Influencing SAP: SAP Customer Connection Selection Call ...

PUBLIC

Nadine Engler – SAP Customer Connection Project Manager

Shiguo Wang – Chief Product Owner

Lily Xiao – Product Owner

September 19, 2018

Influencing SAP: SAP Customer ConnectionSelection Call GRC – Process Control and Risk Management 2018

2PUBLIC© 2018 SAP SE or an SAP affiliate company. All rights reserved. ǀ

The information in this presentation is confidential and proprietary to SAP and may not be disclosed without the permission of SAP.

Except for your obligation to protect confidential information, this presentation is not subject to your license agreement or any other service

or vote agreement with SAP. SAP has no obligation to pursue any course of business outlined in this presentation or any related document, or

to develop or release any functionality mentioned therein.

This presentation, or any related document and SAP's strategy and possible future developments, products and or platforms directions and

functionality are all subject to change and may be changed by SAP at any time for any reason without notice. The information in this

presentation is not a commitment, promise or legal obligation to deliver any material, code or functionality. This presentation is provided

without a warranty of any kind, either express or implied, including but not limited to, the implied warranties of merchantability, fitness for a

particular purpose, or non-infringement. This presentation is for informational purposes and may not be incorporated into a contract. SAP

assumes no responsibility for errors or omissions in this presentation, except if such damages were caused by SAP’s intentional or gross

negligence.

All forward-looking statements are subject to various risks and uncertainties that could cause actual results to differ materially from

expectations. Readers are cautioned not to place undue reliance on these forward-looking statements, which speak only as of their dates,

and they should not be relied upon in making purchasing decisions.

Disclaimer

3Customer© 2017 SAP SE or an SAP affiliate company. All rights reserved. ǀ

▪ Recap of project timeline and approach

▪ SAP selection criteria for requested improvements

▪ Improvement request selection results

▪ Next Steps

Agenda

Recap of project timeline and approach


Focus Topic scope: GRC – Process Control & Risk Management 2018

The Focus Topic “GRC – Process Control & Risk Management 2018“

contains topics associated with Improvements to existing functionality

of GRC Process Control and GRC Risk Management.

Target Releases: Process Control 12.0, Risk Management 12.0


SAP Customer Connection GRC – Process Control & Risk Management 2018

Project timeline

Collection

of improvement requests

prioritized by votes

Selection

of improvement

requests for

implementation

Development

of improvements, delivery via

Notes/Support Package

Productive use in customers‘

systems

Collect Select Develop Use

Kick-Off

March 21, 2018

Final Call

May 24, 2018

1st Delivery Call

Q4 2018

open project workspace close project workspace

May 31, 2018

Provide feedback

on productive use

Provide feedback on

specification (optional)

Makes detailed analysis

and decision on

implementation

Develops and delivers

SAP Notes and support

packages

Improves process for

Customer ConnectionFollows, moderates, and

comments on improvement

requests submitted

Submit improvement requests

and prioritize by votesCustomer

activities

Project phases

SAP project

team activities

2nd Delivery Call

Q1 2019

Selection Call

September 19, 2018

SAP selection criteria for requested improvements


SAP selection criteria for requested improvements

Improvement

Requests

submitted

by customers

CC relevant Requests

• Small enhancements to

ensure product quality

• Improved support for your

day-to-day business

SAP selection criteria

• Positive impact for many customers

(Requested improvements need

minimum 5 voting customers to

qualify)

• Global relevance of the

improvement

• Realization time and effort

(maximum 6 months of

development)

• Easy and fast deployment

(can be delivered in Notes / Support

Packages, no structural changes,

must be ‘switchable’)

Portfolio relevant Requests

• Bigger enhancements but

also relevant for the product

• Takes more time to realise

(not realisable in the CC

project frame)

• Out of topic focus

Improvement request selection results


Improvement Requests – Overview

planned implementation for “CC relevant request”

