Lesson 4 of 5
Remediation vs mitigation
10 min
Listen to this lesson
Every reported risk needs a decision. There are two kinds of answer. Remediation removes the risk: change the role, change the assignment, or split the task. Mitigation accepts that the access stays, and puts a compensating control in place that would detect or prevent misuse. Remediation is the default; mitigation is the exception that needs a reason.
- Is the conflict inside a single role?Yes → remediate by redesigning the role · No → next question
- Does the user really need both functions for their job?No → remediate by removing an assignment · Yes → next question
- Can the work be split between two people?Yes → remediate by reassigning tasks · No → mitigate
- Is there an effective control that would catch misuse?Yes → assign the mitigating control with an owner · No → design one, or escalate to the risk owner
Remediation options
- Role redesign: remove the conflicting catalog or transaction from a role, or split a role into two task-based roles.
- Assignment change: remove the role that is no longer needed, typical after a job change or temporary cover.
- Organizational restriction: sometimes the conflict disappears when the functions apply to different units, for example supplier maintenance for 1810 only and payments for 1710 only; check that your rule set analyzes organizational values before relying on this.
- Process change: move a task to a different team, such as central master data maintenance.
Mitigating controls
A mitigating control is a documented control that compensates for the accepted risk. In SAP Access Control, controls live in a mitigating control catalog and are assigned to users or roles for specific risks, usually with a validity period; analysis can then show the risk as mitigated. A good control is specific, performed by someone independent of the user, done at a fixed frequency, and leaves evidence.
| Control element | Contoso example for a supplier master plus payment conflict |
|---|---|
| Risk covered | P001, maintain fictitious supplier and process payment, for one AP lead at Contoso Parts Distribution (1810) |
| Control | Monthly review of all supplier creations and bank detail changes for 1810 against supporting documents |
| Performed by | The 1810 controller, who has no AP or master data access |
| Frequency and evidence | Monthly; signed review report with any follow-ups, stored with the control |
| Validity | One year, then re-approved by the risk owner |
A mitigating control that would survive an audit test.
Mitigation is most often justified in small teams. Contoso Parts Distribution has two people in finance; strict segregation would need a third. Dan, as risk owner, accepts the conflict for the AP lead there, with the monthly review by the controller. In Detroit, with a team of twelve, the same conflict is remediated instead.
Document the decision
Whichever treatment is chosen, the decision itself is evidence. For each open risk, Nadia records the risk, the user or role, the treatment chosen, who decided and when, and, for mitigation, which control was assigned until which date. When auditors later ask why Contoso Parts Distribution's AP lead still holds a conflict, the answer is a record, not a recollection.
What would you do?
Contoso's Toledo plant (1810) has one warehouse supervisor who both posts goods issues and runs physical inventory adjustments, flagged as a high risk. There is no second supervisor on the night shift. Luis asks whether this blocks cutover. What is the best treatment?
- Remediation removes the risk; mitigation accepts it with a compensating control.
- Remediate first: role redesign, assignment change, organizational split or process change.
- A mitigating control needs an independent performer, a frequency, evidence and a validity period.
- Mitigation is common in small teams; the risk owner approves it.
- An assigned control that is not performed hides the risk instead of managing it.
Check your understanding · not graded
Lesson check
1. What is the difference between remediation and mitigation?
2. Who should perform a mitigating control for an AP lead's conflict?
3. Why can an unperformed mitigating control be worse than no control?
4. When is mitigation most often justified?