1).What is the rule set in GRC?
Ans)GRC Landscape is 2 system landscape,
in GRC there is no Quality system.
2).Explain about SPM?
Ans) SPM can be used to maintain and monitor the super user access in an SAP system. This enables the super-users to perform emergency activities and critical transactions within a completely auditable environment. The logs of the SPM user IDs help auditors in easily tracing the critical transactions that have been performed by the Business users
3). What is use of su56?
Ans) Displays the current users Authorization Profiles available it the ID. Can also be used to reset their User buffer to pick up new roles and authorizations.
4). What is the use of RSECADMIN?
Ans)IN SAP BI
Reporting Users – Analysis Authorization using transaction
RSECADMIN, to maintain authorizations for reporting users.
RSECADMIN – To maintain analysis authorization and role
assignment to user.
5). What is offline risk analysis?
Ans) Offline Mode Risk Analysis process is performed with the help of Risk Identification and Remediation module in SAP GRC Access Control Suite. Offline mode Analysis helpos in identifying SOD Violations in an ERP System remotely. The data from system is exported to flat files and then it can be imported into the CC instance with the help of data extractor utility.
It can also be used to remotely analyze an ERP system which may be present in a different ERP Landscape.
6). How can find out whether CUA (Central User Administration) is configured on your sap system?
Ans)Execute su01 You can find out a tab called system tab…. If system tab is not displayed there in su01 screen there is no CUA is configured.
7). How do we test security systems? What is the use of SU56?
Ans) Through Tcode SU56, We will check the users buffer
8) .What are the key activities under SAP GRC Access Control?
Ans)To mitigate risk in an organization, it is required to perform risk control as part of compliance and regulation practice. Responsibilities should be clearly defined, managing role provisioning and managing access for super user is critical for managing risk in an organization.
9).How Process Control is different from Access Control in SAP GRC?
Ans) SAP GRC Process control is used to monitor task and reports in real time and you can generate compliance status of controls in place as per business processes and aligning business processes to perform risk prevention and mitigation.
10).What is the use of GRC Risk Management?
Ans)SAP GRC Risk management allows you to manage risk management activities. You can do advance planning to identify risk in business and implement measures to manage risk and allow you to make better decision that improves the performance of business.
11). What are the different types of Risk?
Ans) Risks come in many forms −
12).What is SAP GRC Audit management?
Ans)This is used to improve the audit management process in an organization by documenting artifacts, organizing work papers, and creating audit reports. You can easily integrate with other governance, risk and compliance solution and enables organizations to align audit management policies with business goals.
13). What is SAP GRC Fraud Management?
Ans)SAP GRC Fraud management tool helps organizations to detect and prevent frauds at early stage and hence reducing minimizing the business loss. Scans can be performed on huge amount of data in real time with more accuracy and fraudent activities can be easily identified.
14).What are the key capabilities of Fraud management module?
SAP Fraud management software can help organizations with following capabilities
15).What is Global Trade Services?
Ans)SAP GRC GTS software helps organizations to enhance cross border supply within limits of international trade management. It helps in reducing the penalty of risks from International Trade Regulation authorities.
It provides centralize global trade management process with a single repository for all compliance master data and content irrespective of size of an organization.
16). Is it possible to lock all the users at same time in SAP system?
Ans)Yes, using T-code: EWZ5
17). What is Authorization object and authorization object class?
Ans)Authorization objects are groups of authorization field that are used to regulate activities in SAP system. All the objects come under Authorization class and grouped by different functional areas like Finance, accounting, etc.
18).How do you perform user authorization in SAP system using GRC access control?
Ans) SAP GRC access control uses UME roles to control the user authorization in the system. An administrator can use actions which represents the smallest entity of UME role that a user can use to build access rights.
One UME role can contain actions from one or more applications. You have to assign UME roles to users in User management engine (UME).
19).What is UME and how it works?
Ans) CC.ReportingView
Description: Compliance Calibrator Display and Reporting
CC.RuleMaintenance
Description: Compliance Calibrator Rule Maintenance
CC.MitMaintenance
Description: Compliance Calibrator Mitigation Maintenance
CC.Administration
Description: Compliance Calibrator Administration and Basis Configuration
20).What is Risk Analysis and Remediation under Access Control?
Ans)Risk Analysis and Remediation (RAR)
In GRC access control, you can use Risk Analysis and Remediation (RAR) capability to perform security audit and segregation of duties (SoD) analysis. It is a tool which can be used to identify, analyze, and resolve risk and audit issues linked to regulatory compliance.
21).What are the key activities that Process Control share with Access Control in GRC?
Ans)Access control and process control shares the compliance structure in below areas
22).What are different Process Control areas that are shared with Risk management?
