Business users face challenges while performing control activities (for example, accuracy in control effectiveness). They strive to find ways to achieve timely performance using workflows and to upload evidence for activities. I explain how a business process owner can set up, execute, and document performance plan tasks that ensure faster execution, clear accountability of different stakeholders within the business process, and enhanced reliability and consistency of controls.
Manual Control Performance in SAP Process Control 10.1 enables business process owners to conduct control activities and deliver evidence documents to auditors. You can attach the evidence documents using an attachment feature. Business process owners can track multiple performance plans along with their statuses. I explain the setup of Manual Control Performance using a business scenario and show how to enable different stakeholders for different transactional activities at different levels within a performance plan.
Set Up your System for Manual Control Performance
To use Manual Control Performance, you need to have an SAP system with SAP Process Control 10.1 Support Package 11 or higher. I now walk you through the steps to set up your system for Manual Control Performance.
1. Set Up Roles and Authorizations
You need to set up roles and authorizations so that you can use the SAP Process Control 10.1 Manual Control Performance feature. Table 1 lists details pertaining to the roles necessary for the Manual Control Performance feature.
Open Data Protocol (OData) Service Role. This role is required by all business users who need access to the SAPUI5 interface. It can be assigned at the transaction code SU01 level.
Food and Drug Administration (FDA) control performer
All these roles can be assigned at the entity level.
Sarbanes-Oxley control performer
Cross-regulation control performer
Note: A user can assign any existing role for a Manual Control Performance step reviewer.
Manual Control Performance performer roles
Table 2 lists details pertaining to the authorization objects necessary for Manual Control Performance.
Details for Manual Control Performance authorization objects
Datapart allows a part of the entity to be editable or viewable when it is configured in a role that has grouped the specific data in tabs under that entity.
2. Configure the Open Data Protocol (OData) Data
The OData service GRPC_CTRL_PERF_SRV needs to be configured. It was delivered to exchange data between the user interface (UI) and the back end. This service must be activated post installation or post upgrade.
To maintain and activate the OData service GRPC_CTRL_PERF_SRV, execute transaction code SPRO and follow menu path SAP Reference IMG > SAP NetWeaver > SAP Gateway > OData Channel > Administration > General Settings > Activate and Maintain Services. Click the execute icon beside Activate and Maintain Services to open the screen in Figure 1. Click the Add Service button to maintain the service.
Click the Add Service button
In the System Alias field, choose the system alias you defined during Gateway configuration and press Enter. Use F4 input help to select the alias. Usually, you choose the local system alias. Depending on your system configuration, you can either choose a local or another system alias. For more details, contact your system administrator.
Select the new service from the list and choose Add Selected Services. In the dialog box that appears, enter ZGRPC_CTRL_PERF_SRV in the Technical Service Name field, choose Local Object in the Package Assignment field, and click the OK button.
Note: You can use wild cards during your search (for example, *GRPC_*SRV). You have now activated the OData service required for the new feature.
3. Activate Manual Control Performance Workflow and Tasks
To activate workflow and tasks, follow Customizing menu path SPRO > SAP Reference IMG > SAP Customizing Implementation Guide > Governance, Risk and Compliance > General Settings > Workflow > Perform Task Specific Customizing. Click the execute icon beside Perform Task-Specific Customizing to open the screen in Figure 2. Navigate to SAP > GRC > GRC-SPC. Click the Assign Agents link. This action opens the screen in Figure 3.
Click the Assign Agents link
Set the attribute to General Task
Follow these steps to enable the task and workflow for Manual Control Performance.
Click the Manual Control Performance tasks highlighted in Figure 3 one by one.
- Create Manual Control Performance
- Perform Manual Control Performance
- Rework Manual Control Performance
- Review Manual Control performance
Select the task and click the Attributes button. Select the General Task radio button and click the Transfer button. Then go back to the main screen shown in Figure 2. To activate the Event Linkage, go to SAP > GRC > GRC-SPC and click the Activate event linking link (Figure 4).
