Crystal Reports is a business intelligence application used to design and generate reports from a wide range of data sources. SAP BusinessObjects Process Control uses Crystal Reports for generating reports. Crystal Reports offers several benefits not available in core SAP reporting technologies, such as a more intuitive report formatting and the ability to schedule reports to automatically run and be distributed. The GRC user community, including analysts, managers, and executives, needs to perform tasks such as monitoring controls and risks, certifying financial statements, and understanding the risk landscape of an enterprise, so reporting is a key part of the business process for GRC. Analysts, managers, and executives have different reporting requirements and SAP BusinessObjects Process Control provides numerous standard reports that cover the following categories of compliance-specific reporting:

• Structure and setup reports: pertain to all master data objects in SAP BusinessObjects Process Control configuration and maintenance
• Roles and authorizations reports: pertain to authorization analysis
• Evaluation reports: pertain to all design assessments and tests of effectiveness activities
• Monitoring reports: pertain to automated control monitoring
• Audit and analysis reports: pertain to audit investigations and change control
• Reports and analytics: provide a dashboard for selecting different types of metrics
• Datasheets: provide access to the information related to a control or subprocess

I’ll show you the prerequisites, configuration, and post-installation steps involved to take advantage of the Crystal Reports features with SAP BusinessObjects Process Control. Beforehand, you might want to start with a look at the underlying architecture and some of the important terms and pieces of functionality involved, which I cover in the sidebar “Integrated Architecture.”

Prerequisites for SAP BusinessObjects Enterprise for SAP BusinessObjects Process Control

To enable Crystal Reports in SAP BusinessObjects Process Control 3.0, ensure that SAP NetWeaver Portal is set up for SAP BusinessObjects Process Control. To know the detailed prerequisites for Crystal Reports in SAP BusinessObjects Process Control, you need to install and use the following software components.

SAP BusinessObjects Enterprise 3.1

SAP BusinessObjects Enterprise delivers interactive reports to end users via any Web application — intranet, extranet, Internet, or corporate portal. You can use it for distributing weekly sales reports, providing customers with personalized service offerings, or integrating critical information into corporate portals. As an integrated suite for reporting, analysis, and information delivery, SAP BusinessObjects Enterprise provides a solution for increasing end-user productivity and reducing administrative efforts. By default, SAP BusinessObjects Enterprise ships with Tomcat Web application server and MySQL database server.

Fix Pack 1.3

SAP BusinessObjects XI 3.1 contains all corrections that were included and delivered in previous Fix Packs. To get subsequent corrections, you need to install Fix Pack 1.3 after upgrading to SAP BusinessObjects XI 3.1 to enable SAP BusinessObjects Process Control Crystal Reports. Fix Packs are patch installations only — they do not have the complete product installations. You need to have SAP BusinessObjects Enterprise installed to be able to install a Fix Pack.

Integration Kit 

The SAP BusinessObjects XI Integration Kit provides the ability to extract the business intelligence contained within your SAP systems. By generating Crystal Reports and OLAP reports from SAP NetWeaver Business Warehouse (SAP NetWeaver BW) queries, ABAP queries, and InfoSets, you can organize, format, and share your SAP data. SAP BusinessObjects InfoView is contained in the Integration Kit and allows you to share your reports over the Web, and SAP authentication enables Single Sign-On (SSO) between your SAP system and SAP BusinessObjects Enterprise. The SAP BusinessObjects XI Integration Kit consists of several main components:

• Crystal Reports is the report design tool that allows you to report from your SAP data
• SAP BusinessObjects Enterprise provides the framework for managing, scheduling, and distributing reports over the Web
• OLAP Intelligence allows you to analyze and report on the multidimensional data that is stored in the InfoCubes of your SAP NetWeaver BW system

The SAP BusinessObjects XI Integration Kit provides the database drivers and other features for reporting off your SAP system. The accompanying guide documents the SAP report design features that are available once you install the kit on top of Crystal Reports or OLAP Intelligence. It also shows how to publish and view these reports in an SAP BusinessObjects Enterprise environment. As a quick reference, make sure you have the following components installed before moving forward.

