Assessment of Control Design and Efficiency 

Use

During control design assessment, you review the maturity of a control.

During control efficiency assessment, you review which resources are necessary to perform a control. An issue is created, for example, if it is possible to automate a control currently performed manually.

Both types of assessment can be executed in parallel for a control.

For compliance with the SOA requirements, the design of a control must be assessed by the owner. This assessment presents an opportunity to check at the same time the efficiency of a control with a view to improving the process (not required by SOA). If control design or control efficiency can be improved further, the control owner then reports this as an issue. Only when the issue has been resolved can the assessment be closed with a positive rating.

Performing assessments at an earlier point in time makes it easier to test the effectiveness of a control, which occurs in a later phase of an MIC project.

Prerequisites

You have specified in Customizing for MIC under Assessment and Test whether the rating for control design assessment should be issued manually or automatically, and, in the latter case, how the automatic rating should be determined from the maturity gap.

The person who is to perform the assessment has authorization for one of the following tasks:

●     Perform Control Design Assessment (PERF-CDASS)

●     Perform Control Efficiency Assessment (PERF-CEASS)

Features

When the control owner has reviewed the control, he or she enters the assessment result (rating) in the system using the appropriate task in their task list. For control efficiency assessment, ratings are always issued manually. For control design assessment, you can automate this step by having the system issue the rating automatically. In this case, the system determines the rating from the difference between the required target maturity for a control and the current control maturity entered by the assessor (maturity gap).

Other than the actual rating, the control owner enters additional assessment data, such as comments or the technique used for the assessment. If the assessor discovers a shortcoming, he or she reports it by creating an issue in the system.

In Customizing, you can specify that the assessments still have to be validated (confirmed) by the owner of the superordinate object. In the case of the assessment of a control, for example, the process owner must validate it. This central setting for validation can be changed when accepting processes.

Depending on the result of the assessment and on whether validation is required, different changes in status and thereby different process flows are possible. For more information, see Process Flow of Assessments and Manual Tests.

Example

Example: Control Design Assessment (Without Validation)

Example: Control Design Assessment (with Validation)