A critical piece of the GRC puzzle, proper segregation of duties (SoD) and access control over key information assets, is one of the most effective safeguards against fraud and mistakes – and a prerequisite for sound corporate oversight required by various regulatory mandates around the world, such as the Sarbanes-Oxley Act. It is also one of the most difficult controls to deploy and sustain given the thousands of users, roles, and processes that require access and authorization evaluation, testing, and remediation.

Manage and Prevent User-Access and Authorization Risk Across the Enterprise

SAP GRC Access Control delivers a comprehensive set of access controls that identify and prevent access and authorization risks in cross-enterprise systems to prevent fraud and reduce the cost of continuous compliance and control. GRC Access Control enables all corporate compliance stakeholders – including business managers, auditors, and IT security managers – to collaboratively define and oversee proper SoD enforcement, enterprise role management, compliant provisioning, and superuser privilege management.

SAP GRC Access Control enables you to achieve:

• Minimal time to compliance – Set up access controls using the most comprehensive library of SoD rules to go live quickly and achieve a cost-effective cleanup of initial controls. Build on the extensive library of best practices, developed over a 10-year period, to rapidly identify and eliminate cross-enterprise access risks in real time, and rely on preventive controls built into business processes to stop future violations.
• Continuous access management – Enforce SoD compliance from the start with enterprise-wide role design, documentation, and maintenance that eliminates manual errors and enforces best practices. Prevent reintroduction of SoD violations throughout the employee life cycle with compliant user provisioning that includes automated approval workflows, mandatory, real-time risk assessments, and remediation that occurs prior to physical user provisioning. Allow business users to perform emergency activities outside of their role with superuser privilege management that employs a controlled, auditable environment meeting both operational and control requirements.
• Effective management oversight and audit – Managers have effective and comprehensive management oversight through user access reaffirms and reviews of access-risk, SoD rules, mitigating controls, roles and audit trails for role provisioning, user provisioning, emergency access, and more. Auditors can comprehensively and more easily validate proper management oversight to ensure the business complies with all policies by making sure all access is properly authorized and by ensuring that SoD risks are appropriately mitigated.