SAP Process Control 10.1 uses an integration framework workflow. This framework enables you to combine different work processes for the assessment of master data. Use of a power transaction may cause a partial change of data in the back end because there is no authorization check with using these transactions. As a result, inconsistent data could exist in the system.

Power transactions should be used very cautiously. I show how to use the transactions effectively and troubleshoot issues directly in the system. First I present the problem, and then I show the solution for each one. Best practices and recommendations are covered in the last section.

The different phases for SAP Process Control 10.1 include master data setup for the organization, assessment of the master data, and continuous control monitoring via a scheduler. Each stage is critical, and therefore, you need to ensure that SAP Process Control is implemented and used effectively.

I describe the following functionalities by describing the problem with master data and then showing how to fix it:

• Power mode transactions
• Master data plan
• Setup structure: Expert mode
• Workflow: custom agent determination rules
• Best practices and recommendations

Power Mode Transactions

SAP Process Control uses a framework to create master data. Master data is stored in dedicated tables called infotypes. The framework defines the underlying principles based on how the data is stored. Transaction codes are used to modify the corresponding information in order to fix inconsistencies.

There is inconsistency in master data stored in infotypes. To find inconsistencies and correct them, you need to know how the relevant information for master data and assessment is stored. To do this step, execute transaction codes OOIT and OOSU to display and configure new infotypes and subtypes in SAP Process Control 10.1.

Infotype 1000 is used to store basic HR information, such as object type, object ID, valid from, valid to, and name. In another example, infotype 1001 is used to store a business rule relationship with another object type.

You need to carefully use the back-end HR transactions, which are used to modify or maintain the infotypes that store master data and assessment-related information in different tables. That is because there is no authorization or integration check to use these transactions. This may lead to data inconsistency and several dumps in the SAP Process Control 10.1 application. In a dump, the application terminates.  

I go through some important transaction codes for master data creation or troubleshooting the inconsistent data in the system. There is no need to remember these transactional tables by heart as the transaction itself provides the corresponding information. I describe a few important transactions that give you an idea about the corresponding information stored in SAP Process Control.

Transaction code OOIT is used to create an infotype or access different infotypes already maintained and used inside SAP Process Control. After you execute transaction code OOIT, the screen shown in Figure 1 appears.

Figure 1

The Infotypes Overview screen in SAP Process Control

Each infotype stores basic information, such as an object or relation. A subtype is used to store the related set of information corresponding to each object. For example, infotype 5326 is used to store test plan data inside SAP Process Control.

Transaction code OOSU is used for subtypes maintenance. Subtypes can be used for compliance with different regulations, such as the Sarbanes-Oxley Act and US Food and Drug Administration (FDA) regulations. After you execute transaction code OOSU, the screen in Figure 2 opens. In this screen you maintain a subtype for a specified infotype. In my example, subtypes 5000 (Sarbanes-Oxley) and 5100 (FDA) are maintained for infotype 5326.

Figure 2

Maintain subtypes

Regulation Initiatives

SAP predelivers subtypes for regulations such as Sarbanes–Oxley and the FDA with an installation of SAP Process Control (e.g., subtype 5000 for Sarbanes–Oxley and subtype 5100 for FDA regulations). You might need to set up a new subtype for regulations for your existing business processes and do not know which objects need to be configured against existing infotypes to set up a new regulation.

When you need to set up a new regulation, you need to be sure that assessment and master data details for the configured regulation are saved in the database. For example, test plan details for configured regulation are only saved if you configure a new regulation for infotype 5326. I describe infotypes and objects that need to be configured for the new regulation or subtype using transaction code OOSU. Following are the steps to configure a subtype for a new regulation.

To view the objects for which a subtype needs to be configured, access the Infotypes Overview screen (Figure 1) by executing transaction code OOIT. Double-click the Infotypes per object folder. This action displays the screen shown in Figure 3.

Figure 3

The Change View for the Infotypes Overview screen

In Figure 3 select any infotype. In my example, I selected infotype 5326 (Test Plan). After selecting infotype 5326, click the Infotypes per object folder. This action displays the screen shown in Figure 4. Note that according to the infotype that I selected in my example, Figure 4 indicates that Local Control, Central Control, Entity-Level Control, and Local Entity-Level Ctrl. need to be configured for infotype 5326.

