Skip to Content
avatar image
Former Member

Request can not be approved, Mitigate risk(s).

Hello,

Need you help on our issue.

We are currently using GRC 10.1 SP12. We have this scenario when the user requested for two different roles (Finance with risk and HR roles) beloging to two different paths.

The approval goes below:

Stage Approval Manager Yes Servicedesk Yes Role Owner for HR Yes Role Owner for Finance (with risks) Yes

On the role owner stage, the request will split depending on the path where the role is associated.

If the HR Role Owner will approve first, the role owner has been prompted with an error to mitigate the risk associated to Finance. 

Our question is that why is it that the HR role owner must be required to mitigate the Finance risk which is not related to his / her role.

See screenshot below.

access request.png (229.7 kB)
access request.png (207.2 kB)
access request.png (296.6 kB)
access request.png (95.3 kB)
Add comment
10|10000 characters needed characters exceeded

  • Get RSS Feed

1 Answer

  • Aug 25, 2016 at 09:44 AM

    Hi Jill-Ann,

    As I know this conception of GRC, if you request roles in one request they must be evaluated together within risk analysis. I see 2 possible solution (there might be more of course):

    • customize system to create more than one request per user (not recommended) and request FI roles in one request, HR roles in another.
    • 2nd possible solution (as we have): set risk mitigation procedure for a different stage. We set it for Manager stage and base on the mitigations/risks results role owner takes a decision.

    Regards,

    Artem

    Add comment
    10|10000 characters needed characters exceeded