Click the Activate event linking link
In the screen that the system opens (Figure 5), find WS7650029 and expand the node. Select the row below the WS7650029 node and click the Deactivated button. This action enables the event linkage that is highlighted in the rectangular marked box. A green Activated status button appears on the screen after the event is activated.
Activate the event linkage
4. Maintain the Entity-Role Assignment
You next must enable the assignment of roles to the entity. In my example, Role SAP_GRC_SPC_CRS_CTL_PERFORMER has been assigned to the CONTROL entity and is visible in the Role tab of the control screen.
To complete this step follow menu path SAP Customizing Implementation Guide > Governance, Risk and Compliance > General Settings > Authorizations > Maintain Entity Role Assignment. Click the execute icon beside Maintain Entity Role Assignment and in the screen the system displays (Figure 6) click the New Entries button.
Maintain new entries
In the next screen (Figure 7) select the Entity using F4 help and select the Role using F4 help to maintain the role for the entity. Repeat this step for other roles shown in Figure 8 for Entity Control.
Role assignment for Entity Control
Click the save icon shown in Figure 6 to save your entries. The list of roles assigned to Entity Control is then shown in the next screen (Figure 8).
Different roles have been assigned to the entity
5. Maintain Custom Agent Determination Rules
Custom Agent Determination Rules are customizing tables in which a user needs to set up roles for different business events. It means if any business event triggers, then workflow goes to the user who is assigned to that particular role.
To complete this step, follow menu path SAP Reference IMG > SAP NetWeaver > SAP Gateway > OData Channel > Administration > General Settings > Workflow > Maintain Custom Agent Determination Rules. Click the execute icon beside the Maintain Custom Agent Determination Rules node. This action opens the screen in Figure 9.
Maintain custom agent determination
Click the New Entries button to maintain the entries for Manual Control Performance in the screen shown in Figure 10. The example in Figure 10 is for business event 0PC_PERF_CTRL_PERF, which is used for the Manual Control Performance step performer. The role SAP_GRC_SPC_CRS_CTL_PERFORMER is assigned to this business event.
Entries for MCP business events
Maintain the entries for MCP step Performer and Reviewer for the following Business Events as shown in Figure 10. Repeat this step to maintain different entries as shown in Figure 11.
- 0PC_VALI_CTRL_PERF – Reviewer Business Event
- 0PC_PERF_CTRL_PERF – Performer Business Event
Multiple entries for Manual Control Performance Business Events
A business event is the action that is mapped with roles, and based on that workflow, it is routed to a particular user who has that role assigned on that particular entity.
For example, in Figure 10, users have been assigned at the Entity level. In the case of Manual Control Performance, the entity is Control, which has the role SAP_GRC_SPC_CRS_CTL_PERFORMER assigned under the Role column in the control screen. Suppose user XYZ has been assigned to role SAP_GRC_SPC_CRS_CTL_PERFORMER in the control screen under the Role column.
Now when the business event 0PC_PERF_CTRL_PERF triggers, which has role SAP_GRC_SPC_CRS_CTL_PERFORMER mapped in custom agent determination customization as shown in Figure 10, user XYZ receives the Manual Control Performance step performer workflow.
Click the save icon on top as shown in Figure 9 to save the entries.
6. Relate the Regulation to Plan Usage
This customization enables the MCP for particular regulations. For example, if you want to enable it for Sarbanes-Oxley regulations, then you need to maintain the entry for SOX regulation for Activity PERF-CLTPF.
To complete this step, follow menu path SAP Reference IMG > SAP Customizing Implementation Guide > Governance, Risk and Compliance > Process Control > Multiple-Compliance Framework > Relate Regulation to Plan Usage.
Click the execute icon beside Relate Regulation to Plan Usage and in the screen that appears, click the New Entries button (Figure 12). This action opens the screen in Figure 13.
New Entries button
In Figure 13, select an Activity ID and a Regulation Configuration using the F4 help and click the save icon (not shown). For my example, Manual Control Performance has been maintained for Sarbanes-Oxley and FDA regulations.
