What is SAP GRC? Understanding 10 Core Modules

What is SAP GRC?

SAP GRC (governance, risk, and compliance) is a set of solutions and products that help you manage enterprise resources in a way that minimizes risk, builds trust, and lowers compliance costs. Products like SAP Risk Management, SAP Process Control, and SAP Audit Management let you automate GRC activities, improve control and visibility, monitor risks and enforce controls, and coordinate GRC through a unified technology platform.

In this article, you will learn:

• SAP GRC Auditing: Why It’s Crucial for Your Organization
• The 10 Core SAP GRC Modules: A Quick Guide
  • Enterprise Risk and Compliance
  • International Trade Management
  • Cybersecurity, Data Protection, and Privacy
  • Identity and Access Governance
• Best Practices for Developing a Successful SAP GRC Strategy
  • Establish Ongoing Controls
  • Communicate and Align
  • Train
  • Leverage Frameworks
• SAP GRC with PathLock

eBook: Extend SAP GRC to Cloud & Non-ABAP Systems

Remove GRC Silos & Lower the Cost of Enterprise Application Risk Management

Download e-book

SAP GRC Auditing: Why It’s Crucial for Your Organization

Enterprise Resources Management (ERP) is an integrated system that stores all business transactions in a unified database. The ERP system is typically a central part of the SAP environment. SAP solutions are configured to accomodate a certain business environment, codifying the roles and responsibilities of all employees within the organization.

You can audit your SAP environment using two modules provided as part of SAP GRC: SAP Process Control and SAP Risk Management. SAP audits can assess the risk that sensitive business data might be accessed or manipulated by multiple users in an enterprise. Fraudulent, inaccurate or invalid data entered at any point in your business processes may affect the data accuracy of the entire system.

Auditing capabilities in GRC enable auditors and administrators to:

• Automate and accelerate the audit process, which can otherwise be a huge manual effort. SAP Auditing lets auditors create, track and manage audit issues, and also accelerates the remediation of these issues.
• Automatically prioritize issues for deeper investigation—this allows internal auditors to conduct timely risk assessments, focusing on the most important issues.
• Track individual transactions across connected applications—SAP’s internal auditing mechanisms can automatically detect transactions that violate security protection policies.
• Detect malicious transactions—including potential instances of fraud and Segregation of Duties violations.
• Uncover unauthorized changes to customer profiles or master data files. SAP GRC simplifies this process with automatic inspection capabilities.
• Comply with regulations and standards—SAP Auditing assesses whether SAP system configuration and the treatment of private information complies with regulations and compliance standards (such as SOX, HIPAA, GDPR, PCI/DSS, and SOC2).

The 10 Core SAP GRC Modules: A Quick Guide

This section provides an overview of GRC modules provided as part of SAP’s software ecosystem.

To learn about third-party tools you can use to implement GRC in a SAP environment, read our guide to SAP GRC Tools

Enterprise Risk and Compliance

1. SAP Risk Management

Image Source: SAP

This is an enterprise risk management solution that supports identification, analysis and monitoring of risks, letting you extract detailed insights into risk drivers and their impact on your operations and business reputation.

The solution lets you manage risk using the following steps:

• Plan your risk strategy—identify business activities that involve risk, establish a hierarchy of business risks, assign risk owners and risk appetite and define responsibilities.
• Identify risks—identify the links between risks and events, create a survey and document suspected root causes and risk consequences. Keep track of your mitigation activities.
• Analyse risks—perform qualitative and quantitative risk analyses to understand potential risks, how likely they are to occur, and what impact they might have.
• Monitor data in real time—automate risk monitoring, using real-time application data from both internal and external systems.