• SAP BusinessObjects Process Control 3.0 in ABAP with all Support Packages
• SAP BusinessObjects Enterprise server
• SAP BusinessObjects XI 3.1 Integration Kit
• SAP NetWeaver Portal: GRC_PC_POR business package for SAP BusinessObjects Process Control
• SAP NetWeaver Portal: GRCRFW Java component
• ABAP: GRFND_A – SAP BusinessObjects Process Control 3.0 in the ABAP system

Configuration Activities of SAP BusinessObjects Enterprise for SAP BusinessObjects Process Control

After completing the installation of the respective components from SAP BusinessObjects Enterprise and SAP BusinessObjects Process Control, you need to perform the post-installation and configuration steps to enable Crystal Reports. I’ll go through each of these steps next.

• Configure the Java Connector
• Configure the system definition for the SAP BusinessObjects Enterprise server
• Publish Crystal Reports
• Set up SSO in SAP BusinessObjects Enterprise
• Set up security in SAP BusinessObjects Enterprise
• Set up the Scheduler 

Configure the Java Connector

The GRC Reporting Framework includes the Java Web Dynpro application, which communicates via Java Connector (JCO) with SAP BusinessObjects Process Control ABAP components and SAP BusinessObjects Risk Management ABAP components. Follow these steps to configure JCO connections:

• Make sure the SLD Data Supplier Service in the J2EE Engine Administrator Console is properly configured
• Log into SAP NetWeaver WebDynpro Content Administrator. Expand sap.com under Deployed Content and choose sap.com/grc/crmodel. The component details screen shows up on the right panel.
• Click the Switch On button to activate the JCO Connections tab. A system administrator or Basis expert should define the system destinations GRFN_CR_DATA (the logical system name for model instances) and GRFN_CR_METADATA (the logical system name for RFC metadata).
• Click the Create button to establish the connection for GRFN_CR_DATA
• Then click the Create button to establish the connection for GRFN_CR_METADATA
• Test the JCO client connection by clicking the Test Connection button to verify the settings

Configure the System Definition for the SAP BusinessObjects Enterprise Server

Create the system definition from the SAP system with the load balancing template, or with the SAP system using a dedicated application server template, with at minimum the following fields:

• Host name of the SAP BusinessObjects Enterprise server
• SAP BusinessObjects Enterprise server name: server:domain (e.g., iwdf001.pal.sap.corp:8080)
• Path of the SAP BusinessObjects Enterprise server to access Crystal Reports in the OpenDocument folder
• Protocol of SAP BusinessObjects Enterprise server: http
• SAP client of the Crystal Reports
• Target data source where SAP BusinessObjects Process Control and SAP BusinessObjects Risk Management are installed. The target source is generally the SAP NetWeaver ABAP system ID.
• SAP system ID of Crystal Reports
• System alias: SAP_GRC_BOE

Publish Crystal Reports

You publish (i.e., activate) Crystal Reports in the SAP NetWeaver ABAP system where SAP BusinessObjects Process Control 3.0 is installed. To do so, follow these steps:

• Assign SAP BusinessObjects Enterprise roles to users
• Activate Crystal Reports in SAP BusinessObjects Process Control 3.0 ABAP
• Configure the data source location of Crystal Reports in SAP NetWeaver Portal
• Create an RFC for Publisher Service in SAP BusinessObjects Process Control 3.0 ABAP. Publisher Service connects from the ABAP system to SAP BusinessObjects Enterprise.
• Create the server definition for SAP BusinessObjects Enterprise in SAP BusinessObjects Process Control 3.0 ABAP
• Define the SAP BusinessObjects Process Control system in the Central Management Console (CMC) in SAP BusinessObjects Enterprise
• Publish the Crystal Reports (SAP BusinessObjects Process Control 3.0 ABAP)
• Configure the data source location of Crystal Reports (SAP NetWeaver Portal)