Entries for PERF-CTLPF
7. Notification Configuration
In this step, you can maintain different notification templates for Manual Control Performance. To maintain notification templates, execute transaction code SM30. This action opens the screen in Figure 14 in which you enter the view name (GRFNVNOTIFYMSG) in the Table/View field. You can also search for the view using F4 help. After you make your selection, click the Maintain button.
Table to maintain notification entries
In the initial screen that opens after you click the Maintain button (not shown), click the New Entries button. This action opens the screen in Figure 15. Enter data in the following fields:
- Message Class: For MCP, 0GRC_CTRL_PERF is the message class
- Message number : This number can be anything from 0 to N
- Description: Enter text to describe the notification message
- Subject: This field is for the email notification subject
- Document Object: This field is for the email template
Details for notifying a user to perform a control
Repeat the previous process for different notifications pertaining to Manual Control Performance. To notify a user to review control performance, enter the details shown in Figure 16.
Details to notify a user to review the control performance
To notify a user to re-perform a control, enter the details shown in Figure 17.
Details to notify a user to rework a control performance
To notify a user for completed performance steps, enter the details shown in Figure 18.
Details to notify user a user about a completed control performance step
To remind a user to perform the step, enter the details shown in Figure 19.
Details to remind a user to perform a control
To notify a user to perform a forwarded performance step, enter the details shown in Figure 20.
Details to notify a user to perform a forwarded control
The final entries look like the data shown in Figure 21.
Details on different notification messages
For all notifications, there is a specific template maintained in different message classes in Figure 21. You can access those Manual Control Performance templates via transaction code SE61, using F4 help for the Name field as shown in Figure 22.
Manual Control Performance templates
Select the document name in Figure 22 and click the Display button to open the screen in Figure 23.
8. Add a Menu Item for Reports
You can use the reports Manual Control Performance Results and Manual Control Performance Details to check which controls have been manually performed in your organization and to see the control performance results in detail. To enable the menu items for the reports in SAP NetWeaver Business Client (NWBC), you need to complete these settings.
Execute transaction code SM34. This action displays the screen in Figure 24. In the View cluster field, enter a name (e.g., GRFNVC_ITEMAUTHC) and click the Maintain button to maintain the entries. This view cluster is used to maintain the customization for Manual Control Performance reports such as authorization mode and regulation relevance.
Maintain entries in the View cluster
After you click the Maintain button in Figure 24, the screen in Figure 25 opens. In Figure 25, click the New Entries button and then enter data in the following fields:
- Menu Item ID: 0REP_MCP (the Menu Item ID is fixed for MCP)
- Menu Item Text: Enter Manual Control Performance Results
- Authorization Mode: Choose Entity-Level Authorization Check
- Entity Evaluation: Choose One entity/object is enough
- Authorization Class: Leave it empty
- Logical Operation: Choose No
- Regulation Relevance: Leave this option unchecked
Enter details for 0REP_MCP
Click the save icon (not shown) to save your data.
Create a Performance Plan
A Performance Plan for Control is a multiple-step process that is used to gather evidence from different users (i.e., step performers) that is used for control effectiveness testing and auditing. For example, the business scenario Postive Payment used for checks is shown in Figure 26. A sequence of steps, evidence, or comments can be required or not required as per the step configuration.
The Positive Payment scenario has a three-step performance plan
In my example scenario in Figure 26, I show a method used to verify payments done by an organization via checks to detect fraud (if any). This scenario has three performance steps:
1. Export payments - Export the payment transactions to the bank
2. Verify completness - Verify checks and Hash total
3. Transmit and confirm - Transmit to bank and confirm receipt
Before going forward, there are some general steps that are repetative for most of the following steps.
Complete these steps to launch the GRC application.
1. Execute transaction code nwbc in the SAP GRC back-end system as shown in Figure 27. This action opens NWBC in your browser (Figure 28).
