GRC SAP 2018 Pei Xiao Breakingnewssapprocess

Breaking News: SAP Process Control and SAP Risk
Management Upgrade
Pollen Pei and Lily Xiao
SAP
Legal disclaimer
The information in this presentation is confidential and proprietary to SAP and may not be disclosed without the permission of
SAP. This presentation is not subject to your license agreement or any other service or subscription agreement with SAP. SAP
has no obligation to pursue any course of business outlined in this document or any related presentation, or to develop or
release any functionality mentioned therein. This document, or any related presentation and SAP's strategy and possible
future developments, products and or platforms, directions, and functionality are all subject to change and may be changed by
SAP at any time for any reason without notice. The information in this document is not a commitment, promise, or legal
obligation to deliver any material, code, or functionality. This document is provided without a warranty of any kind, either
express or implied, including but not limited to, the implied warranties of merchantability, fitness for a particular purpose, or
noninfringement. This document is for informational purposes and may not be incorporated into a contract. SAP assumes no
responsibility for errors or omissions in this document, except if such damages were caused by SAP´s willful misconduct or
gross negligence.
All forward-looking statements are subject to various risks and uncertainties that could cause actual results to differ materially
from expectations. Readers are cautioned not to place undue reliance on these forward-looking statements, which speak only
as of their dates, and they should not be relied upon in making purchasing decisions.
© 2018 SAP SE or an SAP affiliate company. All rights reserved. ǀ Public 1

Public
Legal disclaimer
The information in this presentation is confidential and proprietary to SAP and may not be disclosed without the permission of
SAP. This presentation is not subject to your license agreement or any other service or subscription agreement with SAP. SAP
has no obligation to pursue any course of business outlined in this document or any related presentation, or to develop or
release any functionality mentioned
Because therein.
SAP This document,
Process or any related
Control, SAP presentation and SAP's strategy and possible
Risk Management,
future developments, products and or platforms, directions, and functionality are all subject to change and may be changed by
SAP at any time for and SAPwithout
any reason Access notice.Control release
The information 12.0 are
in this document targeted
is not for promise, or legal
a commitment,
obligation to deliver release
any material,
incode,
March or functionality. This document is provided
2018, everything containedwithoutin
a warranty
this of any kind, either
express or implied, including but not limited to, the implied warranties of merchantability, fitness for a particular purpose, or
noninfringement. This presentation is subjectpurposes
document is for informational to theand disclaimer.
may not be incorporated into a contract. SAP assumes no
responsibility for errors or omissions in this document, except if such damages were caused by SAP´s willful misconduct or
gross negligence. Similarly, every screenshot is considered a “lab preview.”
All forward-looking statements are subject to various risks and uncertainties that could cause actual results to differ materially
from expectations. Readers are cautioned not to place undue reliance on these forward-looking statements, which speak only
as of their dates, and they should not be relied upon in making purchasing decisions.

Public
Agenda
Introduction
Overview: SAP Process Control and SAP Risk Management Release 12.0
Visual harmonization
Preview SAP Risk Management 12.0 enhancements
Preview SAP Process Control 12.0 enhancements
Demo
Wrap-up

Public
Introduction
The “3 Ws” for this session
To introduce Version 12.0 of SAP Process Control and

SAP Risk Management, targeted for release March 2018
Compliance managers, risk managers, control managers,

business process owners, project teams, auditors –
especially those who already use or are implementing SAP
Process Control and/or SAP Risk Management
A preview of the release so you can understand how to

work this into your upgrade plans

Public
Overview: SAP Process Control and SAP Risk Management Release 12.0
Introducing SAP Process Control and SAP Risk Management 12.0
 Visual harmonization to introduce Fiori and

Fiori-like look and feel to PC and RM
 Device-independent user interfaces
 Functional enhancements
 Performance enhancements

Public
Upgrading to version 12.0
Target release: March 21, 2018
 The code base will include SAP Process Control,

SAP Risk Management, and SAP Access Control
12.0
 Upgrade to SAP NetWeaver® version 7.52 and

