Master Guide Sap Businessobjects Risk Management 10.0: Technology Consultants System Administrators
Master Guide Sap Businessobjects Risk Management 10.0: Technology Consultants System Administrators
Master Guide Sap Businessobjects Risk Management 10.0: Technology Consultants System Administrators
Target Audience
Èšž† Technology Consultants
Èšž† System Administrators
PUBLIC
Èšz¤ÄÄŽñx“´Ê9ÿpöDÖ”§ÎFGÞ©
þfl—lðÖ’¨ì~$h˛°|ñ£s·ÜùÍO|êµÆöEKŠ•“§†ÛW
F
Document History
CAUTION
Before you start the implementation, make sure you have the latest version of this document.
You can find the latest version on the SAP Service Marketplace at http://service.sap.com/
instguides → SAP BusinessObjects → SAP BusinessObjects Governance, Risk, Compliance (GRC) → Risk
Management → Risk Management Release 10.0.
The following table provides an overview of the most important document changes.
Version Date Description
1.0 2010-12-13 Initial Version
1.10 2011-01-31 Updated system landscape
1.20 2011-04-18 Added section 4.0 Content Lifecyle Management (CLM)
1.30 2011-06-28 Standardization
Chapter A Reference . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
A.1 The Main SAP Documentation Types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
1 Getting Started
SAP BusinessObjects Risk Management 10.0 is a customizable software solution delivered as an add-on,
based on SAP NetWeaver 7.0 EHP 2 SP06. The Risk Management application enables an enterprise-wide
risk management process as mandated by legal requirements and recommended by best practice
management frameworks.
NOTE
Current information about the implementation of SAP BusinessObjects Risk Management, and
the latest installation and configuration guides on SAP Marketplace at http://service.sap.com/
instguides → SAP BusinessObjects → SAP BusinessObjects Governance, Risk, Compliance (GRC) → Risk
Management → Risk Management 10.0.
Constraints
This Master Guide primarily discusses the overall technical implementation of SAP BusinessObjects
Risk Management, rather than its subordinate components. This means that additional software
dependencies might exist without being mentioned explicitly in this document. You can find more
information on component-specific software dependencies in the corresponding installation guide.
CAUTION
Verify that you have the latest documents available on the SAP Service Marketplace before
beginning implementation.
Performance http://service.sap.com/performance
SAP BusinessObjects Risk Management enables you to proactively reduce risk by systematically
identifying, assessing, and controlling risks to prevent incidents and management failures.
pŁ@©ÑýD¬}ð“ß:.›Ê H
RECOMMENDATION
As a best practice, we recommend implementing SAP GRC applications in three phases, with
separate systems for each:
pŁ@Oô4 Development
pŁ@Oô4 Testing
pŁ@Oô4 Production
For more information about three-tier landscapes, see the SAP NetWeaver Master Guide, located at
http://service.sap.com/instguides
CAUTION
We strongly recommend that you use a minimal system landscape for test and demo purposes
only. For performance, scalability, high availability, and security reasons, do not use a minimal
system landscape as your production landscape.
NOTE
For more information, see the Product Availability Matrix posted on SAP Service Marketplace at
http://service.sap.com/pam..
NOTE
For more information about the implementation of the scenario, see Overall Implementation
Sequence [external document].
SAP BusinessObjects Risk Management 10.0 enables organizations to balance business opportunities
with financial, legal, and operational risks to minimize the market penalties from high-impact events.
The application allows customers to collaboratively identify these risks and to monitor them on a
continuous basis. Stakeholders and owners are provided with such tools as analytic dashboards for
greater visibility in mitigating risks in their areas of responsibility.
The business scenario consists of the following processes:
úLø^˘½ Risk Planning
Risk Planning includes the initial definition and assignment of roles and responsibilities, the setup
of the organizational hierarchy, and the definition of risk-relevant business activities (such as
processes, projects, or other company assets). Furthermore, it includes the development of risk
classifications to structure and report on risk assessment results, and the definition of a key risk
indicator framework to automate risk monitoring, thereby reducing effort.
Such structuring allows the implementation of risk management programs on a large scale,
enabling you to streamline risk planning and reduce duplicate efforts in your company’s different
organizational units.
The process includes the following steps:
1. Maintain business objectives
2. Maintain organizations
3. Assign user roles
4. Define key risk indicators
5. Maintain response catalog
6. Maintain risk catalog
7. Maintain opportunity catalog
8. Maintain activity hierarchy
úLø^˘½ Risk Identification
Risk Identification describes the process of identifying and collecting data about a company’s risks.
This includes documenting potential root causes, impacts, and relationships between risk events.
The process includes the following steps:
1. Define surveys and questions
2. Document activities
3. Propose risks
4. Document risks and opportunities
œk|IŠ? Risk Analysis
In the Risk Analysis process, you can qualitatively and/or quantitatively analyze the likelihood of
occurrence and the potential impacts of identified risks. This enables you to determine appropriate
responses to risks.
The process includes the following steps:
1. Conduct assessments
2. Build risk scenarios
3. Perform Monte Carlo simulations
œk|IŠ? Risk Response
In the Risk Response process, you document measures taken to manage the risk and its current
status. You also determine assessment and review cycles for the risks and responses.