Figure 4

The Infotypes per object type screen

When you update an infotype, data is never deleted, but is archived for historical evaluation. The time constraint functionality enables the system to store more than one record at the same time, even if their validity periods overlap. To set up a time constraint, return to the screen shown in Figure 3, and for my chosen infotype 5326, click the Time constraint dialog folder.

Now I return to focusing on regulation initiatives. You also execute transaction code OOSU to define a new subtype for relevant infotypes. For my example, after you execute transaction code OOSU, in the screen that appears (Figure 5), click the Subtypes folder and enter Z901 in the field under the Subtyp column and 5326 in the field under the Inftyp. (Infotype) column. Click the save icon to save your entries.

Figure 5

Define a new subtype Z901 for infotype 5326

From Figure 4, I know that for my example I have to define the new subtype for the following object types:

• Local control (P2)
• Central control (P5)
• Entity-level control (P7)
• Local entity-level control (P9)

To define a subtype for the local control object type, click the Time constraint folder as shown in Figure 5. To create a new entry, populate the fields as shown in Figure 6. In my example, I enter P2 (local control) in the Object type field, 5326 (test plan information) in the Infotype field, and Z901 (the new regulation that I want to configure) in the Subtype field. In the Time constraint field, enter 2. Process Control data is stored with the time constraint 2. Click the save icon to save your entries.

For more information on time constraints go to:

https://help.sap.com/saphelp_470/helpdata/en/48/35c9f24abf11d18a0f0000e816ae6e/content.htm.

Figure 6

Define a new subtype Z901 for local control

To define a subtype for the central control object type, follow the same instructions for creating a local control object type, but enter P5 in the Object type field (Figure 7). Click the save icon.

Figure 7

Define a new subtype for central control

To define a subtype for the entity-level control object type, follow the same instructions for creating a local control object type, but enter P7 in the Object type field (Figure 8). Click the save icon.

Figure 8

Define a new subtype for entity level control

To define a subtype for the central control object type, follow the same instructions for creating a local control object type, but enter P5 in the Object type field (Figure 9). Click the save icon.

Figure 9

Define a new subtype for local entity level control

Repeat the steps as outlined for Figures 3 to 9 and similarly configure object types for the remaining infotypes: 5302, 5304, 5306, 5307, 5311, 5313, 5315, 5326, 5337, and 5338.

Master Data Plan

Consider a scenario in which you find data inconsistencies. To fix these inconsistencies, use the master data plan transaction to quickly fix the data inconsistency or repair, create, or change master data.

Transaction code PP01 (master data plan) is used to change or maintain related infotypes for a particular object. Although it provides a quick fix to master data, the user needs to be knowledgeable about its use. If the user is not trained, it could lead to data inconsistency in the system and the application would not behave as expected.

There are robust authorization and integration checks in SAP Process Control. Normally, a business user accesses the application through the front end and everything is stable. However, there could be two instances in which the user encounters instability:

• An administrator used power transactions GRFN_STR_CHANGE to modify data and could not handle the inconsistencies.
• There was a possible code correction fixed in later Support Packages and the user is on a lower Support Package.

In both these instances, there could be data inconsistencies in the system and the plant maintenance transaction is useful in these scenarios.

Consider this example (Figure 10). Open the SAP Process Control application, and in the initial screen (not shown), click the Organizations link. This action opens another screen (not shown) in which you click the master data  workcenter icon under Master data open organization. After you click the Subprocess tab in Figure 10, a dump occurs (Figure 11). The reason for the dump is a missing assignment between the local process and the corresponding organization and central processes.

Figure 10

The Organization screen of the work center in SAP Process Control

Figure 11

A short dump caused by data inconsistency in the system

To repair the relation and make data consistent in the system, execute transaction code PP01. Follow these steps.

Get the Organization ID. To do this, open the relevant organization under the Master Data work center in SAP Process Control and copy the organization ID by pressing Ctrl+C (Figure 12).

Figure 12

Copy the Organization ID

Now execute transaction code GRFN_STR_DISPLAY. In the screen that appears (Figure 13) under the Organizational unit folder, click the Search Term link. In the pop-up screen, paste the organization ID in the With name field. Press Enter.

