Business users face challenges while performing control activities (for example, accuracy in control effectiveness). They strive to find ways to achieve timely performance using workflows and to upload evidence for activities. I explain how a business process owner can set up, execute, and document performance plan tasks that ensure faster execution, clear accountability of different stakeholders within the business process, and enhanced reliability and consistency of controls.

Manual Control Performance in SAP Process Control 10.1 enables business process owners to conduct control activities and deliver evidence documents to auditors. You can attach the evidence documents using an attachment feature. Business process owners can track multiple performance plans along with their statuses. I explain the setup of Manual Control Performance using a business scenario and show how to enable different stakeholders for different transactional activities at different levels within a performance plan.

Set Up your System for Manual Control Performance

To use Manual Control Performance, you need to have an SAP system with SAP Process Control 10.1 Support Package 11 or higher. I now walk you through the steps to set up your system for Manual Control Performance.

1. Set Up Roles and Authorizations

You need to set up roles and authorizations so that you can use the SAP Process Control 10.1 Manual Control Performance feature. Table 1 lists details pertaining to the roles necessary for the Manual Control Performance feature.

Table 2 lists details pertaining to the authorization objects necessary for Manual Control Performance.

Authorization object	FRFN_API
Activity	02: Display 03: Change
Datapart	*
Authorization entity	CTRL_PERF
Subentity	*

2. Configure the Open Data Protocol (OData) Data

The OData service GRPC_CTRL_PERF_SRV needs to be configured. It was delivered to exchange data between the user interface (UI) and the back end. This service must be activated post installation or post upgrade.

To maintain and activate the OData service GRPC_CTRL_PERF_SRV, execute transaction code SPRO and follow menu path SAP Reference IMG > SAP NetWeaver > SAP Gateway > OData Channel > Administration > General Settings > Activate and Maintain Services. Click the execute icon beside Activate and Maintain Services to open the screen in Figure 1. Click the Add Service button to maintain the service.

In the System Alias field, choose the system alias you defined during Gateway configuration and press Enter. Use F4 input help to select the alias. Usually, you choose the local system alias. Depending on your system configuration, you can either choose a local or another system alias. For more details, contact your system administrator.

Select the new service from the list and choose Add Selected Services. In the dialog box that appears, enter ZGRPC_CTRL_PERF_SRV in the Technical Service Name field, choose Local Object in the Package Assignment field, and click the OK button.

Note: You can use wild cards during your search (for example, *GRPC_*SRV). You have now activated the OData service required for the new feature.

3. Activate Manual Control Performance Workflow and Tasks

To activate workflow and tasks, follow Customizing menu path SPRO > SAP Reference IMG > SAP Customizing Implementation Guide > Governance, Risk and Compliance > General Settings > Workflow > Perform Task Specific Customizing. Click the execute icon beside Perform Task-Specific Customizing to open the screen in Figure 2. Navigate to SAP > GRC > GRC-SPC. Click the Assign Agents link. This action opens the screen in Figure 3.

 

Follow these steps to enable the task and workflow for Manual Control Performance.

Click the Manual Control Performance tasks highlighted in Figure 3 one by one.

• Create Manual Control Performance
• Perform Manual Control Performance
• Rework Manual Control Performance
• Review Manual Control performance

Select the task and click the Attributes button. Select the General Task radio button and click the Transfer button. Then go back to the main screen shown in Figure 2. To activate the Event Linkage, go to SAP > GRC > GRC-SPC and click the Activate event linking link (Figure 4).

In the screen that the system opens (Figure 5), find WS7650029 and expand the node. Select the row below the WS7650029 node and click the Deactivated button. This action enables the event linkage that is highlighted in the rectangular marked box. A green Activated status button appears on the screen after the event is activated.

4. Maintain the Entity-Role Assignment

You next must enable the assignment of roles to the entity. In my example, Role SAP_GRC_SPC_CRS_CTL_PERFORMER has been assigned to the CONTROL entity and is visible in the Role tab of the control screen.

To complete this step follow menu path SAP Customizing Implementation Guide > Governance, Risk and Compliance > General Settings > Authorizations > Maintain Entity Role Assignment. Click the execute icon beside Maintain Entity Role Assignment and in the screen the system displays (Figure 6) click the New Entries button.

