What to do incase of new change in Org Structure while using indirect assig

Question

Hi all,
This is my first post in this forum and I hope I will get the right answer.
We have implemented the indirect role assignement and now we are in the process to set the process incase of any change in the Org Structure.
Option 1)
Me as a security engineer I have decied to have the following process:
HR has moved an employee from position to position > HR will inform the SAP Security Engineer about the new change > SAP Security Engineer lock the user and send the new list of roles for the employee to the mananger and process team lead for approval > mananger and process team lead can either approve the request or suggest new changes > then the SAP Security Engineer will do the changes i(if any) and then unlock the user.
Option 2)
One of the Process Team Leads is suggesting that we assign the roles to the positions once, get it approved and then whatever happen we don't care.
Please let me know what is the best way, and I am sure the first option is the best but a lot of manual work.
I hope to get good response on this and I hope if there is supported document from SAP.

Answer 1

>
Julius Bussche wrote:
> Option 1 sounds labour intensive. Option 2 requires better planning and testing.
>
> If your roles are built with the org structure in mind and the user's authority for anything other than basic common functions is from those position based roles, then you can assign the roles to the positions and let HR move the user's around as their jobs change in the org structure.
>
> What you should however be involved in is any changes to the org structure itself and the roles assigned to the positions and the roles themselves anyway.
>
> As you would be letting the system do a large part of the boring work for you, you should also monitor the usage of it from time to time.
>
> If you have a very large number of users and your org structure is stable and well defined (i.e. not a chaotic project structure...) then go for option 2 because it is more scalable.
>
> Cheers,
> Julius
In addition to Julius comments, I like to add the following base on our current security design.
We have something similar to option #2 in place.  We have HR base security by positions.  We made sure the business owners of the security roles are aware of the security role to position mappings.  We have a matrix of security to position mappings that has been approved by the business owners.  Exceptions are address in the form of a Help Desk ticket.
In this example all managers will get a set of roles.  The clerks will also get a set of roles.  Again these will be pre-approve role to position assignments.
Position: Manager
Assign Role: Z-GL-MANAGER & Z-AP-MANAGER
Position: Clerk
Assign Role: Z-GL-CLERK & Z-AP-DISPLAY
Option #1 - It's too much work and you are assuming that all the players involve on the business process will follow through, from notification of move, to approval, and more notification, etc.
As long as the business owners are aware and understand how position base security works option #2 is the way to go.  Of course we have other procedure in place before handing out security credentials, from submitting an SAP access form to mandatory training, etc.  We currently do not have the man power to have option #1 in place.
Good Luck!