Figure 13

Enter the Organization ID in the pop-up screen

Figure 14

Check the assigned subprocesses to the organization by selecting the Assigned Subprocesses option for the chosen organization

In the screen that appears (Figure 15), choose the local subprocess ID (an eight-digit number).

Figure 15

Choose a local subprocess for a particular organization

Right-click the name of the local subprocess (e.g., 00-AM Asset master) and select Goto and Subprocess > Process Hierarchy from the menu (Figure 16).

Figure 16

Navigate to Subprocess -> Process Hierarchy for the chosen local subprocess

If the next screen does not display a local process under the subprocess, then you have found the missing process (Figure 17).

Figure 17

There is no process for the chosen subprocess

So far, you have identified that there is data inconsistency. Now, you need to find the corresponding Central Processes.

In Figure 17, copy the name of the Central Subprocess (e.g, 00-AM Asset master data creation) and execute transaction code GRFN_STR_DISPLAY. In the screen that appears (Figure 18), expand the Central Subprocess folder and click the Search Term link. In the pop-up screen, paste the Central Subprocess name in the With name field and click the Find button.

Use the Central Subprocess Name to find the central Subprocess ID.

Figure 18

Find the central subprocess with the same name as the local subprocess

The next screen (Figure 19) displays the Central Subprocess for which you searched in the Name field in the Hit list section. Double-click this name.

Figure 19

The Central Subprocess displayed

In the refreshed screen (Figure 20) click the one level up icon to display all relevant Central Processes.

Figure 20

Display all the relevant central processes

Remember all the Central Processes IDs, from the top to the start of the Central Subprocesses. After you click the one level up icon, you see the related Central Processes (PK) for the chosen Central Subprocesses (PL) as shown in Figure 21.

Figure 21

All central processes up the hierarchy for the chosen central subprocess

So far you have identified the corresponding central process for the missing local process. To make the data consistent, you need to re-create the missing local process and establish a relationship between the local process and the corresponding organization and central process.

To re-create the missing local process, execute transaction code PP01. In the screen that appears (Figure 22), select Local Process from the list of options in the Object type field. In the Time period section, select the Period radio button and change the date in the From field to the valid-from date for the Local Subprocess. Press Enter to save your data. This action opens the screen shown in Figure 23.

Figure 22

Choose the Object infotype name to create an object with the same validity as the local subprocess

Enter the Central Process name from Figure 21 under the Object abbr. and Object name fields in  Figure 23. In the Validity field, ensure that the valid from date is the same as that of the Local Subprocess. Click the save icon.

Figure 23

Copy the process name

Now you are finished resolving the dump using the master data plan transaction (PP01). You could enter a description for the created object using transaction code PP01. However, this step is optional because you enter a description for newly created Local Process through the front end, which has authorization checks maintained, and only authorized users are able to maintain description data.

To maintain a description, execute transaction code PP01. In the screen that appears (Figure 24), select the check box beside the Description infotype and click the create icon. Now choose Local Process for the Object type name to create an object with the same validity as the local subprocess. You also need to enter the correct valid dates in the Time period section. Click the save icon (not shown) to save your entries.

Figure 24

Enter a description for the created local process

First, you create the local process relation with the organization. To complete this step, execute transaction code PP01. In the screen that appears (Figure 25) select the box beside the Relationships infotype and click the create icon.

Figure 25

Select the Relationships infotype

Figure 26

Maintain an organization for the local process

Now you create a local process relation with a central process. Return to the Maintain Object screen (Figure 27) and select Relationships. Click the create icon.

Figure 27

Select the Relationships infotype

Figure 28

Maintain the central process for the local process

Now you are done with establishing data consistency.

Set Up Structure: Expert Mode 

Expert mode transaction (transaction code GRFN_STR_CHANGE) is useful for locating master data errors and correcting them. For example, a process administrator who runs the transaction GRFN_STR_CHANGE might need to change the object validity or repair the object relationship. I had discussed this functionality briefly in the “Master Data Plan” section, but I describe it in more detail now. After you execute transaction code GRFN_STR_CHANGE, the screen shown in Figure 29 appears.

Figure 29

The objects available in SAP Process Control are highlighted on the left

Objects are maintained in SAP Process Control as time frame dependent. This means objects are valid for a specific time with relevant begin and end dates.

