Analyzing Risks When Approving Access Requests

Use

On the Access Request screen, you can perform risk analysis and impact analysis before approving requests. You have the following options for performing the analysis:

On the Risk Violations tab, you can perform the analysis and save the results.
On the User Access tab, you can use Simulation to first perform the analysis and then choose whether or not to save the results.

Note

You can set the requirement that approvers must analyze risks before approving access requests. Maintain this setting in the Customizing activity (transaction SPRO) Maintain MSMP Workflows, under Governance, Risk, and Compliance Access Control Workflow for Access Control. In the Maintain Paths phase, under the Maintain Stages section, select Display Task Settings. Select the Risk Analysis Mandatoryfield and choose Yes or No.
You can allow approvers to approve access requests despite risks. Maintain this setting in the Customizing activity Maintain MSMP Workflows, under Governance, Risk, and Compliance Access Control Workflow for Access Control. In the Maintain Paths phase, under the Maintain Stages section, select Display Task Settings. Select the checkbox for the Approve Despite Risk field.

Procedure

This procedure is the same regardless of the tab page you choose to initiate it. The only difference is that Simulation allows you to choose whether or not to save the results.

From the My Home work center, select Work Inbox. On the Workitems screen, select Access Management. Choose an access request.
Do one of the following:
- Select the Risk Violations tab.
- On the User Access tab, choose Simulation.

In the Analysis Type dropdown list, select the relevant analysis type.

You use Risk Analysis to determine violations pertaining to the authorizations assigned to the role. For example, when the authorizations result in segregation of duties violations.

Note

You can customize SAP Access Control to include firefighter assignments automatically in the risk analysis.

Maintain this setting in the Customizing activity (transaction SPRO) Maintain Configuration Settings, under Start of the navigation path Governance, Risk, and Compliance Next navigation step Access Control End of the navigation path . For the parameter Consider FF Assignments in Risk Analysis, enter the values as follows:

Column	Value
Parameter Group	Risk Analysis
Parameter ID	1038
Parameter Value	Yes or No, as required

You use Impact Analysis to determine authorization violations pertaining to other roles. That is, the authorizations for the selected role, in combination with authorizations for another role, result in violations.

Select the System and Rule Set.

Under the Result Options area, select the format, type, and additional criteria for the analysis results.

Choose the Run Risk Analysis pushbutton.
In the Result area, you can choose different ways to view the analysis results.
If you are running a simulation, you can:
- Choose Cancel if you do not want to save the results of the analysis.
- Choose Apply if you want to save the results of the analysis. The information is saved to the Risk Violations tab and you can view it whenever you open the request. The results are also available to the approver of the request.
On the Risk Violations tab, you can choose to mitigate any risk by selecting the risk and choosing Mitigate Risk.

Format:	Executive Summary
Type:	Action Level, Permission Level
Additional Criteria:	Include Mitigated Risks