The process includes the following steps:
1. Propose responses
2. Document responses and enhancement plans
œk|IŠ? Risk Monitoring
In the Risk Monitoring process, you analyze and report on your company's risk situation. This
step includes documenting incidents and losses for occurred risk events.
The process includes the following steps:
1. Monitor response and enhancement plans
2. Monitor key risk indicators
3. Review assessment status
4. Document incidents
5. Document issues
6. Report on risk situations
4.1 Introduction
The Content Lifecycle Management (CLM) component aims to support the management of partner
content, providing users with a consistent way to package, version-control, inspect, and import partner
content into their systems. It focuses on the capability to deliver content from vendors’ landscapes to
customers’ landscapes and does not provide means to transport content within one single landscape.
The latter capability is already provided by the ABAP transport system.
CLM is available on ABAP 7.3 and ABAP 7.02.
CLM is delivered as a single software component. There are different versions of this software
component available, depending on the version of the target platform.
Version
Standalone Integrated
installed standalone as an an add-on to the same
add-on to the NetWeaver managed application
platform. In this case, CLM system.
can communicate with When you install a
the application system managed application on
using an RFC connection. your system, you can also
This landscape model can install the CLM add-on on
be used if you do not want the same system. In this
to interfere with an case, both the application
existing running and CLM can be operated
application system and its from a single system
associated technical without an RFC
resources. connection.
See figure 1: Standalone + See figure 2: Integrated +
one system one system
Multiple If CLM is used to manage If CLM is used to manage
application content application content
residing in multiple residing in multiple
systems on the landscape, systems on the landscape,
the deployment landscape the complex deployment
scenario depicted in figure landscape scenario
3 can be applied. In this depicted in figure 4 can be
landscape model, CLM is applied. In this landscape
installed standalone as an model, CLM is installed as
add-on to the NetWeaver an add-on to one of the
platform. managed application
This landscape can be used systems.
when you want to have This landscape mode
only CLM system as a could fit use cases where
central box that can one application system is
communicate with other frequently used with CLM
managed application for managing the its
systems. content lifecycle, while
See figure 3: Standalone + other participating
multiple systems application systems
interact with CLM only a
few times.
See figure 4: Integrated +
multiple systems
y/Aªåk
ô¶>mgc°ł! `¸¬¹6Figure 1: Standalone + One System
y/Aªåk
ô¶>mgc°ł! a¸¬¹6Figure 2: Integrated + One System
y/Aªåk
ô¶>mgc°ł! f¸¬¹6Figure 3: Standalone + Multiple Systems
É“aÖ
äá7˘Éıwt±MŁcE(sFigure 4: Integrated + Multiple Systems
Communication with managed applications happens via function calls through RFC destinations of
SAP NetWeaver Application Server ABAP. Such communication channels can be configured for remote
communication. This allows different actual landscapes to be formed.
NOTE
A landscape designed according to the above principles can be used for both providing content
and consuming content. In case of separate Content Provisioning (vendor) and Content
Consumption (customer) processes; a typical landscape can look as follows:
É“aÖ
äá7˘Éıwt±MŒcE
Alternatively, these two processes can share the same landscape (with both extraction and
deployment being handled in the same CLM system. It must be verified during the design of the
landscape that both business processes can be executed in such a dual-purpose landscape.
For example: Separate authorizations/users must be associated with separate application systems
so that content deployment is not accidentally performed on the system that is restricted for
content extraction.
NOTE
Specifying a unique authoring namespace is not mandatory if CLM is only used for consuming
content.
CAUTION
If CLM is installed for the dual purpose of consuming content and providing content, the rules
for providing content apply to the formulation of the vendor namespace. It must be globally
unique, as supplied by SAP. For more information about the service for namespace issuing provided
by SAP, see SAP Service Marketplace at http://service.sap.com/namespaces.
application. It also includes detection of differences between content groups and deployment of content
to an application.
The Content Lifecycle Management business scenario is divided into two business processes:
±·%˚n Providing Content: Used by vendors and content authors to provide and distribute application
content to their customers
±·%˚n Consuming Content: Customers deploy and use vendor content in their applications
For more information about the business scenario and business processes, refer to the Solution Manager
Content documentation.
For technical system landscape, software units, and implementation sequence, refer to sections in
previous chapter of this guide.