Execute transaction code NWBC
2. Click the nwbc link shown in Figure 28 to open the screen in Figure 29. All GRC users have been assigned some roles such as NWBC or SAP_GRC_NWBC. These roles are assigned by executing transaction code SU01 and then assigning roles to users as per their roles in the organization.
Figure 29 shows the GRC application with different work centers such as My Home, Setup, and Assessments.
The GRC application with different workcenters
A Performance Plan then can be created for any control (i.e., central or local) in SAP Process Control. Central control is a central repository of controls maintained as templates that can be further assigned to an organization as a local control, which is used within planning of control performance (i.e., Manual Control Performance).
Central Control Level
A performance plan can be created at the central control level.
Follow these steps to create a performance plan:
- In NWBC, go to Master Data > Activities and Processes > Business Processes and open a central control. This path takes you to Figure 30.
- In the Performance Plan tab (Figure 30), create a new performance plan for the control by adding detailed control performance steps.
- For each step, enter information in fields under these columns:
- Step: Enter the name of the step
- Description: Enter the description of the step
- Evidence Required: Specify if evidence is required for the step
- Comments Required: Specify if a comment is required for the step
- Sequence: Enter a numeric sequence for the step. The number determines the order of performing the steps. You can assign the same number to multiple steps. These steps can be performed side by side.
Performance Plan setup at Central Control
4. Save the control by clicking the Save button.
Local Control Level
For local control, you need to have an organization set up in which you can assign subprocesses and controls. At the local control level, you can set up the step performers as well. A step performer can be a user who is the owner of that particular step. This person can be any user in the system.
5. In NWBC follow menu path Master Data > Organizations (refer back to Figure 29). Click the Organizations link to open the screen in Figure 31 in which you select Finance (this is the organization) and click the Open button. This action displays the screen in Figure 32.
6. Click the Assign Subprocess button in Figure 32 to display the screen in Figure 33. Select the Cash Disbursement subprocess as shown in Figure 33. Then click the Next button to open the screen in Figure 34.
The Subprocess tab
Select the subprocess
Figure 34 shows that the Cash Disbursement subprocess has been added to the Finance organization, which has the Positive payment used for checks control. Select the Positive payment used for checks control and click the Open button.
Local subprocess Cash Disbursement assigned to the Finance Organization
7. Select the control for Positive payment used for checks as shown in Figure 34 and click the Open button under Subprocess Assignment. The control screen opens as shown in Figure 35.
Local control details
8. In the control screen in Figure 35, click the Roles tab. Assign the relevant control performance roles to users as shown in Figure 36. Under the Roles tabs, you can assign a user to Manual Control Performance roles (for example, SOX Control Performer) as shown in Figure 36.
User role assignment at the local control level under the Roles tab
9. Click the Save button to save the control. This action returns you to the screen in Figure 34.
10. Click the Save button to save the Organization as shown in Figure 34.
Assigning Performers for Control Steps
By default, you assign a control performer to a performance plan on the plan level. However, you have the option to assign control performers and set the duration for each performance step. By default, a control performer can be any user in the system. You can use Business Add-In (BAdI) GRPC_BADI_GET_STEP_PERFORMER to implement your own control performer selection logic.
To assign control performers on the step level:
1. Go to IMG activity under menu path SPRO > SAP Reference IMG > Governance, Risk and Compliance > Process Control > Evaluation Setup > Manual Control Performance > Enable Performer Assignment on Step Level and click the enter icon (Figure 37).
2. Select the customizing item MCP_STEP_LVL_CHECK to enable the functionality. Selecting this item enables assignment of the step performer at the step level at the local control level. Select the check box under the Activate column in Figure 37 and click the enter icon.
Check box to activate the enablement of Step level performer
Go to the Performance Plan tab of a local control, select a step, and click the Edit Performer button in Figure 38. To reach the Performance Plan tab, follow the steps mentioned in the assignment of a performance plan to a local control. The details are shown in Figures 31 through 35.
3. In the pop-up dialog window, search and select the performer for the step. You can assign multiple performers to one step.
