Upgrading to SAP GRC 12: Down to the Wire

We are just weeks away from the SAP GRC application reaching the end of its mainstream maintenance on December 31 of this year (see illustration below).  Organizations who are running Access Control, Process Control or Risk Management 10.x should be upgrading to GRC 12 now; otherwise, the consequences for not upgrading could include entering the extended maintenance period or customer-specific maintenance (which often equates to higher fees). As a reminder, after the maintenance period ends, companies will not be able to log support incidents for the 10.x versions, however, but  will still be able to search the SAP Support Portal to find existing issues and solutions.

Referenced from SAP Product Availability Matrix (requires login)

Back in March, we wrote about upgrading to GRC 12 and taking advantage of the opportunity to optimize the use of GRC.  As we are down to the wire on the maintenance window, we have clients who are opting to first perform a “technical upgrade” to get up-to-date as quickly as possible and then planning for optimization later in 2021. Organizations choosing to go with the technical upgrade first should consider allocating enough time and resources to perform the necessary regression testing. This may sound like a large burden, but with the right skillset and documentation, is something that can be easily accomplished.

Organizations in this boat should follow the organization’s systems development life cycle, including ensuring there is adequate project governance and documentation.

Some of the key areas to consider include ensuring appropriate resourcing, time commitment and coverage of the following areas:

  • Project management – includes establishing project plan, timeline, key milestones, task owners and coordination between key stakeholders
  • Regression testing script development
  • Regression testing execution and support

Often, auditors classify GRC systems as critical to the organization (due to the processes it impacts, such as user provisioning, assignment of temporary elevated access and reporting on segregation of duties/sensitive access), so it is no coincidence that implementations and upgrades related to GRC software are selected for SDLC audits.  When we know this is the case, we want to make sure we have all our i’s dotted and t’s crossed!

If you are interested in discussing this topic further, please contact us directly. Visit Protiviti’s SAP consulting services page for more information on our solutions.

Jay Gohil

Director
Technology Consulting - Enterprise Application Solutions

Yeurd Ng

Director
Enterprise Application Solutions

Subscribe to Topics

Protiviti is happy to announce that Wendy Luebbe has joined as a Managing Director for the Technology Consulting Solution. Based in Orlando and with over 20 years of experience, Wendy will focus on the Enterprise Data & Analytics segment, specializing in financial services.

Join Protiviti's Scott Laliberte and Andrew Struthers-Kennedy for thoughts on how organizations should discuss and evaluate risks and include emerging technologies as part of risk and audit reviews. http://ow.ly/oJ0a50Fx7Hx

#ITaudit #ProtivitiTech #emergingtechrisks #prowebinars

Consumer #privacy is key. Protiviti recommends focusing on three buckets and eleven requirements that cover what an organization must consider when developing personal #data privacy protections and have a relationship with #digital #identitymanagement. http://ow.ly/8BuC50FA5Hj

Protiviti’s Scott Laliberte hosted a panel with three Chief Information Security Officers on July 11th. While all faced their own distinct pandemic-related issues, many common themes emerged during the discussion. Learn more: http://ow.ly/Er9e50FA3Q3

#CISO #ProtivitiTech

Reporting and #analytics are critical for #CIOs because they structure #data to guide businesses in strategic decision making. Learn why companies must harness and use information that propels business goals. http://ow.ly/eGoR50FA2ub

#TechTransformation #enterprisetransformation

Load More...