# IRs submitted by customers 154

- # rejected IRs (due to lack of customer votes) 69

- # rejected IRs (due to violated design rules) 3

= # qualified IRs (5 or more votes) 82

CC Requests 68

# IRs already available 4

# IRs accepted (planned for development) 29

# IRs rejected - Prioritization 35

Customer Connection

Relevant Requests


Improvement Requests – Overview

communication for “portfolio relevant requests”

# IRs submitted by customers 154

- # rejected IRs (due to lack of customer votes) 69

- # rejected IRs (due to violated design rules) 3

= # qualified IRs (5 or more votes) 82

Portfolio Requests 14

# IRs planned for portfolio 1

# IRs under review for portfolio 9

# IRs not planned for portfolio – addressing partner solution 2

# IRs not planned for portfolio - product strategy 2

Portfolio Requests

Customer Connection relevant requests


Improvement Requests in scope for development* 1/3

Request ID Idea Title Votes

209333 Unifying the Email Customizing in GRC PC 20

209707 Completed Work Items to be deleted from Work Inbox / Refresh issue 17

209177 warning when control saved with no regulation 17

209729 Assign risk to central subprocess 16

209994 CCM scenario of type ABAP Report spool list in Excel Spreadsheet format 15

211682 Provide ability to reopen closed CCM issues 15

209717 Possibility to change default assignment option for Subprocesses 14

209224 Ability to select multiple organizational units in Process Control reports 14

209190 PC: Change ABAP Report CCM SubScenario so that it does not have to be Review Required 12

209725 Enlarge Description field to a reasonable size 12*) Planned – no commitment

https://influence.sap.com/sap/ino/#/idea/209333













209375 GRC PC does not include locked users in the CCM SOD/RA sub scenario business rule results 12

209259 PC: CCM Automated Monitoring - Job Scheduler allow for actioning of more than 1 job step at a time 10

209992 Risk Assignment pop-up is too small and has no filtering option 10

211750 SOD Integration scenario Business Rules MUST have the ability to show Locked Users 10

211195 Transfer work items for individual replacements 10

209709 Datasheet report should support custom defined PDF forms 10

210842 Adobe Offline Forms with CCM - Should allow of separation of results by Business Rule 10

209722 Display Hierarchical View in expanded view per default 9

209752 Disclosure Survey tasks are missing in Planner Monitor 9

209996 My Processes not fully refreshed after adding new locally created control 8*) Planned – no commitment














211688 Ability to Upload additional docs to the closed control performance or testing items (MTOE/MCPs) 8

210301 Assessment Survey results report does not show current status by default 8

211223 Improvement of GRFN_REPORT_EXECUTE report via email 8

209176 Response validity configuration: PC/RM integration for effectiveness and completeness 8

209719 My Processes: separate WD applications for Hierarchical View & List View 7

210969 Process Controls - Assessment Survey results report 6

211225 Disclosure Survey Configurable Notifications 6

210299 Central control/processes and related local controls/subprocesses cannot be deleted in one go 6

209864 Cannot determine when the survey item has been completed in the reports 5

*) Planned – no commitment











Improvement Requests already available


209193 PC:Manual Control Performance: Planner's ID should not be used to issue Plan. Should be System ID. 11

209332 Uploading the Business Rule Assignment 10

211756 Request: Notifications for CCM Execution Problems 8

210973 Reporting - Parameters for years 6






Rejected Improvement Requests – Prioritization 1/4


209449 Enhancing the Join Capabilities in Data Sources 12

209182 make hardcoded workflow names configurable 12

211838 Searching Work Items in the Frontend 10

212027 MCP plan enhancement 10

211476 Delegation: email notification also to the delegate person 8

209724 New long text fields to overcome 40 Char restriction 8

211708 Background Job basing on Planner Monitor to send out email for workflows in status error 8

212378 Enable priority status to be set on OWP (Adobe offline form) emails 8

212377 OWP (Adobe Offline form) - Reminder emails should include OWP form 8

209727 Possibility to assign Users / Roles to ELC individually 8