SAP_UI 7.52 SP02 will be required.
 No data migration steps will be required
 Configuration changes will be required to deploy

selected enhancements

Public
Visual harmonization
What is visual harmonization?
Goal: provide PC and RM users the latest and best

user experience from SAP S/4HANA
More specifically, a Fiori-like experience:
 Increased use of Fiori apps and launchpads
 A Fiori-like theme for Web Dynpro screens where

Fiori is not available, which includes colors,
navigation elements, and tiles
 Unified entry from Fiori Launchpad
© 2018 SAP SE or an SAP affiliate company. All rights reserved. ǀ Public

* Some limitations at time of presentation 10
Public
Prerequisites of visual harmonization
 Works only with Fiori 2.0 and

the new Belize theme
 Kernel 7.49 or higher
 SAP_UI and SAP_BASIS 7.51

SP00 or 765 respectively (NW
7.51 / NW 7.65) or higher
 Requires application adoption
 Requires activation of product

– if you are not part of
S/4HANA

Public
Prerequisites of visual harmonization (cont.)
S/4 Release SAP SAP_BASIS Release

Kernel
Release
Backend Frontend
Server Server
S/4HANA SAP 7.65 7.50

Cloud 1608 Kernel
7.49
S/4HANA SAP 7.51 7.50
ON-PREMISE Kernel
1610 7.49
Note: For Stand Alone products (e. g. CAR) it must be decided whether VH should be enabled or not. If the product
is enabled then it will appear visually harmonized in all constellations in which the NW 7.51 is the underlying basis.

Public
Fiori launchpads
Driven by business roles, 7 of which are delivered out of the box

Delivery with 12.0
For Process Control:
 Compliance manager (mapped to internal control manager) PFCG Role
 Compliance specialist (mapped to control owner)
 Executive (mapped to CEO/CFO) Business Catalog
 Manager (mapped to organization owner)
For Risk Management:

Existing
 Employee (mapped to risk owner/risk expert)
 Risk Manager (mapped to central risk manager)
GRC Role
 Risk Management Specialist (mapped to unit risk manager)
The PCFG roles assigned permit the user to access the work centers to which they are assigned.

Public
Creating your own SAP Fiori launchpads
High-level steps:
1. Create a new business catalog in SAP Fiori Launchpad
Designer (IMG).
2. Add tiles to the new catalog from existing catalogs for
PC and RM.
3. Add target mapping.
4. Optionally, add a business group (will be used as source
of tiles available to those related to your new business
catalog).
5. Create a new PFCG role and add the corresponding
business catalog and business group.

Public
Top 4 things to keep in mind
 User Interface component needs for the Gateway system

 SAP_UI 7.52 SP02 will be required
 Work center entries will be mapped to tiles
 Standard roles will be delivered

Public
You choose: SAP Fiori launchpads or SAP Business Client (BC)
You can use either—some users may prefer launchpad, others BC or offline forms
Public
What does “Fiori-like” mean?
 Many screens could not be

completely redone in Fiori for
this release
 Where new Fiori apps were

not possible, we changed the
look of existing Web Dynpro
screens to be more in line with
Fiori
 Remember that these will also

work on multiple devices*

* Some limitations at time of presentation 17
Public
SAP Process Control
Compliance Manager
Responsible for managing

compliance within his
organization

Public
Fiori Launchpad – Compliance Manager

Public
SAP Process Control
Compliance Specialist
Responsible for multiple

processes, Euro travel

Public
Fiori Launchpad – Compliance Specialist

Public
Fiori Launchpad – Executive

Public
Fiori Launchpad – Manager

Public
SAP Risk Management
Risk Manager
Responsible for managing

risk information and
processes

Public
Fiori Launchpad – Risk Manager

Public
Fiori Launchpad – Risk Management Specialist

Public
Fiori Launchpad – Employee-Risk Management

Public
SAP Risk Management
Preserve and grow value
Plan
Monitor and report Plan risk management within
Monitor thresholds, the context of value to the
effectiveness of risk organization
responses, and corrective
actions
Identify
Link risks, risk drivers, risk
Enterprise indicators, impacts and
Respond responses
risk and
Respond to risk after
compliance
balancing costs and benefits
Analyze
Analyze risk via scenarios,
modeling, and other factors
to understand exposure

