GRC AC UAR - Auto removal of un-approved Roles after 90 days SLA

[moondhrakaush]

Dear Experts,

I've configured UAR functionality by keeping Role Owners as reviewers.

How do I configure further so that if there's no action taken on the UAR requests within 90 days, the Roles gets removed automatically ?

Thanks,

Kaushal

[madhusap · Accepted solution]

Hi Kaushal,

Your requirement is not an out-of-box functionality, however with some minor enhancement in UAR webdynpro approval functionality, you should be able to achieve it.

Enhance Approval functionality to have proposed action as REMOVE ROLE (by default). When the reviewer is performing the review then can APPROVE to keep the roles.

In case the reviewer did not finish the review process in 90 days then route the request to "Auto Approval" path so that request gets completed and access will be revoked for those users not reviewed by reviewers in UAR requests.

However, removing the access of your end users just because your reviewer did not finish the review on time is not a good governance design as it impacts operations. Have some processes like Email reminders, Escalating to higher level, Delegating the request to Alternate Approvers, Updating the Status of pending review requests in monthly meetings and most importantly educating and training your reviewers on the objective of review will help to get your process streamlined.

Regards,

Madhu

[moondhrakaush · Accepted solution]

Thanks Madhu,

I knew about this method of going with enhancement however was wondering if SAP has introduced anything for this in the latest versions of GRC.