Documentation Location
SAP BusinessObjects http://service.sap.com/instguides → SAP BusinessObjects → SAP BusinessObjects
Upgrade Guide Governance, Risk, Compliance (GRC) → SAP BusinessObjects Access Control or Process Control→
SAP BusinessObjects Access Control 10.0 or Process Control 10.0
SAP BusinessObjects On SAP Help Portal at http://help.sap.com
Application Help
A Reference
Cross-Phase Documentation
Implementation
The master guide is the starting point for implementing an SAP solution. It lists the required installable
units for each business or IT scenario. It provides scenario-specific descriptions of preparation,
execution, and follow-up of an implementation. It also provides references to other documents, such
as installation guides, the technical infrastructure guide and SAP Notes.
a´¿´2 Target group:
a´¿´] Technology consultants
a´¿´] Project teams for implementations
a´¿´2 Current version:
a´¿´] On SAP Service Marketplace at http://service.sap.com/instguides
The installation guide describes the technical implementation of an installable unit, taking into
account the combinations of operating systems and databases. It does not describe any business-related
configuration.
a´¿´2 Target group:
a´¿´] Technology consultants
a´¿´] Project teams for implementations
a´¿´2 Current version:
a´¿´] On SAP Service Marketplace at http://service.sap.com/instguides
Configuration Documentation in SAP Solution Manager – SAP Solution Manager is a life-cycle
platform. One of its main functions is the configuration of business scenarios, business processes, and
implementable steps. It contains Customizing activities, transactions, and so on, as well as
documentation.
a´¿´2 Target group:
a´¿´] Technology consultants
a´¿´] Solution consultants
a´¿´] Project teams for implementations
a´¿´2 Current version:
a´¿´] In SAP Solution Manager
The Implementation Guide (IMG) is a tool for configuring (Customizing) a single SAP system. The
Customizing activities and their documentation are structured from a functional perspective. (In order
to configure a whole system landscape from a process-oriented perspective, SAP Solution Manager,
which refers to the relevant Customizing activities in the individual SAP systems, is used.)
a´¿´2 Target group:
a´¿´] Solution consultants
a´¿´] Project teams for implementations or upgrades
a´¿´2 Current version:
a´¿´] In the SAP menu of the SAP system under Tools Customizing IMG
Production Operation
The technical operations manual is the starting point for operating a system that runs on SAP
NetWeaver, and precedes the application operations guides of SAP Business Suite. The manual refers
users to the tools and documentation that are needed to carry out various tasks, such as monitoring,
backup/restore, master data maintenance, transports, and tests.
@Ł@a¹# Target group:
@Ł@a¹L System administrators
@Ł@a¹# Current version:
@Ł@a¹L On SAP Service Marketplace at http://service.sap.com/instguides
The application operations guide is used for operating an SAP application once all tasks in the
technical operations manual have been completed. It refers users to the tools and documentation that
are needed to carry out the various operations-related tasks.
@Ł@a¹# Target group:
@Ł@a¹L System administrators
@Ł@a¹L Technology consultants
@Ł@a¹L Solution consultants
@Ł@a¹# Current version:
@Ł@a¹L On SAP Service Marketplace at http://service.sap.com/instguides
Upgrade
The upgrade master guide is the starting point for upgrading the business scenarios and processes of
an SAP solution. It provides scenario-specific descriptions of preparation, execution, and follow-up of
an upgrade. It also refers to other documents, such as upgrade guides and SAP Notes.
@Ł@a¹# Target group:
@Ł@a¹L Technology consultants
@Ł@a¹L Project teams for upgrades
@Ł@a¹# Current version:
@Ł@a¹L On SAP Service Marketplace at http://service.sap.com/instguides
The upgrade guide describes the technical upgrade of an installable unit, taking into account the
combinations of operating systems and databases. It does not describe any business-related
configuration.
@Ł@a¹# Target group:
@Ł@a¹L Technology consultants
@Ł@a¹L Project teams for upgrades
@Ł@a¹# Current version:
@Ł@a¹L On SAP Service Marketplace at http://service.sap.com/instguides
Release notes are documents that contain short descriptions of new features in a particular release or
changes to existing features since the previous release. Release notes about ABAP developments are the
technical prerequisite for generating delta and upgrade Customizing in the Implementation Guide
(IMG).
@Ł@a¹# Target group:
l-3#⁄6 Consultants
l-3#⁄6 Project teams for upgrades
l-3#⁄Y Current version:
l-3#⁄6 On SAP Service Marketplace at http://service.sap.com/releasenotes
l-3#⁄6 In the SAP menu of the SAP system under Help Release Notes (only ABAP developments)
Example Description
<Example> Angle brackets indicate that you replace these words or characters with appropriate
entries to make entries in the system, for example, “Enter your <User Name>”.
Example Arrows separating the parts of a navigation path, for example, menu options
Example
Example Emphasized words or expressions
Example Words or characters that you enter in the system exactly as they appear in the
documentation
http://www.sap.com Textual cross-references to an internet address
/example Quicklinks added to the internet address of a homepage to enable quick access to specific
content on the Web
123456 Hyperlink to an SAP Note, for example, SAP Note 123456
Example $flüǬ Words or characters quoted from the screen. These include field labels, screen titles,
pushbutton labels, menu names, and menu options.
$flüǬ Cross-references to other documentation or published works
Example $flüǬ Output on the screen following a user action, for example, messages
$flüǬ Source code or syntax quoted directly from a program
$flüǬ File and directory names and their paths, names of variables and parameters, and
names of installation, upgrade, and database tools
EXAMPLE Technical names of system objects. These include report names, program names,
transaction codes, database table names, and key concepts of a programming language
when they are surrounded by body text, for example, SELECT and INCLUDE
EXAMPLE Keys on the keyboard
Disclaimer