Mitigation Control Assignment Workflow Follow Up

[mbennett27]

I have a couple of questions related to the following archived thread:

https://archive.sap.com/discussions/thread/3592062

1. What happens to the original request when the role owner tries to submit? Does the request remain open?

2. How is role owner notified that mitigation is approved and role owner can proceed? If the control assignment is rejected is the original request rejected or does it remain open?

[mbennett27]

Thanks. I was able to utilize native notifications to send the Requester (person that suggested the mitigating control) an email on Approval or Rejection of the Mitigating Control workflow request.

[alessandr0]

Hi Matthew,

regarding 1) if the requests triggers the mitigation assignment approval workflow the current request (your access request) will move forward. It either goes to the next stage or it closes once it reaches the end of the workflow. If you have set that the stage cannot be approved while risks are not mitigated, you would have to wait until the mitigation assignment request is approved. Since here is a disconnect between the two workflows you always end up in having misunderstandings. That also leads to question 2) since there is a disconnect, the role owner does not get notified. The original request remains open if you don't allow to move on (the Despite Risk setting in MSMP). Otherwise, the request will, as mentioned, move and close out once it reaches the end.

I guess it's a better approach to get the mitigation monitors involved in the access request workflow with a custom function so that the workflow detours to a mitigation approver path once a mitigation is present. Then they always have the ability to reject role assignments (may be just one out of 10 that is causing the conflict), or also reject the entire request.

Hope that helps.

Regards, Alessandro