Lesson 3 of 5
Risk analysis
9 min
Listen to this lesson
Access risk analysis compares users' or roles' authorizations with the rule set and reports every risk it finds. SAP Access Control's analysis engine can run ad hoc in real time or as an offline batch, at user level or role level, and can include or exclude mitigated risks. The output is long; the skill is reading it and turning it into decisions.
Role level versus user level
| Aspect | Role-level analysis | User-level analysis |
|---|---|---|
| Question | Does this role, on its own, contain a conflict? | Does this user, across all their roles, hold a conflict? |
| When to run | During role design and before every role change is transported | Before assignments, at go-live, and periodically after |
| Typical finding | A role designed with two conflicting catalogs | Two clean roles whose combination conflicts |
| Fix | Redesign the role | Change the assignment or mitigate |
Contoso's target is that every single role is SoD-free (role-level clean). Even then, user-level analysis is essential, because Ana might hold the AP clerk role and, after covering for a colleague, the supplier master role too. Each role is clean; Ana is not.
Reading a result line
| Field | Example | What it tells you |
|---|---|---|
| User | ANA (Contoso AP clerk) | Who holds the conflicting access |
| Risk ID and description | P001, maintain fictitious supplier and process payment | Which risk from the rule set is triggered |
| Risk level | High | How urgently it needs a decision |
| Function and action | Maintain supplier master via BP; process payment via the payment run app | Which tasks combine, and through which apps or transactions |
| Role | ZCMC_JOB_AP_CLERK_1710 and ZCMC_JOB_MD_SUPPLIER | Which assignments create the conflict |
| System | CMQ (later CMP) | Where the access exists |
| Mitigation | None | Whether an accepted control already covers it |
One line of a user-level risk analysis, with Contoso example values.
Read across the line: it says that Ana, through two roles, can perform both functions of a high-level SoD risk, with no mitigating control. The roles column is the most useful one for the fix, because it shows which assignment to question. Analysis reports also group by risk, by process and by user group, and dashboards show the trend across systems. SAP's tool includes a risk simulation that answers "what if we add this role?" before the change is made.
- Run the analysisUser level, permission level, all high and critical risks, excluding mitigated ones.
- Group by root causeWhich role combinations create most conflicts?
- Fix roles firstConflicts inside a single role are design defects.
- Decide per userRemove an assignment, or mitigate if the business needs both.
- Re-runConfirm the conflict is gone or shows as mitigated.
Analysis is a snapshot
A risk analysis describes access at the moment it ran. A user who receives a role the next morning, a role changed in the next transport or a rule set updated for a new release can all change the picture. That is why Nadia schedules a weekly batch analysis of CMQ during the test phase and of CMP after go-live, and why ad hoc analysis is built into role changes and access requests. Results that auditors rely on should state the date, the system, the rule set version and whether mitigated risks were included, so that anyone can reproduce them.
What would you do?
A user-level analysis shows that Kenji, the ABAP development lead, has a critical access risk in CMQ: debugging with change rights. Kenji says he needs it to fix defects during testing. How should Nadia read and act on this result?
- Analysis runs at role level (is the role clean?) and user level (is the person clean across roles?).
- Clean roles can combine into a conflicted user, so both levels are needed.
- Read each line: user, risk, level, functions and actions, roles, system, mitigation.
- Group by role combination to find the few roles behind most conflicts.
- Use simulation to check a change before it is made.
Check your understanding · not graded
Lesson check
1. Every Contoso role is SoD-free at role level. Why is user-level analysis still needed?
2. Which column of a risk analysis line is most useful for deciding the fix?
3. What does risk simulation let you do?
4. A report shows 400 conflict lines. What is the most efficient first step?