SAP GRC CUP Getting message "Some unmitigated risks exist".

Hi,
when there is one profile or role,when approver mitigate the request.It gets message" Some unmitigated risks exist".
Already it's configured as unchecked for "Allow Approvers to approve access, despite any conflicts" in GRC CUP.
Any advise or solution.
Thanks
shahed.

Hi Shahed,
When u you the seeting "Allow approver to approve dispite Risks" as unchecked. This setting exist at stage level as well as at global level. Stage level setting get the preference. With this setting Approver will not be able to approve the request untill all risks are mitigated or no risks exists. It will show an error some unmitigated risk.
Kind Regards,
Srinivasan

Similar Messages

Role Upload template for SAP GRC CUP 5.3

Good Morning / Afternoon / Evening SAP Security Gurus,
I am looking to upload end user roles via a role upload template spreadsheet for use in SAP GRC CUP 5.3. I am referring specifically to the recommended template mentioned in step 11 of the 5.3 Post Installation CUP guide, so that roles can be picked within ERM for workflow.
According to the guide, it recommends uploading from the backend systems via a spreadsheet - any template versions or advice on finalising this would be most appreciated.
Best Regards
Steve

Thanks Ashish,
Someone else recommended this option as well via another forum. Have tried it out and working fine.
Thanks for the reply
Steve

SAP GRC CUP password issue

Hi,
to get user password, i set email reminder, closing as send password in mail No and password display period : 0.It throws a password as sap default string .How can it be standard password,so user can reset by entering it.In SAP GRC 5.3 AC-CUP 5.3_05.0, I can't see password self service tab too.Is there any better way so user can get password in email as sap standard in 8 words (number , letters or any special characters as set like us).

when i try to create request type for password self service. i have only these actions to select
CREATE_USER Create User
CHANGE_USER Change User
DELETE_USER Delete User
LOCK_USER Lock User
UNLOCK_USER Unlock User
ASSIGN_ROLES Assign Roles
SUPER_USER_ACCESS Super User Access
USER_DEFAULTS User Defaults
i can't see any action for password self service in configuration->request type-> create option.please answer it.

SAP GRC AC: Organizational rules at Batch risks analysis and Dashboards

Dear All.
I would like to know GRC AC is able to consider the organizational rules defined (for example: risk only affected to Company, BUKRS 0001) at the Batch risks analysis and at the Dashboard. I already know that for the ad-hoc reporting you can filter by the Org.rules created but i would like to know if this filter is also able for the Batch risks analysis.
Thanks and regards.

Dear all.
As per my knowledge this parameter only sets the flag of Consider Org.Rules at the filters. This is what the guide indicates:
"Setting the value to YES automatically selects the Consider Org Rule checkbox on the Risk Violations tab of the Access Request and
Role Maintenance screens."
So how are you so sure about that indicating this flag to YES will take into consideration the org rules at the Dashboards?
Regards

Anyone have SAP GRC CUP LDAP connector using port 636 SSL working?

Hello,
I wanted to verify if anybody connects to an eDirectory (or any other) LDAP in CUP using SSL port 636?
Statement I received from SAP is that this is not supported in CUP, and only non SSL connections to LDAP work. I just have trouble to believe this as SSL would be best practice in any company.

Pados,
By using STUNNEL, CUP will not know about SSL. CUP will always think it is a regular connection but stunnel will send SSL connection to LDAP. Here is the link:
http://www.stunnel.org/
Regards,
Alpesh

HT1338 I've updated my software but still get message "Some plugins used byu this page are out of date". What do I do next to cure this problem?

Does anyone know how to solve this problem?

Could be because recent versions of Firefox do not accept most plug-ins.
But for this there is a workaround:
Open Firefox and type in the address bar: about:config (no spaces) and click return. This gives you a warning that it might harm the application. Ignore that and click on 'I'll be careful, I promise' and you get the config file that you can edit - with great care.
Look/search (scroll down) for: firefox.plugins.enabled
Set it to true. (Double click it to toggle it)
Now close Firefox, open it again, and it now uses the plug-ins that Safari has stored.
As for Java, not many web sites use Jave and for security reasons you should turn of Java, but Javascript is another matter (and something completely different) and this should be left on.

