Seperating SoD results reports by org unit

Question

Hi GRC gurus,
I was looking into CC 5.2 to find a way to seperate the access to SoD reports based on the org unit being analyzed.
This is a topic in itself, but my question is whether there is a way to control access to the output of the results based on org unit.
I found a VRAT object (from memory it was the Business Unit object ...0006) with this description and documentation, but it is not used anywhere in the coding...........
Is this different in 5.3? Or have I missed something?
Our other option is to put another layer of security ontop of the output, either by sending the results or downloading them to other storage media for access.
Cheers,
Julius

Answer 1

>
Frank Koehntopp wrote:
> you can run risk analysis by Org Level, which will report only violations for a certian Org Unit.
That is a challenge in itself because of the dependency on org customizing (SPRO...).
In this case: Some processes (e.g. Treasury, just as an example) and some business orgs. (e.g. inter-company shells) would like to train their key users to be able to do this analysis themselves. They actually want this, which is great! For the rest an output report sent by someone else (including a batch process etc) and a follow-up is normally enough.
The problem is that if they want to do this themselves, then in the case of some processes they would like to exclude anyone else from analyzing roles which grant access to their special processes which are largely org independent but would like to see the transactional authority to certain orgs (more precisely accounts) in other orgs.
Certain other org units which are legal entities take SoD seriously and would like to analyze their internal processes (which often have * org values as they have central functions, or are in some cases decentral with only * org as it made no difference...) without other users running the same checks having access to their roles if they enter * in the selection.
I understand that this is anyway a mammoth task for various orgs and systems and the org setup and customizing in SPRO is largely ignored, so the best option is to control the reporting output (centrally) and send it to those who are authorized. This was my "gut feeling" and idea to set it up with selection rules (variants).
Why I asked this question is because some managers want their own folks to do the online analysis as well, and I found the Business Unit object (which promised half the solution) but was not used in the coding anywhere.
We will be upgrading our 5.2 GRC to 5.3 soon, but I was curious to know whether something like this already exists works, or is in the pipeline?
Cheers,
Julius
ps: This is not a development request. Infact I would be insulted if SAP developed this before adding an AD configurable and LDAP capable method to FM SSFT_PPPI_SIGN for the SIGNING_METHOD parameter