Risk and violation in SoD management, are they synonymous?

Posted by Marta Ortona on Aug 26, 2022 8:15:00 AM
Marta Ortona


In the Segregation of Duties' management in SAP, in the risk analysis phase, it's possible to reason in different ways on the obtained result. 



If a user has a risk how can we describe this situation? Usually the terms Conflict, Risk or Violation are used as synonyms. Is that really true or not? 

Are risk and violation synonymous?


Unfortunately, there is no one-size-fits-all answer, it depends on which tool is used to perform risk analysis. Infact, each tool has its own specific terminology. We can, however, say that talking about conflict can be synonymous with risk. 


The main tool that SAP offers for risk analysis is SAP GRC Access Control in its module Access Risk Analysis (ARA). This is the terminology in the tool version 12. We will use the terminology of this tool as a measuring measure. 


How does SAP GRC Access Control reason? 


In SAP GRC there are two kind of violations: 

  • At risk level
  • At permission or rule level 

In the first case, risk level violation means how many users have a certain risk. 


In the second case, permission level violation, means how many violations generate users who have that risk. 

Let's see in more detail, in the following section, how this calculation works.


How is the violation calculated in SAP GRC Access Control?


The term violation is to be found in the nature of the GRC instrument. Infact, GRC, against a risk generates a number of rules (as Cartesian product) representing the combinations between transactions and authorization objects (in risk function). See the image belove: 


In the dashboard management of SAP GRC Access Control, Access Risk


Analysis module, is possible to decide in which format to see the risk analysis' results.


GRC Management


Through drill-down of detail, for example on "low" level risks, in case of risk M004 I will have thirteen users with this type of violation. See following:            


Risk detail


In the table GRACMGRISKD, is possible to display the same count in the risk analysis summary view, as a result I will have thirteen entries related to the system and selected risk, see the image below. The sum of the risk count for these users will be 960: the number of violations at the permission level. 


Risk table detail

Entering in the same report at permission level (see the following image) the value will be 960. 


violations detail

In the table GRACUSERPRMVL, that is the result of the detailed risk analysis of the GRC at permission level, the unique count of the column ACTRULEID would be 960 for the involved users. In the example below, for the "LAST" user’s case, 78 lines. 


Conteggio violazioni



The number of risks per user (assuming this is the subject) is always less or equal to the number of violations.

Reading risk analysis in violations or risks mode, may show better or worse results. 


Reasoning at risks is easier especially in the initial stages of Segregation of Duties Management. Violations can be a driver to focus on in remediation or mitigation.  


Lowering, even almost completely, the number of violations, could leave unchanged the number of risks on users. Removing all risks is definitely the ideal way to make the remediation or mitigation phase really effective. 


Blog post originally translated from: https://www.aglea.com/blog/rischio-e-violazione-nella-gestione-della-sod-sono-sinonimi




Topics: governance, Segregation of duties, SAP GRC, sod

Yes Subscribe!

Blog Aglea, what you could find out?

Every Friday a new post, interview or content related to SAP Security.

  • Tips on how to design SAP Security
  • How to
  • Checklist
  • Common error and pitfall on security SAP
  • Interview with experts
  • Who we are and Aglea vision on SAP Security

Recent Posts

Post By Topic

See all