Public
 Workflow enhancements*
 Risk aggregation
 Activity validation*
*both 10.1 and 12.0

Public
Workflow enhancements
Workflow enhancements to better support risk management process and facilitate

update of information
 Delivery options in risk assessment workflows

 Key risk indicators manual entry workflow
 Streamlined risk validation process from sending to receiving

Public
Workflow enhancements (cont.)
Delivery options in risk assessment workflows

Public
Key risk indicators manual entry workflow

Public
Streamlined risk validation workflows

Public
SAP Risk Management
Risk Manager
How can I aggregate the underlying

risk analysis with minimum manual
efforts?

Public
Risk Aggregation
 Automatically aggregate underlying risks

▪ Reduce manual risk aggregation efforts
and errors
▪ Provide automated aggregated risk
insights to management
 Automatic analysis aggregation supports
standard aggregation methods
▪ Sum, average, maximum, minimum for
underlying impacts
▪ Sum, average, maximum, minimum for
underlying probabilities
 Standard aggregation methods can be
extended by customers/partners (e.g.,
weighted average)

Public
Risk Aggregation (cont.)
Define aggregation method
 Flexible configuration can be defined

to support risk management operations
 Different risk analysis profiles can be

supported

Public
SAP Risk Management
Risk Manager
How can I get the latest updates from

my risk activities without contacting
each risk owner?

Public
Activity Validation Enhancements
Plan Check
Activities “Rejected”
Risk Validation Results
Determining which Check plan result of activities
Manager activities need to be validation and decide if to trigger
validated by whom plan again
Validate
Activities
Activity Accept or reject
Owner activity based on risk
validation result or not
Validate
Risks
Risk Owner Accept or reject
content of risks within
certain activity

Public
Activity Validation Enhancements (cont.)
Enable new activity validation

Public

Public
The activity owner can view risk

validation information from other
risk validators.

Public
SAP Process Control
Help ensure effective controls and on-going compliance
Report Document
Insightful reporting for Single source of truth shared
analysis and accountability across the enterprise
Plan
Planning of focused actions
Evaluate Enterprise
risk and to help ensure timeliness
End-to-end test and issue
compliance
resolution
Perform and monitor

Streamlined manual and
automated performance

Public
SAP Process Control
Compliance Manager
Can I run CCM rules without mapping

them to controls?

Public
Automated control testing and monitoring of process flow
Define data sources Map to Analyze and

Trigger
and business rules controls report
FIN
Transaction
controls
Delivered rules O2C
SAP and reports Audit trail
Scheduling
P2P
Master data
controls
Optional in PC
HR
12.0
Configurable rules Dashboards and
Non-SAP analytics
and queries
IT Routing of
Configuration
workflow
controls
Fixed assets
Configurable Reports
deficiencies
FIN = finance; O2C = order to cash; P2P = procure to pay
Public
Automated control testing and monitoring of process flow (cont.)
Some customers would like more flexibility in how they use continuous control monitoring.
SAP Process Control 12.0 offers two new options:
 Standalone rules can be scheduled independently of related controls, if any
 S/4HANA Cloud can be monitored by Continuous Control Monitoring, incase ERP move to cloud
already

Public
Standalone rules
Business Rule Works without Controls

Manually Trigger
Data Source
Organization Control & Automated Issue &

Business Rule Adhoc Issue
Control Business Rule Monitoring Remediation
1. Links to Controls,
Rule works which defines
independent business
of defined contextpurpose of Rules
routegenerated
2. Exceptions only to responsible
based users directly
on Rules requirements
Continuous Monitoring
3. Responsible makes
user decides howsure Controls
to handle the fulfill compliance requirements
exceptions

Public
Standalone rules: Creating a standalone job

Public
Standalone rules: Creating a standalone job (cont.)