Performer setup at the local control level
4. In the field under the Duration(Days) column (Figure 38), enter how many days you want to allow the performer to complete the step. Step durations can be used to trigger email notifications. By default, when a control performance is planned, the system takes the start date of the plan and adds the duration of all previous steps and the current step to determine its due date. If multiple steps are contained in the same sequence, the largest duration number is taken into account. If the total duration of the steps exceeds the due date of the plan, the due date of the plan is considered as the actual due date. You can also use BAdI GRPC_BADI_CALC_STEP_DUE_DATE to change the default behavior and implement your own logic.
5. Repeat steps 3 and 4 to assign a step performer for the all steps as shown in Figure 38.
6. After assignment of the step performer, save the control by clicking the Save button in Figure 38.
7. Click the Save button again, which saves the organization as shown in Figure 34.
Planning Control Performance for a Control
Once a performance plan assigned to a control, the next step is to execute the performance plan so that different step performers can execute their respective steps as shown in Figure 39.
Process flow for Manual Control Performance planning
To plan the performance plan, go to the Planner application under the Assessments work center in the GRC application (Figure 40).
Planner application under Assessments
In the Planner, you create a recurring or one-time plan to perform the control (Figure 41). You can schedule control performance tasks for any control with a control performance plan.
Create a plan
As the control owner, when you open a control assigned to you, you can create a manual control performance directly in the control screen in Figure 42. You also can create an ad-hoc Control Performance plan directly under the Control Performance tab as shown in Figure 42. To reach this screen, follows the steps in Figures 31 through 35.
Ad-hoc manual Control Performance
After a plan is successfully created in the Planner, a user assigned the performance step receives the work item in the GRC inbox. Click the link to go to the Manual Control Performance screen.
Follow menu path NWBC Role > Go to My Home > Work Inbox to see all the assigned workflow tasks (Figure 43). Work Inbox is an application where users can see their workflows. Click the Work Inbox link to open the screen in Figure 44.
Work Inbox application under My Home
If an email address is configured for a step then the step performer also receives an email containing the same link for the manual control performance task (Figure 45). (For example, in Figure 38, the performer for the Export Payment step is Bhupinder Singh Gahunia. The email address for this user is configured using transaction code SU01.)
Manual Control Performance email details
The new user interface (UI) is based on SAP UI5 technology. You can find the basic control information and all the steps included in the performance plan in the UI. From here, you can upload evidence of the manual control performance, report issues, enter comments, or forward the manual control performance to other users. Click the Demo MCP link in Figure 45 to open the screen in Figure 46. This screen shows the workflow in the SAPUI5 application.
Manual Control Performance step main screen
1. Status of Performance Steps
A control performance step can have the following statuses:
- In Process: The initial status of the first steps of the control performance. When the previous step is set to Done, the status of the step becomes In Process automatically. If you reopen a step, the status may also become In Process depending on its sequence.
- Pending: Status of all the steps subsequent to the steps in process.
- Done: When a step is completed and set to done.
Every step in a performance plan goes through the statuses in Figure 47.
Manual Control Performance step statuses
2. Performing the Steps
All steps in the control performance plan must be completed in sequential order. Pending steps cannot be modified until the previous step is completed. You can either complete the steps by yourself or forward the entire control performance to other users. If a control performer is assigned on the step level, only the assigned user can perform the step. After completing all the steps, you submit the manual control performance for review.
3. Completing a Step
To complete a step, click the step Export payments as shown in Figure 46 to go to the detail screen of that step, enter your comment, upload the evidence, and choose Set to Done. If there is any issue worth the attention of the control manager, choose Report Issue to log an ad-hoc issue for the control performance.
Figure 48 shows the single step view, which a step performer executes.
Manual Control Performance step details
4. Forwarding Manual Control Performance to Other Users
To forward the manual control performance to other users, click the Forward button in Figure 48. In the pop-up window in Figure 49, enter data in the following fields:
- Forward to: Select users from the drop-down list. You can also enter the name and select users from suggestions.
