GRC100 – Principles of SAP Governance, Risk and Compliance — Lesson 2: Risk Identification, Assessment, Responses, Controls, Policies, and Control Objectives

Learning Objectives

• Explain the SAP structures, data, settings, roles, and dependencies governing risk and control framework design.
• Perform and validate assessment, responses, policies, and objectives using reviewable system evidence.
• Evaluate the condition where a control is marked effective even though ownership, evidence frequency, access exposure, and remediation tracking do not support the conclusion and select proportionate corrective action.

Detailed Topics

• Risk Identification applied to the course scenario, expected SAP behavior, dependencies, and evidence.
• Assessment applied to the course scenario, expected SAP behavior, dependencies, and evidence.
• Responses applied to the course scenario, expected SAP behavior, dependencies, and evidence.
• Controls applied to the course scenario, expected SAP behavior, dependencies, and evidence.
• Policies applied to the course scenario, expected SAP behavior, dependencies, and evidence.
• and Control Objectives applied to the course scenario, expected SAP behavior, dependencies, and evidence.

Instructor Demonstration

The instructor traces a governance team creating a common language for risk ownership, control evidence, access decisions, and remediation priorities. The walkthrough connects navigation, configuration or process logic, system messages, and evidence captured in the GRC100 risk, control, access, and assurance framework workbook. It also tests the exception where a control is marked effective even though ownership, evidence frequency, access exposure, and remediation tracking do not support the conclusion.

Hands-On Exercise

Complete a controlled SAP exercise covering Risk Identification, Assessment, Responses, Controls, Policies, and Control Objectives and preserve the verified result in the GRC100 risk, control, access, and assurance framework workbook.

1. Confirm scope, prerequisites, master data, roles, dependencies, and acceptance criteria.
2. Execute the workflow while recording settings, transactions, outputs, and system messages.
3. Test normal behavior, one boundary condition, and the stated exception.
4. Document corrections, evidence, ownership, retest criteria, and handover actions.

Scenario Analysis

• Identify which object, rule, setting, or process step most strongly influences risk and control framework design.
• Compare two defensible responses and explain business, technical, control, and support trade-offs.
• Determine how the GRC100 risk, control, access, and assurance framework workbook should be approved, retained, retested, and updated.

Troubleshooting Guidance

Start where expected SAP behavior first differs from the observed result. Check master data, configuration sequence, authorization, integration, status, and transaction evidence separately. Treat “a control is marked effective even though ownership, evidence frequency, access exposure, and remediation tracking do not support the conclusion” as a hypothesis until system settings, logs, documents, and outcomes confirm the cause.

Validation Checklist

• Required SAP structures, master data, roles, settings, and dependencies are present.
• The GRC100 risk, control, access, and assurance framework workbook connects each conclusion to objective, reviewable evidence.
• Normal processing, the boundary condition, integration behavior, and exception were tested.
• Corrections, ownership, retest criteria, documentation, and operational handover are complete.

Lesson Outcome

Learners can apply Risk Identification, Assessment, Responses, Controls, Policies, and Control Objectives, explain the resulting SAP behavior, and defend the outcome through the GRC100 risk, control, access, and assurance framework workbook.