Public
Standalone rules: Confirm and save

Public
SAP Process Control
Compliance Specialist
Can I run CCM rules against S/4HANA

Cloud?

Public
SAP S/4HANA Integration
S/4HANA Cloud
SAP GRC Fully Configured and Operational Real-time enterprise resource management Public Cloud
GRC system (Processes, Controls and Risks)
12.0 suite for digital business. ERP
Cloud
Connector
+ RFC
Corporate Subsidiaries
In this Use Case, the Subsidiary purchases S/4HANA Public Cloud services but wishes to connect it to an existing, fully licensed SAP
Governance, Compliance and Risk (GRC) system with established business processes and controls located at the Company’s Headquarters
– continuous monitoring. The key is to have the ON-Premise GRC system communicate with the Public Cloud ERP system and to apply the
GRC logic to S/4HANA Cloud business transactions (FI, SD and MM). To do this, GRC system must be able to call S/4HANA Cloud to send
queries and S/4HANA Cloud must be able to make calls through the Cloud Connector to the On-Premise system to send corresponding data
back to GRC system.
Public
SAP S/4HANA Integration (cont.)

Public
Wrap-up
Where to find more information
GRC on sap.com
• Governance, Risk, and Compliance (GRC) Solutions: www.sap.com/grc

General help with SAP Governance Risk and Compliance
• Help Portal: http://help.sap.com

• SAP Process Control: http://help.sap.com/pc
• SAP Risk Management: http://help.sap.com/rm
GRC on Analytics from SAP Blog
• GRC Tuesdays: http://blogs.sap.com/analytics/category/grc/

Public
Key points to take home
SAP PC and RM 12.0 provide clear and intuitive SAP Fiori interface
design that improves user experience and boosts efficiency
SAP Risk Management provides insight for decision making at the

board, managerial, and operational levels
Manage risks from end-to-end by leveraging automated risk

management workflows and activity validation capabilities
Automate risk aggregation activities and exception reporting with SAP

Risk Management
CCM standalone rules help business users by enabling them to

manage by exception.
CCM saves effort and money, while helping ensure consistency and
timeliness
CCM helps find issues, errors, and other discrepancies in S/4HANA
Cloud
Public
Thank you
© 2018 SAP SE or an SAP affiliate company. All rights reserved.
No part of this publication may be reproduced or transmitted in any form or for any purpose without the express permission of SAP SE or an SAP affiliate company.
The information contained herein may be changed without prior notice. Some software products marketed by SAP SE and its distributors contain proprietary software components
of other software vendors. National product specifications may vary.
These materials are provided by SAP SE or an SAP affiliate company for informational purposes only, without representation or warranty of any kind, and SAP or its affiliated
companies shall not be liable for errors or omissions with respect to the materials. The only warranties for SAP or SAP affiliate company products and services are those that are
set forth in the express warranty statements accompanying such products and services, if any. Nothing herein should be construed as constituting an additional warranty.
In particular, SAP SE or its affiliated companies have no obligation to pursue any course of business outlined in this document or any related presentation, or to develop or release
any functionality mentioned therein. This document, or any related presentation, and SAP SE’s or its affiliated companies’ strategy and possible future developments, products,
and/or platform directions and functionality are all subject to change and may be changed by SAP SE or its affiliated companies at any time for any reason without notice. The
information in this document is not a commitment, promise, or legal obligation to deliver any material, code, or functionality. All forward-looking statements are subject to various
risks and uncertainties that could cause actual results to differ materially from expectations. Readers are cautioned not to place undue reliance on these forward-looking statements,
and they should not be relied upon in making purchasing decisions.
SAP and other SAP products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of SAP SE (or an SAP affiliate company)
in Germany and other countries. All other product and service names mentioned are the trademarks of their respective companies.
See http://global.sap.com/corporate-en/legal/copyright/index.epx for additional trademark information and notices.
Wellesley Information Services, 20 Carematrix Drive, Dedham, MA 02026 Copyright © 2018 Wellesley Information Services.
All rights reserved.

