To create a mitigating control for SAP functions
-
In the Manager, select the Identity Audit > SAP functions > Function definition working copies category.
-
Select a working copy in the result list.
-
Select the Assign mitigating controls task.
-
Select the Create mitigating controls task.
-
Enter the main data of the mitigating control.
- Save the changes.
-
Select the Assign function definitions task.
-
In the Add assignments pane, double-click the function definitions you want to assign.
- Save the changes.
The following base data is relevant for SAP Functions:
Use function categories to group SAP functions by specific criteria. For example, in a function category you can group together all SAP functions for a specific use case.
To create a function category
-
In the Manager, select the Identity Audit > Basic configuration data > SAP function categories category.
-
Click 
in the result list.
-
Edit the function category's main data.
- Save the changes.
To edit a function category
-
In the Manager, select the Identity Audit > Basic configuration data > SAP function categories category.
-
In the result list, select a function category and run the Change main data task.
-
Edit the function category's main data.
- Save the changes.
Enter the following main data of a function category.
Table 22: SAP function category properties
|
Category |
The function category’s name. |
|
Parent category |
Parent category for organizing function categories hierarchically. |
|
Description |
Text field for additional explanation. |
To assign a function category to a function definition
-
In the Manager, select the Identity Audit > SAP functions > Function definition working copies category.
-
Select a working copy in the result list.
-
Select the Change main data task.
-
In the Function category drop-down, select a function category.
- Save the changes.
You can use functional areas to analyze rule violations in context of Identity Audit for different SAP functions. You can enter criteria that provide information about risks from rule violations for functional areas and SAP functions.
To analyze rule checks for different areas of your company in the context of identity audit, you can set up functional areas. Assign functional areas to hierarchical roles, compliance rules, SAP functions, and service items. To assess the risks, specify how many rule violations are permitted in a functional area or role. You can enter separate assessment criteria for each role, such as a risk index or transparency index.
Moreover, functional areas can be replaced by peer group analysis during request approvals or attestation cases.
Example: Use of functional areas
To assess the risk of rule violations for cost centers. Proceed as follows:
-
Set up functional areas.
-
Assign cost centers to the functional areas.
-
Define assessment criteria for the cost centers.
-
Specify the number of rule violations allowed for the functional area.
-
Assign the functional areas to the SAP functions or compliance rules that are relevant for the assessment.
-
Use the One Identity Manager report function to create a report that prepares the result of rule checking for the functional area by any criteria.
To create or edit a functional area
-
In the Manager, select the Identity Audit > Basic configuration data > Functional areas category.
-
In the result list, select a function area and run the Change main data task.
- OR -
Click in the result list.
-
Edit the function area main data.
- Save the changes.
Enter the following data for a functional area.
Table 23: Functional area properties
|
Functional area |
Description of the functional area |
|
Parent Functional area |
Parent functional area in a hierarchy.
Select a parent functional area from the list for organizing your functional areas hierarchically. |
|
Max. number of rule violations |
List of rule violation valid for this functional area. This value can be evaluated during the rule check. |
|
Description |
Text field for additional explanation. |
Mitigating controls assigned to the function definitions to be tested are automatically copied to rules about SAP functions. Conditions:
- Active rules are assigned to a functional area and a department.
- The function definitions to be tested are assigned to the same functional area and to the variable set associated with the same department.