Under Local Subprocess, click the Search Term option. In the pop-up screen (Figure 30), click the Start date field and then click the preview period icon to set the personalization to a specific time frame. For this example, populate the fields as shown in Figure 30 and click the execute icon.

This is an important step for you to ensure that you are previewing data for the correct time frame before possibly correcting it or analyzing it further.

Figure 30

Set a date and preview period

In the next screen (Figure 31) click the Search Term link for the object that you want to preview.

Figure 31

Find a particular object by clicking the Search Term link

This action opens the screen shown in Figure 32. In the pane on the lower left side of this screen, double-click the object to preview it.

Figure 32

Double-click the object to preview it

In Figure 33, right-click the selected object and choose Goto from the menu options to preview the object assignments.

Figure 33

Choose Goto for the selected object to preview object assignments

Workflow: Custom Agent Determination Rules

You need to be sure that the business events and functional roles are correctly configured so that the workflow is routed to the intended recipient. To do this, you need to assign functional roles to the user for objects and configure business events correctly, as I describe next. You need to route workflow to the intended recipients.

There are different workflows configured in SAP Process Control. These can be triggered manually or automatically via a Planner and Scheduler. The workflows are preconfigured and you do not have to define the workflow template. Instead, you need to make sure that the workflow is triggered to the intended agent.

To complete this step, execute transaction code SPRO and follow menu path Governance, Risk and Compliance > General Settings > Workflow > Maintain Custom Agent Determination Rules.

How is this functionality achieved? To explain this process, I split agent determination for workflows into two stages:

• Assign functional roles to the user for a particular object
• Configure business events for functional roles

Assign Functional Roles to the User for a Particular Object

To assign functional roles to the user for a particular object, you need to assign the functional role to the business user via Access Management.

To maintain an entity role assignment, execute transaction code SPRO and follow menu path Governance, Risk and Compliance > General Settings > Authorizations > Maintain Entity Role Assignment.

Click the execute icon beside Maintain Entity Role Assignment to open the screen shown in Figure 34. In this screen you define functional roles relevant to different entities such as subprocess or control.

Figure 34

Define function roles for entities and save the relevant data

You must have a portal configured to use the SAP Process Control application. Log in as a business user to go to Figure 35. Business users perfom different tasks in the portal to which they are authorized. In my example, you, as a business user, have a dedicated portal assigned to your GRC system. In the screen shown in Figure 35, click the Access Management tab and then click the Business Processes link.

Figure 35

Navigate to Business Processes under Access Management via the front end

In the screen shown in Figure 36, select the Control check box and select the Yes radio button for Show Cross-Regulation Roles? Click the Next button.

Figure 36

Select the role level as Control to assign a functional role

After you click the Next button in Figure 36, you can assign the functional role to the chosen object as shown in Figure 37.

Figure 37

Assign a user to the selected object

Configure Business Events for Functional Roles

Predelivered business events are used during recipient determination for the triggered workflows. The users assigned to roles and objects in the section titled “Assign Functional Roles to the User for a Particular Object” can be specified as workflow recipients by executing transaction code SPRO and following menu path Governance, Risk and Compliance > General Settings > Workflow > Maintain Custom Agent Determination Rules.

Consider this example. Imagine that you wish to trigger notification for any changes in the control. (For more details, refer to the SAP Professional Journal article “How to Use Workflow for Better Data Control and Integrity.”) Master data changes tracking focuses on providing workflow capabilities in the application, such that any changes made to the master data can be approved by the people responsible for overseeing these objects. This functionality ensures that all the changes, additions, or deletions are valid, approved, and documented properly for audit purposes.

After a user initiates the change request, it goes to the approver. The approver then decides to either approve or reject the change request.

First, the IMG is maintained for the Approver (stakeholder) by executing transaction code SPRO and following menu path Governance, Risk and Compliance > Shared Master Data Settings > Activate Workflow for Master Data Changes.

In Figure 38, you define Approval changes workflow for Control. In the row in which the control appears, select the check box under the Approval column. Then click the save icon.

Figure 38

The Approval workflow is activated for CONTROL

The Agents (i.e., stakeholders) to receive the workflow are finally determined based on the defined business event and functional role. To complete this step, execute transaction code SPRO and follow menu path Governance, Risk and Compliance > General Settings > Workflow > Maintain Custom Agent Determination Rules. Configure business event 0FN_MDCHG_APPR for Master Data change Approval by populating the fields as shown in Figure 39.