SAP GRC CUP for backgrounjobs

Hi,
I set background jobs email dispatcher,shedule type other to every sec as 3600 and it's not taking to less than 3600.i am trying to put 60 sec and it's throwing error Enter a valid numeric value for Every Second, Value greater than or equal to Background Job Time Interval, 3600

Hi,
The background job dispatcher time should be greater than or equal to the background job time interval time defined under configuration -> miscellaneous. Remember, the Background Job Time Interval is in Minutes.
Regards,
Alpesh

How does GRC CUP handle scheduled termination set up in SAP HR ?

Dear Experts,
We are planning to use "HR Tiggers" for Hire, Terminate and transfer events in GRC CUP ? Can some body help me understand how does GRC CUP handle the termination requests that are scheduled in future ?
Thanks
Kumar

I configured HR trigger rule for infotype 0000 & subtype Z1,field MASSN with value equal to 01 to trigger new hire...i don't see any data being populated into table /VIRSA/INT_TRIG & ?VIRSA/DATA.
I could see the rule in table /VIRSA/RULEATTR.
Any help would be appreciated.
Thanks,
Srinu

SAP GRC 5.3 CUP: Approver Determinator "Super Access Owner"

Hi,
when configuring a stage, a standard approver determinator called "Super Access Owner" could be selected.My question is where to specify the Super Access Owner in SAP GRC CUP? In the Config Guide of SAP GRC AC 5.3 a hint explains on page 145
"If you select Superuser Access Owner as the approver determinator, the system
fetches the configured owner from the SAP system where the Superuser Privilege
Management is installed and assigns the request to that particular approver."
I do not really unterstand where to specifiy. Is it the former FireFighter in the backend.
Did anybody user this Approver Determinator already?
Thank you in advance.
Marco

Hi Marco,
Yes this approver is defined in the backend Firefighter which is now Super User Privelege Management. The Firefighter ID owner will be taken as the approver if we select Super User Access Owner in the CUP request. This option is basically being provided for Integration of Compliant User Provisioning and Super User Privelege Management for SAP GRC AC 5.3. You may now create a request to assign a Firefighter ID to a Firefighter in CUP and do not need to go to SPM for the same.
In case you do not want to use this approver, please create a Custom Approver Determinator for the same.
Hope this helps.
Harleen

Integrate external identity management solution in SAP GRC Access Control

We need to integrate an external identity management solution into SAP GRC Access Enforcer. Some white paper mention extensibility is provided by web services. It seems that none of these web services are documented. Does anybody have infos about these services and documentation. Any hint is appreciated.
thanks
Detlef

Unfortunately Access Enforcer doesn't implement a number of critical requirements and implementing it "as is" would be a lot of steps backwards in our process.
what do the published webservices do? Is there any documentation about them?
In a part of our process, we must manually pick the current roles(1), the pending roles(2) (roles that were approved but not given due to training prerequisites) and the requested new roles(3) and make the simulation in the VCC.
The information (1) and (2) and (3) we have in our internal system, the information (1) we have inside VCC and (2) and(3) must be manually inputted by the operator to run the simulations. Since this operation is repeated 6000+ times a month in my company, eliminating this manual input will cause a great gain in efficiency.
Other thing that we want to do is to create a job where it would automatically desassociate the mitigating controls if the user does not have the risks anymore (users can lose roles automatically in some events here, so it would be coherent that the user also loses the associated mitigating controls)
IMHO as a former programmer, these are classic cases where I would like to consume some webservices for this tasks to avoid a lot of ctrc ctrlv from the operators (inefficient and error prone)
VCC has any documentation that would help me to find how I would do this integrations?
Thanks in advance