After successfully publishing Crystal Reports, you need to configure these reports to point to the correct SAP BusinessObjects Process Control and SAP BusinessObjects Risk Management systems. The GRC Reporting Framework includes a configuration application to set the data source location of Crystal Reports. Make sure the administrator has the correct portal role to access this application. The administrator needs to provide the information shown in Figure 1 to set the data source location. Follow these steps before you start the publishing process:

• Make sure the administrator is assigned the GRFN_ADMINV activity 06 (clean up reports) authorization object in the ABAP component
• Use transaction GRFN_ACTIVATE_CR in package GRFN_REPORTING, where the activation of the Crystal Report happens in the ABAP component
• Use the SAP&GRFNPCCR variant to activate SAP BusinessObjects Process Control reports (Figure 2)
• Use the SAP&GRFNRMCR variant to activate SAP BusinessObjects Risk Management reports (Figure 2)

Set Up SSO in SAP BusinessObjects Enterprise

SAP BusinessObjects Enterprise can provide SSO to the InfoView and CMC, or you can use different authentication tools depending on your application server type and operating system. There is a detailed procedure mentioned in the SAP BusinessObjects Administration Guide to configure the SAP BusinessObjects Enterprise server to accept SAPSSO2 tickets for SSO with the SAP back end. In the SAP BusinessObjects Enterprise server, you need to update web.xml as shown in the SAP BusinessObjects Process Control 3.0 installation guide for the InfoviewApp application deployed on the Web server. 

Set Up Security in SAP BusinessObjects Enterprise

Make sure all business users who will be running the reports have full access to the folder in which all SAP BusinessObjects Process Control and SAP BusinessObjects Risk Management reports reside on the SAP BusinessObjects Enterprise server, after publishing from the SAP system. For detailed instructions, follow the SAP BusinessObjects Enterprise administrator’s guide for more information. Go to service.sap.com/instguides > Release & Upgrade Info > SAP BusinessObjects > SAP BusinessObjects Business Intelligence (BI) > Enterprise > XI 3.1 > BO Enterprise XI 3.1 Installation Guide for Windows. You need to perform the following steps to assign user security to folders:

• Log in to CMCApp on the SAP BusinessObjects Enterprise server with an administrator account
• Go to the Folders option
• Create a new folder at root called SAPGRCPersonalizedReports (required only for the initial setup)
• Right-click the folder to which you wish to assign permissions and select User Security
• Add all SAP BusinessObjects Process Control business users to the access list as Full Control of this folder. You need to repeat this procedure when there are new business users. Assuming you have imported all GRC roles while setting up your SAP BusinessObjects Process Control 3.0 ABAP system in SAP BusinessObjects Enterprise, you can choose to use the SAP_GRC_FN_BASE and SAP_GRC_FN_ALL roles in this screen and assign the roles Full Control of this folder.

Set Up the Scheduler

All reports support the standard scheduling feature supported by SAP BusinessObjects Enterprise. The scheduler allows you to create a batch or periodic job, or email trigger, among other activities. To enable the email notification of scheduled reports, follow these steps to configure SAP BusinessObjects Enterprise:

• Log in as administrator to CMCApp on the SAP BusinessObjects Enterprise server, and select Servers from the drop-down list
• Right-click Crystal Reports Job Server and select Properties
• Click the Destinations Add Email button
• Enter all relevant values on this page, including: Domain Name, Host, Port, Authentication, User Name (for the RFC user), Password, From, To, CC, Subject, Message, Deliver Documents as Attachments
• Save and close
• Restart the job server so the changes take effect

Now you have completed the installation, post-installation, and configuration of Crystal Reports and SAP BusinessObjects Process Control. You can view the Crystal Reports from the Global Report Center in SAP BusinessObjects Process Control 3.0. This reporting functionality helps your organization to improve the compliance visibility, which I’ll talk about next.