In the next screen (Figure 7) select the Entity using F4 help and select the Role using F4 help to maintain the role for the entity. Repeat this step for other roles shown in Figure 8 for Entity Control.

Click the save icon shown in Figure 6 to save your entries. The list of roles assigned to Entity Control is then shown in the next screen (Figure 8) .

5. Maintain Custom Agent Determination Rules

Custom Agent Determination Rules are customizing tables in which a user needs to set up roles for different business events. It means if any business event triggers, then workflow goes to the user who is assigned to that particular role.

To complete this step, follow menu path SAP Reference IMG > SAP NetWeaver > SAP Gateway > OData Channel > Administration > General Settings > Workflow > Maintain Custom Agent Determination Rules. Click the execute icon beside the Maintain Custom Agent Determination Rules node. This action opens the screen in Figure 9.

Click the New Entries button to maintain the entries for Manual Control Performance in the screen shown in Figure 10. The example in Figure 10 is for business event 0PC_PERF_CTRL_PERF, which is used for the Manual Control Performance step performer. The role SAP_GRC_SPC_CRS_CTL_PERFORMER is assigned to this business event.

Maintain the entries for Manual Control Performance step Performer and Reviewer for the following Business Events as shown in Figure 10. Repeat this step to maintain different entries as shown in Figure 11.

• 0PC_VALI_CTRL_PERF – Reviewer Business Event
• 0PC_PERF_CTRL_PERF – Performer Business Event

A business event is the action that is mapped with roles, and based on that workflow, it is routed to a particular user who has that role assigned on that particular entity. For example, in Figure 10, users have been assigned at the Entity level. In the case of Manual Control Performance, the entity is Control, which has the role SAP_GRC_SPC_CRS_CTL_PERFORMER assigned under the Role column  in the control screen. Suppose user XYZ has been assigned to role SAP_GRC_SPC_CRS_CTL_PERFORMER in the control screen under the Role column.

Now when the business event 0PC_PERF_CTRL_PERF triggers, which has role SAP_GRC_SPC_CRS_CTL_PERFORMER mapped in custom agent determination customization as shown in Figure 10, user XYZ receives the Manual Control Performance step performer workflow.

Click the save icon on top as shown in Figure 9 to save the entries.

6. Relate the Regulation to Plan Usage

This customization enables the MCP for particular regulations. For example, if you want to enable it for Sarbanes-Oxley regulations, then you need to maintain the entry for SOX regulation for Activity PERF-CLTPF.

To complete this step, follow menu path SAP Reference IMG > SAP Customizing Implementation Guide > Governance, Risk and Compliance > Process Control > Multiple-Compliance Framework > Relate Regulation to Plan Usage.

Click the execute icon beside Relate Regulation to Plan Usage and in the screen that appears, click the New Entries button (Figure 12). This action opens the screen in Figure 13.

In Figure 13, select an Activity ID and a Regulation Configuration using the F4 help and click the save icon (not shown). For my example, Manual Control Performance has been maintained for Sarbanes-Oxley and FDA regulations.

7. Notification Configuration

In this step, you can maintain different notification templates for Manual Control Performance. To maintain notification templates, execute transaction code SM30. This action opens the screen in Figure 14 in which you enter the view name (GRFNVNOTIFYMSG) in the Table/View field. You can also search for the view using F4 help. After you make your selection, click the Maintain button.

In the initial screen that opens after you click the Maintain button (not shown), click the New Entries button. This action opens the screen in Figure 15. Enter data in the following fields:

• Message Class: For MCP, 0GRC_CTRL_PERF is the message class
• Message number : This number can be anything from 0 to N
• Description: Enter text to describe the notification message
• Subject: This field is for the email notification subject
• Document Object: This field is for the email template

Repeat the previous process for different notifications pertaining to Manual Control Performance. To notify a user to review control performance, enter the details shown in Figure 16.

To notify a user to re-perform a control, enter the details shown in Figure 17.

To notify a user for completed performance steps, enter the details shown in Figure 18.

To remind a user to perform the step, enter the details shown in Figure 19.

To notify a user to perform a forwarded performance step, enter the details shown in Figure 20.