211684 Provide the ability to secure DS/BRs via a security object 7

211694 Improvement of Escalation Funcionality 7

209829 Unable to see with whom the survey items are pending in NWBC 7

210958 Monitored Controls Report 7

209718 Possibility to deactivate personalised timeframe Date / Today 7

209331 Improving the Performance for Scheduling CCMs 7

210759 Opportunity Escalation Workflow similar to Risk Escalation Workflow 6

212538 Optional workflow requiring administrator approval on closing a SOX issue 6

209651 Enhance Audit log report to include all entity objects 6

211026 Allow role assignments to objects that are no longer valid 6














209822 Business Owners cannot cancel survey items / campaigns in the front end 6

209429 Option to Retrieve actual PDFs submitted to the system 6

209753 Multiple Choice Answer Type for Surveys 6

211194 OWP form for Disclosure Survey is inconsistent with NWBC version 6

209836 The user cannot see what is his role in the 'My processes section' 5

209431 Evaluation Review as Regulation/Local Setting 5

209949 GRC PC delegations doesn't show all required information 5

211193 Allow setting ad-hoc issues to void 5

210971 Uploading of scheduling jobs 5

211967 Shared Service Functionality improvements 5














209837 Possibility to send notification when owners are assigned to controls 5

210260 Hability to include Headers/Non question information in surveys 5

209764 Mass Activation of Planner Activities 5

211844 Display Objects in Overviews as Links 5

211687 Two levels of review in the control testing workflow ( Manual test of control effectiveness ) 5






Portfolio requests


Portfolio Requests

Request ID Idea Title Votes Status Decision

212215 Create the Survey and CCM Issue forms in the Fiori platform 7 Planned for Portfolio*

209099 Forwarding capabilities for Adobe Interactive Forms / OWP in SAP Process Control 14 Under Review for Portfolio

211210 Scheduling CCM Jobs open ended 13 Under Review for Portfolio

211845 Mass Data Changes for SAP GRC Objects 12 Under Review for Portfolio

212217 Increase the Daily Executions for CCM Jobs to be 366 days 10 Under Review for Portfolio

212162 Flexible Workflow Configuration 7 Under Review for Portfolio

210243 Asset as a new master data object with 1:N capabilities 7 Under Review for Portfolio

210238 fix Master Data Change workflow & notification inconsistencies / gaps 6 Under Review for Portfolio

209943 Issues with the Manual Control Performances Plan 6 Under Review for Portfolio

209091 MANUAL resetting of all GRC Process Controls/Rules 6 Under Review for Portfolio

*) Planned – no commitment












Portfolio Requests


210236 CCM - consolidation of exceptions / issues per control 14Not Planned for Portfolio -

Product strategy

210240 New "ICS results per timeframe" dashboards - matrix view 10Not Planned for Portfolio -

Partner solution

210237 Adobe Interactive Form for Sign Off workflow 10Not Planned for Portfolio -

Product strategy

211746 Global Risk and Control Matrix needs to be available to all users, not just assigned owners 6Not Planned for Portfolio -

Partner solution





Rejected requests


Rejected Requests – Violating Design Rules


209100 Datasource and Business rule compare report across clients/systems 9Not planned - Design rules -

will not be developed

211015 Entity level authorizations can't be traced 8Not planned - Design rules -


209868The Control Owner replacement feature doesn't work for a Control Owner assigned on

the same day 7Not planned - Design rules -





Next Steps


Next steps

Improvement Request

owner

SAP Development

voting customers

(optional)

▪ Review of specification

▪ Test and acceptance of the improvement by IR Owner – where applicable

▪ Presentation of results in Delivery Call webinars (Q4 2018 and Q1 2019)


Find & use delivered enhancements consistently – made by SAP

Customer Connection projects:

▪ Easy to use

▪ Search (by topic, by date) & translation functionalities included

▪ Accessible to everyone, S-user only needed for accessing SAP notes

▪ Quick results – downloadable for immediate consumption

Accessible under https://sapimprovementfinder.com

The SAP Improvement Finder

https://sapimprovementfinder.com/

Questions & Answers

Questions or remarks? We are here for you.

