Documenting Controls Centrally 

Use

When a process step has been defined as a control in the central process catalog, this control then has to be documented centrally using control attributes in a different Web application. These central control attributes can be changed by organizational units that have copied the process with the control. In this case, the central attributes serve as default settings that simplify work for the organizational units.

Prerequisites

·        The values that the control attributes can take have been defined in Customizing for MIC under Edit Attribute Values .

·        All settings for the process to which the control belongs have been made in the central process catalog (for example, the assignment to a control objective and to a risk).

·        All attributes for the process step to which the control corresponds have been defined in the central process catalog.

·        You have authorization for the task Edit General Control Attributes in Central Process Catalog (EDIT-CCATR).

·        The task is scheduled (see Task Scheduling).

Features

Documenting a control involves defining various attributes and assignments.

The following are examples of general control attributes:

·        Control Significance

·        Nature of Control

·        Control Purpose

·        Control Automation

·        Control Trigger

·        Assessment Attributes

·        Test Attributes

·        Control Relevance

In the Control - P-CO-R tab page, you assign one or more risks to the control. In this way, you specify that the control serves to mitigate the corresponding risk. For the assignment, you have access to all risks that are assigned in the P-CO-R (Process – Control Objective – Risk) structure to the relevant process in the central process catalog (see P-CO-R Assignment ). Moreover, once the P-CO-R-C assignment has been made, you select the appropriate control type.

In the Control - Accounts tab page, you assign FS assertions from account groups to the control. For the assignment, you have access to the account groups and FS assertions that were assigned to the corresponding process in the central process catalog. From these, you select the assertions that are relevant for the control.

On the AIS Reports tab page, you can assign reports from the Audit Information System (AIS) (see Assignment of AIS Reports).