The final entries look like the data shown in Figure 21.

For all notifications, there is a specific template maintained in different message classes in Figure 21. You can access those Manual Control Performance templates via transaction code SE61, using F4 help for the Name field as shown in Figure 22.

 

Select the document name in Figure 22 and click the Display button to open the screen in Figure 23.

8. Add a Menu Item for Reports

You can use the reports Manual Control Performance Results and Manual Control Performance Details to check which controls have been manually performed in your organization and to see the control performance results in detail. To enable the menu items for the reports in SAP NetWeaver Business Client (NWBC), you need to complete these settings.

Execute transaction code SM34. This action displays the screen in Figure 24. In the View cluster field, enter a name (e.g., GRFNVC_ITEMAUTHC) and click the Maintain button to maintain the entries. This view cluster is used to maintain the customization for Manual Control Performance reports such as authorization mode and regulation relevance.

After you click the Maintain button in Figure 24, the screen in Figure 25 opens. In Figure 25, click the New Entries button and then enter data in the following fields:

• Menu Item ID: 0REP_MCP (the Menu Item ID is fixed for MCP)
• Menu Item Text: Enter Manual Control Performance Results
• Authorization Mode: Choose Entity-Level Authorization Check
• Entity Evaluation: Choose One entity/object is enough
• Authorization Class: Leave it empty
• Logical Operation: Choose No
• Regulation Relevance: Leave this option unchecked

Click the save icon (not shown) to save your data.

Create a Performance Plan

A Performance Plan for Control is a multiple-step process that is used to gather evidence from different users (i.e., step performers) that is used for control effectiveness testing and auditing. For example, the business scenario Postive Payment used for checks is shown in Figure 26. A sequence of steps, evidence, or comments can be required or not required as per the step configuration.

In my example scenario in Figure 26, I show a method used to verify payments done by an organization via checks to detect fraud (if any). This scenario has three performance steps:

            1. Export payments - Export the payment transactions to the bank

            2. Verify completness - Verify checks and Hash total

            3. Transmit and confirm - Transmit to bank and confirm receipt

Before going forward, there are some general steps that are repetative for most of the following steps.

Complete these steps to launch the GRC application.

1. Execute transaction code nwbc in the SAP GRC back-end system as shown in Figure 27. This action opens NWBC in your browser (Figure 28).

  2. Click the nwbc link shown in Figure 28 to open the screen in Figure 29. All GRC users have been assigned some roles such as NWBC or SAP_GRC_NWBC. These roles are assigned by executing transaction code SU01 and then assigning roles to users as per their roles in the organization.

Figure 29 shows the GRC application with different work centers such as My Home, Setup, and Assessments.

A Performance Plan then can be created for any control (i.e., central or local) in SAP Process Control. Central control is a central repository of controls maintained as templates that can be further assigned to an organization as a local control, which is used within planning of control performance (i.e., Manual Control Performance).

Central Control Level

A performance plan can be created at the central control level.

Follow these steps to create a performance plan:

1. In NWBC, go to Master Data > Activities and Processes > Business Processes and open a central control. This path takes you to Figure 30.
2. In the Performance Plan tab (Figure 30), create a new performance plan for the control by adding detailed control performance steps.
3. For each step, enter information in fields under these columns:

• Step: Enter the name of the step
• Description: Enter the description of the step
• Evidence Required: Specify if evidence is required for the step
• Comments Required: Specify if a comment is required for the step
  • Sequence: Enter a numeric sequence for the step. The number determines the order of performing the steps. You can assign the same number to multiple steps. These steps can be performed side by side.

4. Save the control by clicking the Save button.

Local Control Level

For local control, you need to have an organization set up in which you can assign subprocesses and controls. At the local control level, you can set up the step performers as well. A step performer can be a user who is the owner of that particular step. This person can be any user in the system.

5. In NWBC follow menu path Master Data > Organizations (refer back to Figure 29). Click the Organizations link to open the screen in Figure 31 in which you select Finance (this is the organization) and click the Open button. This action displays the screen in Figure 32.

6. Click the Assign Subprocess button in Figure 32 to display the screen in Figure 33. Select the Cash Disbursement subprocess as shown in Figure 33. Then click the Next button to open the screen in Figure 34.