The Business Event for approval workflow is 0FN_MDCHG_APPR. The role assigned is SAP_GRC_SPC_SOX_CTL_OWNER or SOX control owner and the Entity ID is CONTROL. Note that the role assigned can be any business role, which you assign to the control at the front end.

Figure 39

Define Business Event OFN_MDCHG_APPR for CONTROL

Best Practices and Recommendations

Here are some best practices and recommendations for effective use of SAP Process Control 10.1:

1. Do not use expert mode and plan maintenance transactions frequently to change master data. Sometimes an administrator uses expert mode and plan maintenance directly for testing instead of using the front end. I recommend that power transactions be used very cautiously. If used frequently without integration checks, they can lead to data inconsistency.

Expert mode (transaction code GRFN_STR_CHANGE) is where you create the structure of SAP Process Control for your organization. Plan Maintenance (transaction code PP01) is for changing or maintaining related infotypes for a particular object.

Dates are keys, so be careful if you are adding or changing data through Expert mode. There is no authorization check for business users, as it is controlled in the front end.

There are no object or data integrity checks with any changes you make with the Expert mode and Plan Maintenance transactions. Be careful to avoid data inconsistencies.

SAP’s general recommendation is to use the front end for integrating and authority checks. The front end refers to use of SAP Process Control application via the portal or NWBC.

2. Use shared memory. I always recommend the use of shared memory as part of standard product maintenance. It helps with faster data access. In the case of shared memory, the data is always read from the buffer instead of by database retrieval.

In general, you need to do this configuration when master data is most stable in the system. This means that you configure shared memory when there are the fewest changes in the master data.

The shared object of master data is built by: Timeframe + object (e.g., Q1 + Organization). In the following example, you build shared memory for the first quarter for the organization hierarchy. The master data is a query via the period defined by the time frame.

To configure shared memory, execute transaction code SPRO and follow menu path Governance, Risk and Compliance >Shared Master Data Settings > Activate Shared Objects Memory.

This action opens the screen shown in Figure 40. In the field under the ObjectType column of this screen, select Organizational Hierarchy from the drop-down list of options. In the field under the Timeframe column, enter Q1 and in the field under the Year column, enter 2015. Click the save icon to save your entries.

Figure 40

Shared memory for the first quarter of the year 2015 defined for the Organization hierarchy

3. Do not assign the same functional role to a different level or different regulation. For example, the role defined for a CEO/CFO at the corporate level should not be assigned to the Organization owner. Similarly, a role defined for a Sarbanes-Oxley regulation is not defined for FDA.

(This is a general recommendation by SAP. You would not assign the same role to a normal business user as is assigned to CFO role because they are expected to perform different tasks and activities.)

4.  Remember that when you assign the activity = Change to a role, the activity automatically covers the activity Display. This means a business user with Change activity automatically has Display rights on the master data. When you define a business role, you define activities to list all possible operations such as Change, Create, or Display that a business user is supposed to perform.

For more detail, refer to the article "Best Practices for Setting Up Authorization in Process Control."

Therefore, if a business user has authorization to change the attributes of a local control, the authorization to display local control with all its attributes is granted without the Display/CONTROL authorization.

5. Be cautious when defining metadata. When you define metadata, you define which subtype needs to be configured for that entity. The text field defined for central control also needs to be defined for local control. For example, if a subtype is configured for a central entity, then the same metadata configuration needs to be done for the local entity in infotype maintenance.

To understand this process, execute transaction code OOIT. This action opens the screen shown in Figure 41. Select the Time constraint folder. Select infotype 1002 and click the Time constraint folder again.

Figure 41

Select the Time constraint folder to know the objects that are configured

You need to define a subtype for infotype 1002 to define the long text fields.

P5 equals central control. P2 equals local control.

Consider this example. Select the Time constraint folder (Figure 41) and click the New Entries button. In the refreshed screen (Figure 42), configure Subtype ZC01 for central control and click the save icon (not shown) to save your data.

Figure 42

Subtype configured for central control

You also have to configure the same subtype for local control to make data consistent. To complete this step, again you select the Time constraint folder (Figure 41) and click the New Entries button. In the refreshed screen (Figure 43) configure subtype ZC01 for local control and click the save icon (not shown) to save your data.