2. SAP Process Control

Image Source: SAP

This solution lets you use real-time insights to reduce risks by associating controls. Implement continuous monitoring and streamline testing of controls, along with the following steps:

• Create a unified platform for process control information—use a single repository to manage compliance procedures and regulatory policies. Optimize control testing and assessment activities.
• Evaluate control processes—perform comprehensive evaluations to improve control processes and compliance. Manage the entire policy lifecycle and streamline issue management.
• Automate workflows and notifications—minimize manual involvement and enable fast responses to control exceptions. Relevant stakeholders will be involved in tasks when necessary.
• Enable interactive forms—use interactive forms for tasks like sign-offs and testing to support offline procedures. Distribute your surveys and policies to relevant personnel.

3. SAP Audit Management

Image Source: SAP

This solution uses mobile-friendly capabilities to streamline internal auditing and simplify activities like documenting evidence, organizing electronic working papers, and creating audit reports. It fully integrates with SAP Process Control and SAP Risk Management. The solution lets you implement the following steps:

• Use mobile devices for audit planning, management and performance—create, track and manage audit issues using a consistent approach. Mobile support and drag-and-drop interfaces let you capture documentation instantly.
• Simplify audit planning and management—employ collaboration tools and easy-to-use interfaces to simplify tasks for auditors. Effectively manage resources, perform audit planning and scheduling, while optimizing utilization and reducing travel costs.
• Keep track of audits—use online management reviews to enhance audit issue reporting. Audit results are generated at the enterprise level using an intuitive interface. Thematic reporting (using SAP Lumira) can add value to your results.

Learn more in our detailed guide to SAP Audits (coming soon)

4. SAP Business Integrity Screening

Image Source: SAP

This solution lets you identify and prevent errors and fraud, via accurate, real-time scans of business data. It can identify anomalous behavior based on predictive analysis and rule sets, detecting patterns that might indicate fraud. The solution lets you perform following steps:

• Detect exceptions and check compliance—receive alerts for relevant exceptions like corruption, warranty fraud, suspicious transactions and employee theft.
• Prevent and deter—learn how you can prevent reoccurrences of exception scenarios by analyzing them and determining the most effective deterrence approach against each anamolous or fraudulent activity.
• Screen your business partners—avoid partnering with sanctioned or high-risk businesses. You can screen potential business partners against lists from various organizations or government agencies.
• Screen business integrity screening—use big data screening tools to better detect and prevent anomalies and mitigate risks associated with fraud.

International Trade Management

5. SAP Watch List Screening

Image Source: SAP

Most businesses are legally required to screen business partners against lists of restricted or denied persons and organizations, which have been flagged by international or government institutions. This solution provides an automated screening mechanism to simplify the process of vetting business partners and reduce the effort and costs associated with third-party due diligence. It lets you:

• Screen for restricted and denied parties—this includes conducting compliance checks for procure-to-pay and order-to-cash processes in real time. You can automate screening with inline process blocking and release, and use ad-hoc screening for specific use cases.
• Integrate and extend—leverage integration with SAP S/4HANA, and extend to different systems using published APIs.

6. SAP Global Trade Services

Image Source: SAP

Automate trading processes to accelerate cross-border supply chains and control costs. This solution helps clear inbound and outbound customs faster and avoid penalties or fines. It provides a unified repository for compliance requirements, letting you centrally manage global trade operations. It lets you:

• Screen for sanctioned parties—use a sanctioned party list (SPL) to screen partners in sales, procurement, finance and distribution. The solution blocks any transaction that fails the check and sends it for review. Use work lists to process blocked documents efficiently, with intuitive workflows to escalate suspicious entries.
• Manage exports—ensure compliance by connecting with primary logistics processes to classify products, screen for sanctioned parties and manage export licenses. Use a certified interface to connect to government customs systems and screen for embargos.
• Manage imports—handle logistics processes for procurement and inbound products using SPL screening, product classification, and customs management. Perform importer security filing (ISF) and use interfaces such as the Automated Broker Interface (ABI) from U.S. Customs and Border Protection.
• Enable real-time compliance checks—to ensure that both your products and the data necessary for compliance purposes move quickly, integrate with processes such as order and shipment. SAP Business Suite supports this integration.