Figure 34 shows that the Cash Disbursement subprocess has been added to the Finance organization, which has the Positive payment used for checks control. Select the Positive payment used for checks control and click the Open button.

7. Select the control for Positive payment used for checks as shown in Figure 34 and click the Open button under Subprocess Assignment. The control screen opens as shown in Figure 35.

8. In the control screen in Figure 35, click the Roles tab. Assign the relevant control performance roles to users as shown in Figure 36. Under the Roles tabs, you can assign a user to Manual Control Performance roles (for example, SOX Control Performer) as shown in Figure 36.

9. Click the Save button to save the control. This action returns you to the screen in Figure 34.

10. Click the Save button to save the Organization as shown in Figure 34.

Assigning Performers for Control Steps

By default, you assign a control performer to a performance plan on the plan level. However, you have the option to assign control performers and set the duration for each performance step. By default, a control performer can be any user in the system. You can use Business Add-In (BAdI) GRPC_BADI_GET_STEP_PERFORMER to implement your own control performer selection logic.

To assign control performers on the step level:

1. Go to IMG activity under menu path SPRO > SAP Reference IMG > Governance, Risk and Compliance > Process Control > Evaluation Setup > Manual Control Performance > Enable Performer Assignment on Step Level and click the enter icon (Figure 37).

2. Select the customizing item MCP_STEP_LVL_CHECK to enable the functionality. Selecting this item enables assignment of the step performer at the step level at the local control level. Select the check box under the Activate column in Figure 37 and click the enter icon.

Go to the Performance Plan tab of a local control, select a step, and click the Edit Performer button in Figure 38. To reach the Performance Plan tab, follow the steps mentioned in the assignment of a performance plan to a local control. The details are shown in Figures 31 through 35. 3. In the pop-up dialog window, search and select the performer for the step. You can assign multiple performers to one step.

Figure 38 5. Repeat steps 3 and 4 to assign a step performer for the all steps as shown in Figure 38. 6. After assignment of the step performer, save the control by clicking the Save button in Figure 38.

7. Click the Save button again, which saves the organization as shown in Figure 34.

Planning Control Performance for a Control

Once a performance plan assigned to a control, the next step is to execute the performance plan so that different step performers can execute their respective steps as shown in Figure 39.

      To plan the performance plan, go to the Planner application under the Assessments work center in the GRC application (Figure 40).  

In the Planner, you create a recurring or one-time plan to perform the control (Figure 41). You can schedule control performance tasks for any control with a control performance plan.

As the control owner, when you open a control assigned to you, you can create a manual control performance directly in the control screen in Figure 42. You also can create an ad-hoc Control Performance plan directly under the Control Performance tab as shown in Figure 42. To reach this screen, follows the steps in Figures 31 through 35.

Performing Controls

After a plan is successfully created in the Planner, a user assigned the performance step receives the work item in the GRC inbox. Click the link to go to the Manual Control Performance screen.

Follow menu path NWBC Role > Go to My Home > Work Inbox to see all the assigned workflow tasks (Figure 43). Work Inbox is an application where users can see their workflows. Click the Work Inbox link to open the screen in Figure 44.

If an email address is configured for a step then the step performer also receives an email containing the same link for the manual control performance task (Figure 45). (For example, in Figure 38, the performer for the Export Payment step is Bhupinder Singh Gahunia. The email address for this user is configured using transaction code SU01.)

The new user interface (UI) is based on SAP UI5 technology. You can find the basic control information and all the steps included in the performance plan in the UI. From here, you can upload evidence of the manual control performance, report issues, enter comments, or forward the manual control performance to other users. Click the Demo MCP link in Figure 45 to open the screen in Figure 46. This screen shows the workflow in the SAPUI5 application.

 

1. Status of Performance Steps

A control performance step can have the following statuses:

• In Process: The initial status of the first steps of the control performance. When the previous step is set to Done, the status of the step becomes In Process automatically. If you reopen a step, the status may also become In Process depending on its sequence.
• Pending: Status of all the steps subsequent to the steps in process.
•  Done: When a step is completed and set to done.

Every step in a performance plan goes through the statuses in Figure 47.

