GRC Roles and Responsibilities – Business Systems Analysts (IS&T)

GRC Roles & Responsibilities – Business System Analysts

Business System Analysts (BSAs) will carry out the following tasks as part of their GRC-related responsibilities:
 Assist the Role Owner and Risk Owner with:
o Analysis of changes to risks due to changes in roles or user/role assignments
o Redesign of Roles in terms of business-relevant information and Single vs Composite role design
o Understanding the Risk – i.e. what the SAP access allows and if there are any additional technical
features which are being used , or can be used, to reduce / mitigate the risk – this includes
configuration settings, MIT enhancements, additional access security.
 When there are new “Z” transactions, the BSA will assist in categorizing to the closest standard SAP
action. The GRC Admin group will add these to the ruleset in the same place as that standard SAP action.
 Assist the BA to document the new / changed role design and communicate it to the SAP R/3 Security
Admin group. Potentially assist in the initial role testing.

 Assist the BA with documenting any technical Mitigation Controls

 Prepare mini-specs for any new mitigation controls which require technical work (configuration settings, ,
additional access security, new SAP control reports).
Responsibilities Reference

TASKS PROCESS & STEP

Analysis of Risks related to user access 1.2, 1.3, 2.1
User role redesign and test plan 1.4
Review for SOD issues from periodic ARA review 5 Q.2
Definition of Mitigation controls 2.2, 2.3
Assist with testing new or changed roles 1.7, 1.11

REPORTS PROCESS
05 Roles by Role Name 1
06 User to Role Relationship 1
07 Role Relationship with User - User Group 1
08 Users by User ID 1
09 Count Authorizations for Users 1
10 Action Usage by User Role and Profile 1
11 Mitigation Control Report 2
12 User Level 1, 2
13 User Level Simulation 1, 2

FORMS PROCESS & STEP

None None

WORKFLOW OR EMAIL-TRIGGERED ACTIONS PROCESS & STEP

None None