Figure 43

Subtype configured for local control, as defined earlier for central control

6. Monitor jobs. You need to ensure that you have configured the following jobs in SAP Process Control 10.1 to smoothly run the application:

• Transfer work items to replacement
• Maintain workflow notification
• Carry forward open issues after sign-off
• Copy documents after carry forward

I explain how to check on the configuration for each of these jobs.

To check the configuration for transfer of work items to a replacement, you schedule the program GRPC_REPLACEMENT_MASS_ACTIVATE to transfer the work items from persons no longer working on the specific work items to replacement persons entered in the system.

Execute transaction code SPRO and follow menu path Governance, Risk and Compliance-> General Settings >Workflow >Transfer Work Items to Replacement.

Maintaining workflow notification is required to send the reminder to the workflow receiver for the tasks that they need to process. For example, predefine the reminder for sign-off workflow.

To check the configuration for this job, execute transaction code SPRO and follow menu path Governance, Risk and Compliance > General Settings > Workflow > Workflow Email Notification > Maintain Workflow Notification.

Then navigate to Governance, Risk and Compliance > General Settings > Workflow > Workflow Email Notification > Schedule Job for Workflow Notification. This activity is for configuring jobs related to reminders.

In the customizing activity to carry forward open issues after sign-off, you set up the background job that is executed once sign-off has been completed to perform the carry forward of not yet processed or open issues. This configuration allows the issues to be processed after the sign-off data freeze.

The background job is executed after the sign-off is completed. The assessment, testing and remediation plans which were not processed before sign-off are carry forward.

Execute transaction code SPRO and follow menu path Governance, Risk and Compliance > Process Control > Sign-Off > Carry Forward Open Issues After Sign-off.

In the customizing activity to copy documents after carry forward, you set up the background job to carry the forward cases’ documents. This is executed after the carry forward of issues has been completed. This applies to assessment, testing,and  issue and remediation plan cases, which are to be processed after signoff.

This process allows the document attachments from the cases to be available when the cases are carried forward. Once the background job is scheduled, it is executed every time the background job to carry forward open issues has completed.

Execute transaction code SPRO and follow menu path Governance, Risk and Compliance > Process Control > Sign-Off > Copy Documents After Carry Forward.

7. Do some post-installation workflow customizing for SAP Process Control. A task or workflow can be started as a reaction to events created by the application functionality. Specific events are declared as triggering events for the task or workflow.

Execute transaction code SPRO and follow menu path Governance, Risk and Compliance > General Settings > Workflow > Perform Task-Specific Customizing.

In the screen shown in Figure 44, from the hierarchy, expand the GRC folder, select the GRC-SPC subfolder, and click Activate event linking.

Figure 44

Activate event linking for SAP Process Control

In the screen shown in Figure 45, scroll down to see the workflow template tasks. Note that all the templates have a details icon in front of them. Select a workflow task (e.g., GRPC_PLAN CREATE) and click the details icon.

Figure 45

Click the details icon for a selected workflow task

You need to make sure that deactivation of workflow event linkage does not happen. Clicking the details icon opens the screen shown in Figure 46. You need to ensure that the Event linkage activated check box is selected so that workflow is triggered correctly.

Figure 46

Change a workflow task with error feedback (Do not change linkage)

Amit Saini

Amit Saini is a specialist developer in SAP Labs India Pvt. Ltd. Currently, he is working with the IMS Organization (installed base maintenance support) for SAP Process Control 3.0, 10.0, and 10.1.; SAP Access Control 10.0; and SAP Risk Management 3.0. He has vast experience and worked on multiple technologies, including JavaScript, SAP UI5, HANA, ABAP WebDynpro, Workflow, BusinessObjects, Floor Plan Manager with ABAP WD, ABAP OO, Adobe Interactive forms, Adobe Flex Integration with ABAPWD, SAP ABAP Dictionary, function modules for a broad range of SAP modules, and SAP HR Organizational Management (Infotype, Time Constraint, Object Type, Subtype, Evaluation Path).

You may contact the author at amit.saini@sap.com.

If you have comments about this article or publication, or would like to submit an article idea, please contact the editor.