GRC ARM - Auto approve at role owner level for "standard roles" for a user

[former_member271290]

Hello,

our customer is asking to bypass the role approval step if a user requests a role allowed for his position (based on a table roles-job position). Is there any solution to configure it on ARM ?

Let me if you need more details

thank you in advance

Samir

[former_member271290]

Hi Madhu, I'd like just to confirm you that maybe I've solved this issue.

I've created a BRF+ rule with the check (using DB Lookup) in a custom table that contains the mapping job positions and the allowed roles. If the roles are in this table it get as result with different path without any stage, so it is automaticaly approved.

Thank you again for the suggestion.

SC

[madhusap]

Hi Samir,

Since you are going to maintain this data in a mapping table, you have to handle the scenario of bypassing the approval step as part of your BRF+ or Custom function module logic.

When a request is submitted, verify the roles in the request against the mapping table using user's position in the access request as reference (I assume position is mapped to relevant filed in the access request form or in user data source) and route the roles which are allowed to be auto assigned to the user without approval to no stage workflow path and route the remaining roles to your normal access request workflow path. If the request contains only roles related to user's position then all roles get auto approved and assigned automatically as all roles go to no stage workflow path.

Another way is to restrict the roles users can select during request submission. If you can maintain position as role attribute and make users select only those roles based on their position then end user requests can directly go for auto approval without any additional logic as users can select only those roles which can be assigned to them based on their position.

Regards,

Madhu

[former_member271290]

Ok, thanks for the suggested solutions.

if we would like to define the HR structure which can be the possible setup to the bypass role owner step (if the role is ok with the job position)?

Consider that for all cases the request should go to SoD Manager in case of risks.

Thank you very much!

[madhusap]

Hi Samir,

Are you using a custom table to store Roles required for a position?

Or the roles are assigned directly to the position in the HR organisation structure?

Regards,

Madhu

[former_member271290]

Hi Madhu, thank you for your feedback.

the idea now is to map them in a custom table since there is no defined HR structure on SAP yet.