- Comment: Enter an optional comment.
Click the OK button to forward the manual control performance to the selected users. If email addresses are configured for the forwarded users, they receive an email notification.
After you click the Forward Info button in Figure 46, you can see the forward history of the manual control performance. Figure 50 shows the Forward Info button, which shows the details to whom the step has been forwarded.
5. Reopening a Completed Step
If you need to modify an already completed step, you can use the Reopen button to set the step to in process again. This can only be done before you submit the manual control performance for review. Click the Export payments step shown in Figure 48 to go to the detail screen of that step. You see the Reopen button in the step shown in Figure 51.
Reopen a completed step
Reviewing Control Performance
As a control performance reviewer, you’ll find the submitted control performance as a work item. Figure 44 shows the Work Inbox. Figure 52 shows the Review Manual Control Performance workflow.
Review a work item
Click Review Manual Control Performance in Figure 52 and Figure 53 opens where the reviewer can either reject or approve the control performance
Review the step details
After the reviewer approves, Manual Control Performance is completed and the status is set to Done as shown in Figure 54.
Completed steps and Manual Control Performance details
Monitoring Control Performance
You can monitor planned control performances. The Control Performance tab of a local control lists all planned performances and the detailed steps of each performance. Select a performance to display the performance steps. You can follow the steps in Figures 31 through 35 to reach Figure 55.
Monitor the control performance
You can only see the step performer and due date information when the step-level performer assignment is enabled. If a plan is approaching its deadline or is overdue, you can also use the Send Notification button to remind the control performer.
Use Performance Results in Control Effectiveness Testing
The manual control performance results can be used as a reference when you perform effectiveness testing for the control. In the Control Effectiveness Manual Test screen, go to the Control Performance tab and you can see all the results of manual control performance for the control. Following are example steps to use Manual Control Performance Performance Results in Manual Control Test Effectiveness.
Use transaction code NWBC and go to the Assessments tab and select the Planner application as shown in Figure 56.
The Planner application
Create a plan for Test Control Effectiveness for the Control Positive payment used for checks (Figure 57).
Create a plan
To select regulations for a plan, click the Select Regulation option and then in the Regulation field select an option from the drop-down list of options (Figure 58). For my example select FDA and then click the Next button.
Go to the Select Regulation option
Click Select Organizations in Figure 59 and then click the Next button.
The Select Organizations step
Either select the Select All Controls radio button or the Select Specific Controls radio button. Then select the control for which effectiveness testing needs to be performed. Click the Next button (Figure 60).
Select the Control
Activate the plan by clicking the Activate Plan button (Figure 61).
Activate the plan
Use transaction code NWBC. Click the My Home button and then the Work Inbox button. You see the workflow for Test of Control Effectiveness (Figure 62).
Workflow Manual Test of Control Effectiveness
Click Perform Manual Test of Control Effectiveness to open the screen shown in Figure 63.
Control effectiveness workflow details
The menus Manual Control Performance Results and Manual Control Performance Details are added to the Reports section under the Assessments work center in NWBC. You can use these menus to generate reports for manual control performance.
Use transaction code NWBC. Click the Assessments tab and the Manual Control Performance reports (Figure 64).
Manual Control Performance reports
The Manual Control Performance Details report (Figure 65) provides the details of Manual Control Performance along with the evidence collected. You can navigate to particular steps via links in the results of the report. Select a time frame and regulation, which are required for executing this report.
Manual Control Performance Details selection screen
Figure 66 shows the results, including details such as control, control performance, and step details. The results also include links that enable you to navigate to another screen (for example, click any control link to open the control screen).
Manual Control Performance Details report result
The Manual Control Performance Results report shown in Figure 67 shows the selection criteria that you can select and then provide details to get the results.You need to indicate a time frame and regulation to execute this report.
Manual Control Performance Results screen with the status
Figure 68 shows the result for Manual Control Performance results report. This screen shows a status of MCP step as New/Done and other related details.
Manual Control Performance Result report details