SAP GRC Overview

What is SAP GRC？

Governance， Risk， and Compliance

Governance, Risk, and Compliance, almost always referred to as GRC.

The goal of GRC is to help a company efficiently put policies and controls in place to address all its compliance obligations while at the same time gathering information that helps proactively run the business.

Done properly, GRC creates a central nervous system that helps you manage your business more effectively.

You also derive a competitive advantage from understanding risks and choosing oppotunities wisely.

In other words, GRC helps you make sure that you do things the right way: It keeps track of what you are doing and raises an alert when things start to go off track or when risks appear.

Access-Risk Analysis

With the SAP Access Control application, organizations can accurately identify and remediate violations associated with segregation of duties and critical access in real time.

User-Access Management

SAP Access Control automates access assignments across SAP and non-SAP software. It also helps to prevent access violations through embedded risk analysis.

Role Management

Users can define and maintain compliant roles in business-friendly terms and language.

Periodic Certification of Authorizations

Reporting functionality within SAP Access Control enalbles organizations to conduct periodic user-access reviews. They can also run checks to help ensure that mitigating action is effective in the case of segregation-of-duty conflicts.

Emergency Access Management

With SAP Access Control, organization can confidently authorize users to perform super-user activities outside their role. The software enables them to do this using "firefighter" login identification in a controlled, auditable environment.

GRC is not just about complying with requirements for one quarter or one year. Rather, those who are serious about GRC, meaning just about everyone these days, seek to create a system and culture so that compliance with external regulations, enforcement of internal policies, and risk management are automated as much as possbile and can evolve in orderly fashion as business and compliance needs change.

That's why some would say that the C in GRC should stand for controls: controls that help make the process of compliance orderly and make process monitoring and imporvement easier.

Some parts of the domain of GRC - measures to prevent financial fraud, for example - are as old as business itself. Making sure that money isn't leaking out of company and ensuring that financial reports are accurate have always been key goals in most business - only recently have they attained new urgency.

Other parts of GRC related to trade compliance, risk management, and envionmental, health, and safety regulations are somewhat newer activities that have become more important because of globalization, security concerns, and increased need to find and mitigate risks. For example, to ship goods overseas, you must know that the recipient is not on a list of prohibited companies. These lists change daily.

Growing concern about global warming and other pressures to reduce environmental impact and use energy efficently have increased regulations that demand reporting, tracking, and other forms of sociopolitical compliance.

Companies are also interested in sustainability reporting, measuring areas such as diversity in the workplace, the number of employees who volunteer, and environmental efforts, so that companies can provide data about corporate social responsibility. Financial markets punish companies that report unexpected bad news due to poor risk management.