Simply contact us via e-mail:

Nadine Engler

SAP Customer Connection Engagement OwnerT +49 6227 7-47425

E [email protected]

www.sap.com

Thank you.

Join us:

twitter.com/sapinfluencing

Discover Innovations:

http://www.sap.com/innovationdiscovery

Visit us:https://influence.sap.com

mailto:[email protected]

http://www.sap.com/

twitter.com/sapinfluencing

http://www.sap.com/innovationdiscovery

https://influence.sap.com/

Appendix


Requirements not qualified 1/5

IR ID Improvement Request Title Votes

209813 'Assessment Survey Results' report shows invalid failures in the survey results 4

209819 No combined report for Assessment survey results and Remediation statuses 4

209821 More than one control can be created with the same name 4

210015 Filter added to the selection and assignment screens of objects in Process Contol 4

210957 Question library – Question id 4

210960 Configurable controls – Notification only 4

210968 Monitoring job tab 4

211010 Allow Referencing for Indirect Entity Level Controls 4

211204 Modifiable Test/Step Result Description 4

211443 Task, issue, rem. plan recipient: restriction for roles or user groups 4

211836 Disclosure Survey Review: re-answering of same questions shall be optional 4

211971 Planner Enhancement: Export of "View Objects" to Excel 4

212005 Control Disclosure survey notifications to multiple users to behave as manual controls notifications 4

212069 Disclosure survey: Review step for 1 task shall not be dependent on completion of all tasks 4

209823 PC: Risk Assessment and Control Risk Assessment survey export to Excel option 3




209854 Offline Notification via Email for RIsk Propasal 3

209862 A person who creates remediation plan can send the remediation plan task to anyone 3

209867 Column sizes in the reports cannot be extended 3

210000 Requirement to have a “today” period as default in every frontend view or report 3

210962 Mitigating control library 3

210965 Survey case numbers 3

210966 Record Issues according to the Issue Date 3

210970 Cut & Paste Central Controls 3

211029 Default values and standard settings for decentralized data entry 3

211695 Ability to Assign Remediation Plan Directly 3

212006 Recurring scheduling based on working days 3

212268 Extend "Top Risks" Report by additional attributes 3

212404 Addition of 'Full Name' of the Remediation Plan Owner in workflow containers 3

212417 Requires Archive functionalities for CCM- Job Scheduler functionalies like Planner 3

209271 User Default BRF+ Function not working for Role Name until it is alphabetically the first in Acc Req 2




209692 Inconsistancy in Business role mapping PRGN_COMPRESS_TIMES job is scheduled 2

209812 Audit log report - Cant trace who has changed regulation for an Organization 2

209816 PC: Customer Scoping Process Flow - Selecting by Sub-Process Attributes 2

209820 PC: Perform Risk Assessment for Financial Scoping workflow act like Manual Test of Effectiveness 2

209835 Control owners cannot see the entities to which they provide controls in RCM report 2

209860 Walkthroughers cannot see the Control Owners in the survey items 2

209940 Report requirement to see the Control Owner Backup, Delegate and walkthrougher Vs Control Matrix 2

210261 Multiple Item selection for Notification Plans 2

210262 Regulation Specific Assessment Ratings 2

210961 Text length for deficiency descriptor in business rules 2

210964 Ability to copy controls in central controls 2

210972 Escalation workflow 2

210974 Report on Central Controls 2

210976 Risk Coverage Report 2

211060 Planner Notification Enhancement 2




211208 Linkage of Ad Hoc Issues for Disclosure Surveys 2

211217 Default Issue Name and Description 2

211515 Document Template for OWP Confirmation message 2

211516 Searchable connector for Model 0GPC_MCP 2

211517 Fallback Receiver by Funcionality/Regulation/Control 2

212271 Highlight changes in the Risk Attributes Comparison Report (ID: GRRM_GEN_CHA) 2

212274 Date/ Period selection in "Risk & Opportunites" to enter data for the past/ future 2