Cybersecurity, Data Protection, and Privacy

7. SAP Enterprise Threat Detection

Image Source: SAP

SAP offers a security information and event management (SIEM) solution that leverages real-time intelligence. It can detect internal and external threats within your SAP environment and help you achieve compliance with audit and data protection regulations.

Here are several log correlation and analysis features of SAP Enterprise Threat Detection:

• Analyze massive amounts of log data from connected SAP systems.
• Correlate information from multiple systems to gain full visibility into activities.
• Perform forensic threat detection to identify unknown attack variants.
• Customize via integrations with third-party infrastructure components and systems.
• Secure communications using a unique kernel API, which lets you send logs directly to SAP Enterprise Threat Detection.

Here are several automated threat detection and alerting features of SAP Enterprise Threat Detection:

• Detection—use attack detection patterns to find SAP-specific known threats.
• Codeless—create custom attack detection patterns without writing code.
• Alerting—leverage alerts to investigate threats. You can push alerts to external systems.
• Privacy—utilize user pseudonymization when detecting evidence of misuse, with special authorization to access private data when needed.

8. SAP Privacy Governance

Image Source: SAP

This solution provides several capabilities that can help you achieve transparency, governance, and monitoring, to ensure compliance with compliance mandates like GDPR, CCPA, and HIPAA.

Security and privacy governance features include:

• Identify security and privacy risks—create a remediation plan to help you meet objectives and achieve compliance.
• Deploy and manage maturity assessments—using configurable and flexible templates.
• Manage and monitor—you can monitor ongoing compliance and manage security and privacy control evaluations.

Data-driven assessment features include:

• Privacy assessments—such as data protection impact assessments, managing a record of processing activities, and privacy impact assessments.
• Privacy data intelligence—monitor data lifecycle governance processes.
• Monitor program activities—with a unified view allowing evaluation of program effectiveness.

Data subject rights request features include:

• Data subject rights requests—initiate requests with self-service capabilities, and fulfill them using a workflow-driven process of review and response.
• Automatically verify identities using artificial intelligence (AI).
• Automate treatment of personal data—including location, validation, modification and deletion of personal data.

Identity and Access Governance

9. SAP Cloud Identity Access Governance

Image Source: SAP

SAP lets you implement identity and access management (IAM) across complex environments, including cloud and on-premises components. SAP Cloud Identity Access Governance provides a user-friendly, dashboard-driven interface.

Access compliance management features include:

• Continuous access analysis—using real-time insights that can support access compliance management.
• Customized access—using configurable and predefined access rules and policies.
• Dynamically updated user access—according to changing business requirements.

Assignment optimization features include:

• Accurate assignment of user access
• Analytic intelligence that helps you discover business-critical issues, using dashboard-driven UIs and visual prompts.
• Guided remediation helps you dynamically change access and manage access-related risks.

Control and risk management features include:

• Extended access control—for enterprise applications, including users logging in from any location and any device.
• Segregation of duties (SoD)—monitor on-premise and cloud systems for SoD and security violations.
• Preconfigured audit reporting—simplifies compliance management and reports.

10. SAP Access Control

Image Source: SAP

This solution streamlines management and validation of user access. It lets you set up automated processes for user provisioning in SAP systems. It also lets you embed preventative policy checks to enforce governance and monitor emergency access.

• Access risk analysis—accurately identifies and remediates segregation of duties (SoD) and critical access violations.
• User access management—automates user access assignments across SAP environments as well as third-party tools.
• Role-based access control (RBAC)—defines and maintains compliance roles in a way that synchronizes with organizational structure and business language.
• Emergency access—provisions a temporary super-user status using “firefighter” login IDs. You can set this up in a controlled and auditable environment.

