SAP Process Control

Raghu Boddu is the managing director of ToggleNow Software Solutions. He has more than 25 years of experience with SAP security, GRC, audits, and automations. Raghu is a certified information systems auditor (CISA), a certified fraud examiner (CFE), a certified data privacy solutions engineer (CDPSE), and a certified SAP security profession and GRC associate. He has served on the Information Systems Audit and Control Association state board and contributed articles, blog posts, automation stories, and vlogs to the security community. He was named a Microsoft Most Valuable Professional (MVP) for three consecutive years in the Windows Shell space. He has published more than 30 Microsoft Knowledge Base articles. Ramakrishna Chaitanya is a chartered accountant with 10 years of experience in the areas of SAP GRC solutions, including SAP Process Control, SAP Risk Management, and SAP Audit Management. As an advisor, he has helped clients implement SAP GRC solutions for managing the risks and controls in an automated environment. He has exposure to analyzing business processes across various SAP modules to identify potential risks and control checkpoints. He has led multiple SAP Process Control implementation projects, as well as projects converting existing risk and control matrices to suit the SAP GRC environment. He has implemented survey design in SAP Process Control to monitor the GDPR compliance for a leading company in the consumer goods industry.

... Preface ... 15
... Target Audience ... 15
... How to Read This Book ... 16
... How This Book Is Organized ... 16
... Conclusion ... 18
... Acknowledgments ... 18
1 ... Introduction to SAP Process Control ... 21
1.1 ... History of SAP Process Control ... 21
1.2 ... Architecture and Landscape ... 24
1.3 ... Regulatory Requirements, Supported Systems, and Integrations ... 25
1.4 ... Enterprise Risk and Internal Control Management ... 35
1.5 ... Enterprise Risk and Compliance Management ... 36
1.6 ... Summary ... 38
2 ... Governance ... 39
2.1 ... Strengthen Internal Controls ... 40
2.2 ... Manage Internal Controls ... 46
2.3 ... Integration Approach ... 51
2.4 ... Summary ... 55
3 ... Prerequisites ... 57
3.1 ... Check License Agreements ... 57
3.2 ... System Sizing ... 59
3.3 ... Component and Plug-In Requirements ... 61
3.4 ... Summary ... 63
4 ... Basic Configuration ... 65
4.1 ... Initial Configuration ... 65
4.2 ... Workflow Configuration ... 71
4.3 ... Shared Master Data Settings ... 88
4.4 ... Integration Framework ... 92
4.5 ... Multiple Compliance Framework ... 98
4.6 ... Other Configurations ... 105
4.7 ... Introduction to Work Centers for SAP Process Control ... 112
4.8 ... Summary ... 118
5 ... Master Data Management ... 119
5.1 ... Introduction to Master Data ... 119
5.2 ... Business Process Hierarchies ... 122
5.3 ... Organization Hierarchies ... 156
5.4 ... Users and Roles ... 163
5.5 ... Working with Indirect Entity-Level Controls ... 169
5.6 ... Approval Workflow for Master Data Changes ... 173
5.7 ... Uploading Master Data Using the Master Data Upload Generator ... 178
5.8 ... Summary ... 181
6 ... Control Evaluation ... 183
6.1 ... Introduction to Control Evaluation ... 183
6.2 ... Control Design Assessment ... 185
6.3 ... Control Self-Assessment ... 223
6.4 ... Manual Control Performance ... 227
6.5 ... Manual Test of Effectiveness ... 248
6.6 ... Reporting ... 262
6.7 ... Summary ... 263
7 ... Ad Hoc Issue Management ... 265
7.1 ... Configuration ... 265
7.2 ... Issue Remediation Process ... 270
7.3 ... Reporting ... 285
7.4 ... Summary ... 287
8 ... Continuous Control Monitoring ... 289
8.1 ... Introduction to Continuous Control Monitoring ... 289
8.2 ... Data Sources ... 292
8.3 ... Business Rules ... 326
8.4 ... Perform Control Business Rule Assignment ... 357
8.5 ... Create an Automated Monitoring Job ... 359
8.6 ... Transport Procedure ... 367
8.7 ... Export and Import Functionality ... 379
8.8 ... Usage of the SAP HANA Subscenario ... 383
8.9 ... Reporting ... 389
8.10 ... Summary ... 392
9 ... Additional Features in SAP Process Control ... 393
9.1 ... Policy Lifecycle Management ... 393
9.2 ... Disclosure Surveys ... 412
9.3 ... Sign-Off Functionality ... 421
9.4 ... Summary ... 434
10 ... Reporting ... 435
10.1 ... Reports by Work Centers ... 435
10.2 ... Personalization and Configuration ... 452
10.3 ... Interpretation of Report Results ... 461
10.4 ... Summary ... 463
11 ... SAP Fiori for SAP Process Control ... 465
11.1 ... SAP Fiori Apps for SAP Process Control ... 465
11.2 ... SAP Fiori Configuration ... 468
11.3 ... Working with SAP Fiori Apps ... 476
11.4 ... Mapping Custom Catalogs, Groups, and Space IDs to Transaction PFCG Roles ... 481
11.5 ... Summary ... 487
12 ... SAP Financial Compliance Management ... 489
12.1 ... Overview ... 489
12.2 ... Master Data Elements ... 491
12.3 ... Control Evaluation Procedures ... 500
12.4 ... Summary ... 515
... The Authors ... 517
... Index ... 519