212414 Accomodating many-to-many model for shared service centers 2

209657 CCM - Dynamic Parameters in any type and not only date 1

209818 No 'Notes' section available for Central Controls to capture changes 1

209825 Control objectives tab is available at the Subprocess level but not at the Control level 1

209827 Change Analysis Report does not show if subprocess was assigned as 'Provided' / 'Received' subproces 1

209831 The 'Without Recipient' filter in the Planner serves no purpose 1

209833 PC: Add Risk Category to Risk Assessment Results Report 1

209942 Risk and Control Matrix show duplicates 1




210263 Global Variant Restriction for NWBC Reports 1

210947 Let users decide over language versions and make maintaining translations easier 1

210975 Survey Reports 1

211219 Collapsible explanation text in Disclosure Survey 1

211514 Compatibility Between OWP and Online funcionalities 1

211755 Attachments available at the question/test/step level 1

211787 Riskmanagement: Performance dashboard improvement 1

212488 Scheduling GRC Process Control Self Assessment with Frequency quarterly 1

212594 Improvement Access Risk Analysis - the view of the created report must be readable 1


Improvement Request - Status

Status Definition

Identified Improvement request is submitted by a customer (the request owner) on

the Customer Influence site.

Qualified Improvement request is voting to by at least five customers after the end

of collect phase and is, as a next step, analyzed by SAP in the selection

phase.

Scoped Improvement request is planned for development within the develop

phase of the Focus Topic.

Rejected Improvement request is not planned for development by SAP in the

foreseeable future.

Under Review for Portfolio Request has been analyzed and indentified as exceeding the capabilities

of the SAP Customer Connection project. The request is currently under

review whether it fits into the portfolio planning for future product

releases.

Planned for Portfolio Request has been analyzed and indentified as exceeding the capabilities

of the SAP Customer Connection project.The request has been taken

into the planning for the future product portfolio. Nevertheless, there is no

commitment about the scope what or timeline when to deliver. The

request might even be rejected if SAP changes mind during a later time.

Rejected for Portfolio Request has been analyzed and indentified as exceeding the capabilities

of the SAP Customer Connection project.It also does not fit into the

future product portfolio and will not be followed on any further by SAP.


Improvement Request – Rejection Reason

REASON DEFINITIONApproved within SAP decision meeting Improvement request was analyzed and is implementable and shippable via a

note/consulting note, or support package.

Already in development planning Improvement request was analyzed and is already part of an existing product backlog

and/or is planned to be shipped via an enhancement package or a new product release.

Addressing country-specific/legal requirements Improvement request was analyzed and is part of a localization product that was not

part of the Focus Topic scope.

Lack of voting customers Improvement request was voting to by less than five customers.

Out of scope Improvement request does not fit into scope of Focus Topic; a new topic needs to be

requested (please refer to section 2.1 – “How can I suggest a new Focus Topic for SAP

Customer Connection?”).

Prioritization Improvement request was analyzed and could be shippable via a note or support

package ; however, due to the number of implementable improvement requests, a

project backlog prioritization had to take place.

Violating design rules Improvement request was analyzed and is not implementable and shippable via a note

or support package and violates SAP design rules.

Addressing partner solution Improvement request was analyzed and addresses a partner product.

Influencing SAP: SAP Customer Connection Selection Call ...

Documents

Transcript of Influencing SAP: SAP Customer Connection Selection Call ...