Learn more in our detailed guide to SAP Access

Related content: Connecting SAP Access Control to Concur, Ariba, SuccessFactors and More

Extending SAP Access Control with Pathlock

Pathlock is the proven SAP Solution Extension partner, which extends your SAP Access Control investment in several critical areas:

• With Access Violation Management, System Integration Edition (AVM SI), customers can extend their SAP Access Control and SAP Process Control implementation to monitor cross-application SOD risks in SAP cloud applications (like SAP Ariba and SuccessFactors) and non-SAP applications (like Salesforce and Workday)
  • With AVM SI, Access Control customers can perform cross-application SOD analysis
  • With AVM SI, Access Control customers can perform cross-application User Access Reviews
  • With AVM SI, Access Control customers can provision users automatically into roles, across multiple applications
• With Access Violation Management, Risk Analysis Edition, customers can supplement their SAP Access Control implementation with monitoring of violations of SOD risks, to create mitigating controls that can highlight errors and fraud
• With Pathlock Control, customers can extend their SAP Access Control implementation with Emergency Access Management for SAP Cloud (SAP Ariba and SuccessFactors) and non-SAP applications (like Salesforce and Workday)

Interested to learn more about how you can extend your SAP GRC investment with Pathlock? Request a demo of our industry leading capabilities today!

Best Practices for Developing a Successful SAP GRC Strategy

Here are a few ways you can effectively perform GRC in a SAP environment.

Establish Ongoing Controls

Effective GRC is a continuous process, which requires active management and continuous analysis. Implement regular reviews of access restrictions and resource provisioning. Implement tools and practices to gain visibility over your environment, and evaluate risks, including all known scenarios that can result in a breach. Create well-defined rules to reduce risk, based on industry best practices and trusted compliance frameworks.

Communicate and Align

It is important to have a good understanding of the GRC framework at all levels of the organization. There is often a gap between the security concerns of executives and the security concerns of IT and security frontline workers. All parts of the organization must be aligned on the goals, challenges, and priorities of the GRC effort.

Train

It is important to train all levels of employees with GRC responsibilities—do not assume managers or roles like financial or legal know all about GRC, and do not neglect training for junior employees, even if their responsibilities are minimal. Everyone needs to understand their role in achieving regulatory compliance. If you see that compliance issues are ignored at the executive level, seek assistance from outside consultants, who can often help present the issues in more effective terms and create buy-in.

Leverage Frameworks

You can map business-related controls to compliance requirements using frameworks such as NIST, COBIT, and ISO. Ensure that as much as possible, business processes are aligned with these frameworks via automation. Automation reduces the GRC burden on IT and audit teams.

For a GRC framework to be successful, it must be fully integrated into the organization’s structure and roles from top to bottom. It is difficult to implement GRC for the first time, but once it is in place, continuing the process is much easier, as long as you allocate adequate resources for maintenance and ongoing training.

SAP GRC Automation with Pathlock

Pathlock is the proven SAP Solution Extension partner, which extends your SAP GRC investment in several critical areas. Wit Pathlock, customers can:

• Extend their SAP Access Control and SAP Process Control implementation to monitor cross-application SOD risks in SAP cloud applications (like SAP Ariba and SuccessFactors) and non-SAP applications (like Salesforce and Workday)
• Supplement their SAP Access Control implementation with monitoring of violations of SOD risks, to create mitigating controls that can highlight errors and fraud
• Extend their SAP Access Control implementation with Emergency Access Management for SAP Cloud (SAP Ariba and SuccessFactors) and non-SAP applications (like Salesforce and Workday)
• Extend their SAP Process Control implementation to monitor business process controls across SAP cloud applications (like SAP Ariba and SuccessFactors) and non-SAP applications (like Salesforce and Workday)
• Extend their Role Based Access Control to Attribute Based Access Control, providing fine grained data masking and encryption to provide greater protection than broad roles can provide on their own

Interested to learn more about how you can extend your SAP GRC investment with Pathlock? Request a demo of our industry leading capabilities today!