GRC SAP 2018 Pei Xiao Breakingnewssapprocess

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

GRC SAP 2018 Pei Xiao Breakingnewssapprocess

Uploaded by

Copyright:

Available Formats

Breaking News: SAP Process Control and SAP Risk

© 2018 SAP SE or an SAP affiliate company. All rights reserved. ǀ Public 1

© 2018 SAP SE or an SAP affiliate company. All rights reserved. ǀ Public 2

© 2018 SAP SE or an SAP affiliate company. All rights reserved. ǀ Public 3

To introduce Version 12.0 of SAP Process Control and

Compliance managers, risk managers, control managers,

A preview of the release so you can understand how to

© 2018 SAP SE or an SAP affiliate company. All rights reserved. ǀ Public 5

 Visual harmonization to introduce Fiori and

 Device-independent user interfaces

© 2018 SAP SE or an SAP affiliate company. All rights reserved. ǀ Public 7

Target release: March 21, 2018

 The code base will include SAP Process Control,

 Upgrade to SAP NetWeaver® version 7.52 and

 No data migration steps will be required

 Configuration changes will be required to deploy

© 2018 SAP SE or an SAP affiliate company. All rights reserved. ǀ Public 8

Goal: provide PC and RM users the latest and best

More specifically, a Fiori-like experience:

 Increased use of Fiori apps and launchpads

 A Fiori-like theme for Web Dynpro screens where

 Unified entry from Fiori Launchpad

© 2018 SAP SE or an SAP affiliate company. All rights reserved. ǀ Public

 Works only with Fiori 2.0 and

 Kernel 7.49 or higher

 SAP_UI and SAP_BASIS 7.51

 Requires application adoption

 Requires activation of product

© 2018 SAP SE or an SAP affiliate company. All rights reserved. ǀ Public 11

S/4 Release SAP SAP_BASIS Release

S/4HANA SAP 7.65 7.50

© 2018 SAP SE or an SAP affiliate company. All rights reserved. ǀ Public 12

Driven by business roles, 7 of which are delivered out of the box

For Risk Management:

© 2018 SAP SE or an SAP affiliate company. All rights reserved. ǀ Public 13

© 2018 SAP SE or an SAP affiliate company. All rights reserved. ǀ Public 14

 User Interface component needs for the Gateway system

© 2018 SAP SE or an SAP affiliate company. All rights reserved. ǀ Public 15

 Many screens could not be

 Where new Fiori apps were

 Remember that these will also

© 2018 SAP SE or an SAP affiliate company. All rights reserved. ǀ Public

Responsible for managing

© 2018 SAP SE or an SAP affiliate company. All rights reserved. ǀ Public 18

© 2018 SAP SE or an SAP affiliate company. All rights reserved. ǀ Public 19

Responsible for multiple

© 2018 SAP SE or an SAP affiliate company. All rights reserved. ǀ Public 20

© 2018 SAP SE or an SAP affiliate company. All rights reserved. ǀ Public 21

© 2018 SAP SE or an SAP affiliate company. All rights reserved. ǀ Public 22

© 2018 SAP SE or an SAP affiliate company. All rights reserved. ǀ Public 23

Responsible for managing

© 2018 SAP SE or an SAP affiliate company. All rights reserved. ǀ Public 24

© 2018 SAP SE or an SAP affiliate company. All rights reserved. ǀ Public 25

© 2018 SAP SE or an SAP affiliate company. All rights reserved. ǀ Public 26

© 2018 SAP SE or an SAP affiliate company. All rights reserved. ǀ Public 27

© 2018 SAP SE or an SAP affiliate company. All rights reserved. ǀ Public 29

*both 10.1 and 12.0

© 2018 SAP SE or an SAP affiliate company. All rights reserved. ǀ Public 30

Workflow enhancements to better support risk management process and facilitate

 Delivery options in risk assessment workflows

© 2018 SAP SE or an SAP affiliate company. All rights reserved. ǀ Public 31

Delivery options in risk assessment workflows

© 2018 SAP SE or an SAP affiliate company. All rights reserved. ǀ Public 32