange issue regarding due date analysis report (S_ALR_87012168)...
    When i execute this report it displays different amounts in "Not Due" column under 0-30 bucket. In 0-30 bucket, under not due column it shows 10,000 and under total open items column it shows 15,000. How it is possible?
    Thanks to everyone
    Anifi

    Hi,
    This has been closed due to Local and Document currency prob...
    Thanks

  • Unable to open web analysis reports through workspace

    Hi,
    I am connecting web analysis with MSSQL server 2000 and generating reports. I am using essbase 9.3.1 version.
    But my problem now is that I can just open these reports from web analysis studio and cannot open them from workspace. In workspace, if I right click on the report and open it from web analysis studio it does open. But it does not open by double clicking the report in workspace. It just shows a blank report on just parts of the report.
    The issue is only there for the reports that are getting data from relational db (MSSQL server 2000). The other reports that are using the cube data are fine and opening from everywhere.
    Are there any other configuration settings involved in order to open a web analysis report(that uses relational db) from workspace?
    Thanks in advance,
    John

    Hi Atul,
    Try using the in built config checker:
    http://localhost:16000/WebAnalysis/config
    This has several tests you can perform to see what's running.

Maybe you are looking for

  • Error in Column Formula

    Hi All, I have to change the market value to a specific base currency. But i need to take the values from the FX_Rate table where we are storing current forex rates. I have edited the column formula of Market_value as: CASE "Currency".INSTRUMENT_CCY

  • P67A-GD65 (B3) I put it to sleep and now it won't wake up?

    I hope that someone will be able to help me.  The other night after using my computer I put it in to standby mode.  The next day when I tried to wake it up it didn't respond.  I tried everything that I could think of and in the end turned off the pow

  • HOW DO I SPEAK WITH A LIVING HUMAN BEING?????????

    I NEED TO HAVE A PROBLEM RESOLVED AND NEED TO SPEAK TO A LIVING PERSON ABOUT IT IMMEDIATELY. I WOULDN'T USE YOUR STUPID BROWSER BUT THE PROGRAM I AM USING REQUIRES IT. GET BETTER CUSTOMER SERVICE

  • Sony rdp-xf100ip error message

    I recently purchased your sony rdp-xf100ip iphone dock and radio and really like it. I'm concerned now after reading a lot of negative reviews about people having an error messages and the unit turns off and doesn't work again. Just keeps getting err

  • Iweb problems now mobileme no longer exists?

    Hi, I recently downloaded Mountain Lion and have icloud as I understood this would allow me to use iweb and publish my site via icloud. I have since learnt that you can no longer do this. I'm not very technical but just wondered if someone can help.