Ans)
23).What is IAM Internal audit management?
Ans) These are Repetitive manufacturing, Discrete manufacturing, as well as production manufacturing
24).What do you know about Routing in Sap PP?
Ans) Internal audit management allows you to process the information from Risk management and Process control to use in audit planning. Audit proposal can be transferred to audit management for processing when required and audit items can be used to generate issues for reporting. IAM provides you a place where you can perform complete audit planning, create audit items, define audit universe and create and view audit reports and audit issues.
25)What are the different activities that can be performed under IAM?
Ans) In Internal Audit Management work center you can perform various activities
26).What is an Audit Universe?
Ans)Audit Universe contains audit entities which can be classified as Business units, Lob’s or departments. Audit entities define the audit planning strategy and these can be linked to Process control and Risk management to find risks, controls, etc.
27).What is Audit Risk Rating ARR?
Ans)Audit Risk rating is used to define the criteria for an organization to find risk rating and establish ranking for risk rating. Each audible entity is rated as per management feedback in ARR. You can use ARR to perform the below
28)What is the use of Report and Analytics Work Center in GRC?
Ans)Reports and Analytics Work center is shared by Process Control, Risk management and access control. The Process Control Reports and Analytics work center consists of Compliance section in GRC application.
29).What are the different reports under Process Control?
Ans)In compliance section, you can create various reports under Process Control.
Evaluation Status Dashboard
Shows a high-level picture of the overall status of corporate compliance throughout different business entities and provides analytics and drilldown capabilities to view data on different levels and dimensions.
Survey Results
Displays the results of surveys.
Datasheet
Provides comprehensive information on master data, evaluation, and remediation activities for subprocesses and controls.
30).What is SoD Risk Management?
Ans) In every business, it is required to perform Segregation of Duties risk management starting from Risk recognition to rule building validation and various other risk management activities to follow continuous compliance.
As per different roles, there is need to perform Segregation of Duties in GRC system.
31).Based on SoD, what are the common roles and their key duties?
Ans) Business Process Owners
Senior Officers
Security Administrators
Auditors
SoD Rule Keeper
32).What are the different phases in GRC Risk Management?
Ans)There are various phases in risk management process
33).What are the different phases under Risk management in GRC?
Ans)
34).What is rule building and validation under Risk Management?
Ans)
35).How do you perform Risk classification? What is difference between low, medium and high risk classification?
Ans)Risk should be classified as per the company policy. There are various risk classifications that you can define as per risk priority and company policy
This includes risk where the productivity losses or system failures compromised by fraud or system disruptions and loss is minimum.
36). What is difference between preventive mitigation controls and detective mitigation controls?
Ans)Preventive mitigation control is used to reduce the impact of risk before it actually occurs. There are various activities that you can perform under preventive mitigation control
Detective Mitigation Controls
Detective mitigation control is used when an alert is received and a risk occurs. In this case the person who is responsible to initiate corrective measure to mitigate the risk.
There are various activities that you can perform under detective mitigation control
37).What is the use of Superuser privilege management in GRC?
Ans) In SAP GRC 10.0 Superuser privilege management needs to be implemented in your organization to eliminate the excessive authorizations and risks that your company experiences with the current emergency user approach.
38).What is difference between single and derived roles?
Ans) For Single role, you can add/delete Transaction codes while in derived roles you can’t add T-codes.
39).How do you check Superuser logs?
Ans)Use T-Code: Transaction: /n/VIRSA/ZVFAT_V01
40).What are the advantages of using Global Trade Services?
Ans)Below are the key advantages of using Global Trade Services
41).What do you understand by user buffers?
Ans)User buffer stores all the authorization of a user.
42).What is the maximum number of Transaction codes that can be assigned to a user?
Ans) Using SM18 Transaction Codes.
43) .How do you implement firefighter’s id in SAP GRC system?
Ans)Implementing firefighter ID’s consists of following steps
44).How do you perform Role modification in SAP system?
Ans)Using PFCG_TIME_DEPENDANCY back ground job.
45).What do you understand by ruleset? What is default rule set in GRC system?
Ans)Collection of multiple rules is known as rule set. In GRC, we have default rule set known as Global rule set.
46).What is the landscape of GRC system?
Ans)GRC landscape has 2 systems
47). What is the use of Segregation of duties in SAP system?
Ans)SOD is implemented in SAP system to detect and monitor fraud in business transactions.
48).What is the table name to store illegal password details in SAP system?
Ans)Table USR40 is used to store all illegal password details.
49). How do configure a user to login to SAP GRC system?
Ans)You need to assign following roles to user to login to GRS system
50).What are the key capabilities that you can perform using Superuser privilege management?
Ans)