01 October 2013

1. GRC Access Control, HCM Position Assignment & HCM Triggers Workshop BUSINESS BLUEPRINT WORKSHOP Fahri Batur – Sr. GRC Security Consultant - MENA 01 October 2013

2. Purpose and Objectives • Purpose • Provide a consistent baseline understanding of indirect SAP role assignments to HCM org structure • Understand the basic functional and technical dependencies of using HCM triggers to drive SAP account creation and SAP role assignment via the HCM org • Understand the specific challenges present for Strata in achieving HCM driven account provisioning • Objectives • Establish if the functional and technical dependencies can be met in the timeframes of the ERP project • Make a clear project/business decision if HCM triggers and indirect assignment can be included in the scope of delivery based on HCM stream readiness

3. Agenda • Overview of HCM Triggers for GRC AC ARM • Overview of User – Direct role assignment • Overview of HCM Position Based Indirect role assignment • Overview of Hybrid model – Direct and Indirect assignments • Strata specific requirements • Dependencies

4. HCM Triggers for GRC AC ARM In a business scenario where SAP HCM system is being used to maintain the master data for all employees, whenever any change occurs in the SAP HCM system then it potentially needs to be manually maintained in all the other systems. The HCM Triggers functionality of GRC AC will allow creation of automatic requests in ARM corresponding to changes in the master data in SAP HCM system. User does not need to fill the ARM request form. When an event is triggered in the SAP HCM system, such as hiring a new employee, rules are applied and a corresponding action to create a workflow request is initiated in ARM. The request can be processed by HCM through ARM workflow and can be provisioned to backend system directly or indirectly by HCM through ARM.

5. HCM Triggers for GRC AC ARM • HCM Triggers allow automatic creation of workflow requests in ARM when some actions like hiring of a new employee, position change or change in personal data of an employee are held in SAP HCM system. Here is some explanation on the four options that we have for configuring HCM Triggers: • Actions • What to do when a rule is encountered • Rules • When will the action be performed • Automatic SAP HCM triggers • Field Mapping • Map SAP HCM fields to ARM fields • Process Log • Record of ARM updates through HCM Triggers

6. User – Direct role assignment Users gain SAP Access rights which are directly assigned to their SAP user master records. This means that as they move around or leave the organisation the role assignments have to be manually adjusted or automated via a tool such as Access Control 10.0 – Access Request Management or an Identity Management solution

7. HCM Position Based – Indirect role assignment • Users gain SAP Access rights based on the position(s) that their personnelHCM record is attached to, this means that as they move around or leave the organisation the role assignments are adjusted automatically

8. HCM Position Based – Indirect role assignment - Pros • Reduce the administration time taken by the SAP authorisation team • Standardises the access – everyone that is assigned to that position will receive the same access • When people move around the organisation their SAP Business Roles are removed for the old position and added for the new position • When new people join the organisation they are automatically given the roles assigned to that position

9. HCM Position Based – Indirect role assignment- Cons • Position based model is inflexible, everyone assigned to the position gets the same roles, if there is a need for one person to cover / deputise for another then you cannot grant them access without moving them to a new position. • Requires the HCM Organisational assignment processes to be very robust and stable – adding new HCM Organisation levels, positions, or changes to current HCM Organisation levels, positions will impact the users access. • Users must have a HCM personnel records which must be maintained with a link to the SAP User ID Via infotype 0105 record, the SAP User ID must be created first before assignment to position occurs. • Users’ access is only triggered when there is a change in the HCM position. • Integration with Access Control 10.0 – Access Request Management is less effective, as the requests are for the organisation object not the user. • Access Control Risk analysis will be conducted at the User level, but changes occur at the position level. • Does not integrate well with a complex landscape. • Additional training is required for the role owners to understand the impact of approving assignments to the position.

10. User – Direct role assignment - Pros • This is the most widely used role assignment concept. • This approach is very flexible, each user can be assigned the correct SAP Business Roles to carry out their task. • Members of the same team could have different access to allow for deputation. • Roles can be set to expire to force a periodic business access review (yearly or less). • Integrates well with Access Control 10.0 Access Risk Analysis and Access Request Management, this is the concept they were designed to support. • Access Control Risk analysis will be conducted at the User level, and changes occur at the User level. • Users do not need to have a HCM user record.

11. User – direct role assignment- Cons • As people move around the organisation, the roles required for old task are not always removed or added • If new people join the organisation or move to a new position, they have to request the access they need, which sometimes means they don’t always get the right access for the job.. Sometimes too much sometime not enough

12. Hybrid model – Direct and Indirect assignments As this hybrid suggest you get the best and the worst of both worlds

13. Hybrid model – Direct and Indirect assignments • Users gain SAP Access rights which are indirectly assigned to the HCM organisation structure and directly assigned to their user records. This means that as they move around or leave the organisation some roles will be added or removed automatically and some roles have to be manually adjusted or automated via a second tool like Access Control 10.0 – Access request Management or an Identity Management solution. • Allows for a more flexible access control model than the HCM indirect position, and adds more control than the direct assignment. • You can handle normal staff, consultants, contractors and 3rd party in the way that best suits the business.

14. Hybrid model – Direct and Indirect assignments - Cons • Hybrid model can only grant additional access, this means that the HCM position holds the minimum roles required for the position so all team members may need to request additional roles to complete day to day activities • The Role Owners need to understand that one request may be for the User and the next request is for the position and may affect more than one person. Additional training is required for the owners to understand the impact of approving assignments to the position. • HCM and the User Administration team need to work together. • If new people join the organisation or move to a new position, they may have to request the additional access they need which sometimes means they don’t always get the right access for the job.. Sometimes too much sometime not enough

15. ALE of HCM org structure to ‘receiving’ systems • As SAP roles are ‘local objects’ then the HCM org structure needs to be ALE’d to the other systems so that system specific SAP role assignments can be assigned

16. ALE of HCM org structure to ‘receiving’ systems • The GRC system legitimately has it’s own org structure that would be corrupted by the ALE of the HCM org structure into the GRC system meaning direct assignments would occur