SAP GRC Interview Questions and Answers

1. What are the components of GRC?

The main components of GRC are:

• Access Control: Manages and controls user access rights and segregation of duties.
• Risk Management: Identifies, assesses, and mitigates risks.
• Process Control: Ensures compliance with internal controls and regulatory requirements.
• Audit Management: Facilitates and manages internal and external audits.

2. What are the upgrades happened in GRC 5.3 from GRC 5.2?

Upgrades from GRC 5.2 to GRC 5.3 include:

• Enhanced user interface and user experience.
• Improved performance and stability.
• New features and functionalities, such as advanced reporting capabilities and better integration with SAP ERP.
• Bug fixes and support for newer SAP versions.

3. Is it possible to have a request type by which we can change the validity period of a user? If possible, then what are the actions?

Yes, it is possible. To change the validity period of a user, you can:

• Define the request type in the GRC configuration.
• Configure the request to include actions like updating the user validity in the user provisioning system.
• Set up workflow steps to manage approval processes and validations.

4. What's the latest Support Pack for GRC 5.3? How it differ from the previous one?

The specific latest support pack should be checked on the SAP Support Portal. Generally, differences include bug fixes, performance improvements, and updates to integrate with newer SAP systems.

5. What are the issues faced by you in ERM & CUP after going live?

Common issues may include:

• Integration problems with other SAP modules.
• Performance issues or slow processing times.
• Incorrect or incomplete configurations.
• User adoption and training issues.

6. Can we change Single roles, objects & Profile descriptions through mass maintenance of roles? If yes, how?

Yes, changes can be made via mass maintenance. This is done through transaction codes or SAP tools for role maintenance where you can update multiple roles in bulk.

7. What are the prerequisites for creating a workflow for user provisioning?

Prerequisites include:

• Defining the user provisioning processes and roles.
• Configuring the workflow in SAP GRC, including routing and approval steps.
• Ensuring proper integration with SAP ERP and other systems.
• Setting up required authorizations and roles for workflow participants.

8. How will you control the GRC system if you have multiple rulesets activated?

Control can be achieved by:

• Prioritizing and organizing rulesets effectively.
• Regularly reviewing and updating rulesets.
• Using GRC configuration to handle conflicts and overlaps between rulesets.

9. Can we view the changes of a role, that happened in PFCG, through GRC?

Yes, GRC can track and audit changes to roles made in PFCG if configured to do so, often involving integration with Change Management tools.

10. How will you mitigate a user against an authorization object which is decided as sensitive by Business?

Mitigation involves:

• Implementing mitigating controls in SAP GRC.
• Defining and applying specific mitigation actions or processes.
• Reviewing and approving these mitigations as per compliance requirements.

11. Give an example of SOD with object level control & also decide the Risk implication from the Technical standpoint.

• Example: Preventing a user from both creating and approving purchase orders (P2P process).
• Risk Implication: If a user can both create and approve POs, it increases the risk of fraud or error in financial transactions from a technical standpoint.

12. Is it possible to assign two roles with different validity period to a user in one shot through GRC? If yes, how?

Yes, this is possible through GRC request types and user provisioning configuration, which allows assigning multiple roles with different validity periods in one request.

13. What's the use of a Detour path? How Fork path differ from the Detour path?

• Detour Path: Allows the workflow to take an alternative path based on conditions or exceptions.
• Fork Path: Splits the workflow into parallel paths that run simultaneously.

14. How can you enable a self-password reset facility in GRC?

Enable self-service password reset through the GRC configuration settings, usually involving user management or self-service configuration areas.

15. Can we have customized actions for creating request types in CUP?

Yes, CUP allows for the customization of actions for request types, involving configuring actions and workflows to meet specific business needs.

16. Which SOX rules were inherited in SAP GRC?

SAP GRC inherits various SOX compliance requirements, including segregation of duties, access controls, and audit trails to support financial reporting and internal controls.

17. How many types of Background job you are familiar with? Why Role/Profile & User Sync. job is required?

Types include Role/Profile Synchronization, User Synchronization, and Access Risk Analysis jobs. These jobs ensure synchronization of roles and users across systems and conduct regular risk analyses.

18. Where can we change the default expiration time for mitigating controls? What's the default value for the same?

Change the default expiration time through GRC configuration settings. The default value is typically 365 days but can be customized as needed.

19. How will you do the mass import of role in GRC?

Use GRC mass import tools or transaction codes to upload role data from files or external systems, following SAP guidelines for data formatting and validation.

20. Explain the total configuration & utility of SPM?

SPM (Security Policy Management): Configures policies and controls to manage security compliance. It includes managing and monitoring compliance with security policies and standards.

21. Can we create Logical systems in GRC? If yes, how & what can be the advantages & disadvantages of the same?

Yes, logical systems can be created in GRC. Advantages include better system organization and management. Disadvantages may include increased complexity and maintenance overhead.

22. Can we have a different set of number ranges activated for request generation?

Yes, different number ranges can be configured for different types of requests through GRC configuration settings.

23. Explain, how can we create derived roles in ERM. What will be the significant changes in methodology for creating composite roles?

Derived roles inherit characteristics from a parent role. The methodology for creating composite roles involves defining multiple roles with inherited permissions and managing role hierarchies.