SAP GRC 10.0 Risk Management - Forecasting Horizon Scoring Analysis Mode

Hi everyone,
In SAP GRC 10.0 Risk Management Support Package 7, we need to assess a corporate risk by performing an automatic analysis aggregation based on a scoring analysis profile.
The problem is that corporate risks must be created based on a forecasting horizon.
So, can we create forecasting horizons with scoring analysis mode? How? Must be enabled through customizing or applying a SAP note?
Best Regards,
Chema Traveso

Hi,
I think this is still user-specific, as it was in 5.X. I have checked the new GRC authorisation object parameters delivered within the roles and also tried to see if a Admin user was able to see all the variants created by the different users, but so far I have not found a solution.
It may be worthwhile to raise this in "IdeaPlace", hoping it gets enough votes and SAP's attention for implementing in a future Support Pack delivery.

SAP GRC 10.0 - Risk Analysis - Define global variant

Hi Experts,
We are implementing SAP GRC 10.0 and we have a question about variant management in Access Risk Analysis.
When we saved a variant, it seems that this variant is user specific.
Is it to possible to define this variant as default for all users?
Thanks.
Best regards,
Nicolas RICHARD

Hi,
I think this is still user-specific, as it was in 5.X. I have checked the new GRC authorisation object parameters delivered within the roles and also tried to see if a Admin user was able to see all the variants created by the different users, but so far I have not found a solution.
It may be worthwhile to raise this in "IdeaPlace", hoping it gets enough votes and SAP's attention for implementing in a future Support Pack delivery.

Add Fields in CUP Request - SAP GRC Access Control 5.3

Dear Friends,
I am wondering on how to add fields value in CUP (Compliant User Provisioning) SAP GRC AC 5.3.
Currently i'm leading 9 SAP Security Coordinators in Indonesia and i want to create Performance Metrics on how long the CUP Requests is processed. It needs to enhance the CUP by adding value Delegation of Authority and the record no. of the DOA requests.
Really appreciate your inputs on how to add fields value in CUP.
Thank you so much
-Mesti-
Edited by: AnnisaPramesti on Jan 2, 2012 5:37 PM

Hi.
Check under http://service.sap.com/instguides
SAP BusinessObjects -> SAP BusinessObjects Governance, Risk, Compliance (GRC) -> Access Control -> SAP GRC Access Control 5.3
Cheers,
Diego.

SAP GRC AC 5.3 (CUP) connecting to module of R/3 (HR)

Hello,
I have a problem.
I want to monitor from the SAP GRC AC 5.3 (CUP) some event or activation or trigger when someone create or does some modificaction to an employee from the module HR. Maybe from the Tcode PA20, AP30 or PA40.
IS there a "how to" or a manual to configure this from the SAP GRC AC 5.3?
Thank you in advance
Best Regards...
Pablo Mortera.

Pablo,
I am not clear on what exactly you want but as far as I know there is no monitoring capability in CUP. If you want to monitor something, you will have to write your own Java code (for CUP front-end) or ABAP code (SAP back-end) to access particular database tables.
Regards,
Alpesh

Why can't i add playlists to my iPhone from my mac while they are connected? I keep getting the following message "some items (meaning all of them) were not transferred because iTunes match is enabled." This is incredibly frustrating.

I keep getting the following message "some items (meaning all of them) were not transferred because iTunes match is enabled." when I try to drag and drop a playlist, song, or album to my iPhone. This was NEVER a problem before iTunes match or the last iOS update. So what is the deal? Why can't i just add music to my phone from the mac? There is space on the phone. The only way I have found to get the music i want to the phone is to have it download from the phone. This is not something i want to have to do: go through and manually add every album and recreate a playlist on the phone when its there on the mac. And, even more irritating, since the new update, when the phone is plugged into the mac i can't actually view from the mac what music is on the phone. This is incredibly frustrating and any help would be much appreciated in managing my music libraries for each device.

Hi,
You cannot manually manage music with match turned on on your iOS device. If you want to manage music manually, you will need to turn off match on your iPhone.
Jim

SAP GRC CUP Getting message "Some unmitigated risks exist".

Similar Messages

Maybe you are looking for