Reporting Needs for Compliance Visibility

You access and run company-level reports from the Global Report Center by logging into the SAP BusinessObjects Process Control system via SAP NetWeaver Portal (Figure 3). This central repository contains summary and detailed reports that are available depending on what role the user is assigned. In the global view, you can specify which regulations or policies you want to include in a report. In the compliance-specific view, the compliance selection is limited to one initiative (e.g., Sarbanes-Oxley). Once the settings are done properly, you then can view the reporting as a dashboard in Xcelsius and all different reports in Crystal Reports categories (e.g., structure and setup or evaluations).   Click the Risk and Control Matrix link in the Structure and Setup section to get an input selection screen in which you need to filter the output based on your requirements (Figure 4). You can select only one regulation, such as Sarbanes-Oxley, cSOX, or JSOX, to determine the risk and control matrix. In SAP BusinessObjects Process Control 3.0, the multi-compliance framework concept helps enable a variety of compliance initiatives, such as financial compliance, operational compliance, or others as needed. You can also implement multiple internal compliance policies for your company.   In this screen, you have many filter selections and can choose to display the report online or schedule a job to be sent at a later time by clicking the Schedule button in Figure 4. You can filter the selection of the process, subprocess, control, and so on based on your reporting requirements. You can select the Exclude Subnodes or Bypass Buffer settings under Report Setting. If you select Bypass Buffer, the system does not access the stored repository in the report mart. If you select Exclude Subnodes, you see only high-level reports. Click the Display Report button in Figure 4 and SAP BusinessObjects Process Control can connect to the SAP BusinessObjects Enterprise server with InfoView (Figure 5). This establishes the connection to the SAP BusinessObjects Enterprise server with the SSO InfoView for the reporting requirements. Based on the input selection for the Risk and Control Matrix report, the output report format is generated in the Crystal-based format (Figure 6).   Figure 5 is a dynamic screen to show you that it is trying to connect the SAP BusinessObjects Enterprise server from SAP NetWeaver ABAP. Once the SSO is set up properly, it redirects to the screen shown in Figure 6.   In Figure 6, the report output for the risk and control matrix is generated for the required selection, such as for Sarbanes-Oxley regulation only. This report provides the detailed information about the Organization, Process, Control, Risk, Test Plan, among others. In Figure 7 (which is an extension of Figure 6), from the main menu click the circled icon to download the report output in any format. Select the file format of your choosing in the drop-down shown in Figure 6. After choosing the required file format, you can export the file and work on it offline. You can also select the page selection based on your needs.     On the other hand, you can receive the report via email or set up a periodic job based on the frequency such as Once, Daily, or Weekly with the date range selection in the scheduling options. The background job creates a report that is dispatched to the right report destinations when you click the Schedule button shown in Figure 4. This produces the screen shown in Figure 9.   You can send it to the report destination with the subject and a short message. You can also select the report format for the output such as .pdf or .doc. In SAP NetWeaver Portal, you need to provide the user name and password that has access to the reporting framework. Make sure that this user has sufficient authorization to execute a job and send the report. In addition to that, you can monitor the success or failure message by checking the Success check box next to Enable Email Notification in Figure 9. Last, I’ll describe the Analytics dashboard, which has the built-in technology of Xcelsius and more granular features. It can drill down to the next level in each segment of the graphical view. You can refer to the output of the survey assessment summary in Figure 10, which you get to by clicking Analytics Dashboard in the Reports and Dashboard section of Figure 3.   The survey assessment is selected for a 2009 time frame and for the Sarbanes-Oxley regulations. You can select the survey status or survey rating summary graph for different organizations for the filter criteria. It displays the survey status and survey rating of the survey assessment summary reports. The graphs have the distribution in a percentage of each status. This graph displays the status of all the surveys selected from the input selection. It has Survey Status and Survey Rating for the control design assessment. Survey Status has statuses such as DRAFT and REVIEW, and Survey Rating has statuses such as Deficient and Adequate. Once you place your cursor in the Survey Rating in the respective color code, it shows the percentage in the total population. For example, significantly deficient is 10.14% with the number count and the color code. Furthermore, you could explore on drill-down capability of the graphical view to see more granular reporting requirements on each survey rating and survey status. SAP BusinessObjects Process Control also offers a variety of dashboards (e.g., control test of effectiveness, issue summary) above what is shown in Figure 10 and has the drop-down functionality in the Survey Assessment Summary input field in Figure 10.