Sending Mitigating Control Reminders - Alerts and Notifications

[Former Member]

Hi All,

This query relates to notifications and alerts in ARA 10.

Our objective is set up notifications so that control monitors receive reminder messages to their SAP inboxes on a periodic basis.

We have completed the following steps:

-          Run actions sync job

-          Created mitigating controls with owners and monitors assigned

-          Populated the “reports” tab with a transaction code, assigned a frequency of 1 and a control monitor

-          Assigned mitigating controls to access risks identified

-          Run the generated alerts job (with the “send notifications” option ticked)

Via the "Access Alerts-Mitigating Control" report, I can see that alerts have been generated for the mitigating controls. However, no notifications emails were sent to the control monitors inbox.

Are there any additional steps that I need take in order to send notifications? 

Does the control monitor need to have run the report action tcode in order to trigger the frequency countdown?

We’re running GRC 10 with support pack 8.

Any help would be much appreciated!

Regards,

Maeve

[Former Member]

Hi Maeve,

Check the thread:

http://scn.sap.com/thread/3165695

Regards,

Ajesh.

[simon_persin4]

Hi Maeve

Smriti is referring to the Mitigation Control Change workflow rather than the alerts notification.

If I understand you correctly, you are referring to the reminder notification from the ARA alerts rather than the actual change of mitigating control master data.

Have you checked the configuration for SAPCONNECT in transaction SCOT? Is it set up to send email notifications from your GRC system?

If not, configure this. If it is, check Transaction SOST to see if the notification is waiting to be sent?

Does the monitor have an email address assigned in the user master record which can be sent to?

It should just send the notification on the back of the alert generation report if the mitigating control report has not been executed within the number of days set.

Simon

[Former Member]

Hi Simon,

Thanks for your response. 

We're not trying to send external emails - we want the notifications to be displayed in the SAP Work Inbox for a user.

Thanks,

Maeve

[Former Member]

Hi Maeve,

The control monitor will receive e-mail only when something is changed within the mitigating control. For eg: you have changed the risk or added or rmeoved some risk from the mitigating control.

Regarding the functionality of "report" which is maintained in reports tab of mitigating control, the e-mail is sent to the approver if control monitor does not run that report at the frequency mentioned.

I hope this clarifies the functionality.

Best regards,

Smriti

[Former Member]

Hi Smriti,

Thank you for your response.

We have generated the alerts, but notifications are not being delived to the control monitors inbox - Is there additional configuration required?

If the monitor has never run the "report" tcode, will an additional alert be generated every time we run the generate alerts job?

Thanks,

Maeve

[Former Member]

Hi Maeve,

The alerts job should send the notification to mitigation control monitor if there have been some changes to the mitigating control.

If the control monitor does not run that report mentioned, mail will be sent to approver, not to control monitor.

Best Regards,

Smriti

[Former Member]

Hi Smriti,

The control approver has not recieved an notification for the alert either.

Is there particular settings or configurations required before notification messages will be sent to owners? When generating alerts, the "send notification" option was enabled.

Thanks!

Regards,

Maeve

[former_member193071]

Hi Smrithi,

I have one query on your second statement

"If the control monitor does not run that report mentioned, mail will be sent to approver", not to control monitor.

My Query:

Can GRC AC has the functionality to check the back-end system whether control monitor execute the report or not with in the maintained frequency. I think this functionality is available in PC. Could you please clarify me on this part?

Thanks in advance

Regards,

Kesava

[former_member184114]

Smriti,

I have made some changes to one of the mitigation controls for testing purpose. Later I executed the "GRAC_ALERT_GENERATION" with "Send Notification" box checked.

I have seen no email notification sent to the Monitor?

By the way, this job is scheduled on daily basis and mitigation approver receives the email notification successfully.

Also I noticed that, in spite of executing the "report" in back end system, Mitigation Approver received email notification!

May you please help me understand this?

Regards,

Faisal

[former_member193071]

Hi Faisal,

I think we both are in same page. When I have scheduled the Alert generation, irrespective of report execution in back end systems, mitigation approver received emails.

Looking forward for someone to reply us on this.

Regards,

Kesava

[former_member184114]

Kesava,

Thanks for your reply.

I would like to hear about the complete mitigation control monitor procedure.

Hope that somebody would help us 🙂

Regards,

Faisal