2. Performing the Steps

All steps in the control performance plan must be completed in sequential order. Pending steps cannot be modified until the previous step is completed. You can either complete the steps by yourself or forward the entire control performance to other users. If a control performer is assigned on the step level, only the assigned user can perform the step. After completing all the steps, you submit the manual control performance for review.

3. Completing a Step

To complete a step, click the step Export payments as shown in Figure 46 to go to the detail screen of that step, enter your comment, upload the evidence, and choose Set to Done. If there is any issue worth the attention of the control manager, choose Report Issue to log an ad-hoc issue for the control performance.

Figure 48 shows the single step view, which a step performer executes.

4. Forwarding Manual Control Performance to Other Users

To forward the manual control performance to other users, click the Forward button in Figure 48. In the pop-up window in Figure 49, enter data in the following fields:

• Forward to: Select users from the drop-down list. You can also enter the name and select users from suggestions.
• Comment: Enter an optional comment.

Click the OK button to forward the manual control performance to the selected users. If email addresses are configured for the forwarded users, they receive an email notification.

After you click the Forward Info button in Figure 46, you can see the forward history of the manual control performance. Figure 50 shows the Forward Info button, which shows the details to whom the step has been forwarded.

5. Reopening a Completed Step

If you need to modify an already completed step, you can use the Reopen button to set the step to in process again. This can only be done before you submit the manual control performance for review. Click the Export payments step shown in Figure 48 to go to the detail screen of that step. You see the Reopen button in the step shown in Figure 51.

Reviewing Control Performance

As a control performance reviewer, you’ll find the submitted control performance as a work item. Figure 44 shows the Work Inbox. Figure 52 shows the Review Manual Control Performance workflow.

Click Review Manual Control Performance in Figure 52 and Figure 53 opens where the reviewer can either reject or approve the control performance

After the reviewer approves, Manual Control Performance is completed and the status is set to Done as shown in Figure 54.

Monitoring Control Performance

You can monitor planned control performances. The Control Performance tab of a local control lists all planned performances and the detailed steps of each performance. Select a performance to display the performance steps. You can follow the steps in Figures 31 through 35 to reach Figure 55.

Use Performance Results in Control Effectiveness Testing

The manual control performance results can be used as a reference when you perform effectiveness testing for the control. In the Control Effectiveness Manual Test screen, go to the Control Performance tab and you can see all the results of manual control performance for the control. Following are example steps to use Manual Control Performance Performance Results in Manual Control Test Effectiveness.

Use transaction code NWBC and go to the Assessments tab and select the Planner application as shown in Figure 56.

Create a plan for Test Control Effectiveness for the Control Positive payment used for checks (Figure 57).

To select regulations for a plan, click the Select Regulation option and then in the Regulation field select an option from the drop-down list of options (Figure 58). For my example select FDA and then click the Next button. [Are my revisions OK here?]

Click Select Organizations in Figure 59 and then click the Next button.

Either select the Select All Controls radio button or the Select Specific Controls radio button. Then select the control for which effectiveness testing needs to be performed. Click the Next button (Figure 60).

Activate the plan by clicking the Activate Plan button (Figure 61).

Use transaction code NWBC. Click the My Home button and then the Work Inbox button. You see the workflow for Test of Control Effectiveness (Figure 62).

Click Perform Manual Test of Control Effectiveness to open the screen shown in Figure 63.

Reporting

The menus Manual Control Performance Results and Manual Control Performance Details are added to the Reports section under the Assessments work center in NWBC. You can use these menus to generate reports for manual control performance.

Use transaction code NWBC. Click the Assessments tab and the Manual Control Performance reports (Figure 64).

The Manual Control Performance Details report (Figure 65) provides the details of Manual Control Performance along with the evidence collected. You can navigate to particular steps via links in the results of the report. Select a time frame and regulation, which are required for executing this report.

Figure 66 shows the results, including details such as control, control performance, and step details. The results also include links that enable you to navigate to another screen (for example, click any control link to open the control screen).

The Manual Control Performance Results report shown in Figure 67 shows the selection criteria that you can select and then provide details to get the results.You need to indicate a time frame and regulation to execute this report.

Figure 68 shows the result for Manual Control Performance results report. This screen shows a status of MCP step as New/Done and other related details.