Every digital enterprise needs a GRC strategy. This will ensure that the business or organisation can keep itself focussed on achieving its business objectives while also managing various forms of risk, and also remaining compliant with legislation which is enforced in the locations in which the business operates.
As with every other aspect of the digital enterprise, the landscape of GRC is changing: as the organisations, the risks facing them, and the legislation under which a business must remain legally compliant are all subject to change.
In this article, IgniteSAP will briefly introduce the various aspects of GRC, the SAP software solutions required to administer a GRC strategy, and then the means by which IT consultants can become qualified to implement these solutions for customers.
Affective governance of a corporation supports an interconnected business, where all internal and external activity is coordinated and productive. By focussing on management of resources and allocating responsibility and accountability appropriately, organisations are able to achieve their business goals without adversely effecting employees, partners, shareholders or customers. The principles that guide corporate governance are accountability, transparency and sustainability.
SAP defines five categories of risk. They are:
Operation and Performance Risks: these arise from internal or external failures in the structure, people, products or processes involved in business operations.
Compliance Risks: which arise from poor understanding or deliberate ignorance of regional laws and regulations, and internal codes of conduct and professional standards within an organisation. These can be avoided altogether with careful proactive compliance management.
IT Risks: these are the potential failures or misuse of IT which results in business losses. They can be caused by deliberate fraud from inside the organisation, or from external IT system hacking and cyberattacks.
Financial Risks: these are the risks which result from poor business and fiscal management . They can cause loss of revenue or resources due to poor investment decisions, other poor management of business processes or from intentional fraud.
Reputation Risk: Failure to mitigate risks sufficiently and the resulting fallout can lead to another circumstance that may influence the later performance of the business. The reputation of a business is based on trust which stems from a good record of performance of the business. Loss of good reputation among partners and customers can have further consequences like reduced share price or fewer sales of products and services.
Adherence to the rules of operating a business is crucial, and this can be difficult to ensure because of three reasons: firstly the location of economic activity may be in more than one location with legislation varied in each. Secondly, this legislation is subject to change at any time, and thirdly the sheer size and volume of information in the modern digital enterprise means that there is a substantial amount of work involved in ensuring all aspects of the business activity are compliant.
It is clear that these areas defined within the framework of GRC overlap and so it is natural that they are grouped together. It is also appropriate to implement a consistent system for dealing with these issues across the whole of the extended business network, and to ensure that this is embedded in each area of business activity from the very beginning.
Governance, Risk and Compliance strategies are a crucial aspect of any business and so any SAP system. The three GRC areas overlap with each other but they now also overlap with other SAP software solutions because the principles of GRC are so important for the running of a secure and legitimate business that issues such as access control and customer data privacy are now being addressed as part of other SAP solutions.
In fact any SAP solution has some provision for GRC needs built in, but for the purposes of this article we are going to look at those solutions with which an IT consultant looking to specialise in Governance, Risk and Compliance should become familiar. Many of these are contained within the SAP Governance, Risk, and Compliance (GRC) Solutions Learning Journey.
Provision for GRC is embedded in S/4HANA and S/4HANA Cloud so along with SAP solutions in the GRC category any consultant looking to make a career as a GRC specialist will naturally need to demonstrate proficiency with S/4HANA as it relates to GRC.
The foundation course for the GRC Learning Journey is an introduction to the principles of GRC with SAP (GRC100) and this includes sections on solutions relating to Enterprise Risk and Compliance, Access Governance, International Trade Management, Cybersecurity, SAP GRC 12.0 and the SAP GRC 12.0 User Interface, Fiori, Shared Master Data and SAP HANA integration, among many others.
This two day overview prepares those on the Learning Journey for the following more detailed explorations of the SAP GRC portfolio.
The next class in the GRC Journey is Access Control Implementation and Configuration (GRC300), which is a comprehensive five day introduction to SAP Access Control. It covers all of the basic knowledge required to implement and configure Access Control: Architecture, Security Authorisations and associated risks, Segregation of Duties (SoD), Risk Analysis, Role Design and Management, Emergency Access and Periodic Access, any many other features.
By understanding these functions of Access Control 12.0 the course prepares the student for professional practice in this area of SAP and, along with the course in SAP Cloud Identity Access Governance (GRC370), for the Global Certification Exam in SAP Access Control 12.0
The Learning Journey also lists supporting and supplementary modules so that IT consultants looking to specialise in this area can build up a comprehensive knowledge of SAP GRC.
SAP Process Control 12.0 Implementation and Business Process (GRC330) is another five day course covering: Enterprise Risk and Compliance, Governance, Implementation Planning, Configuration Requirements, Creation and Management of Master Data, Configuration of a Compliance Framework, Surveys and Manual Testing, Continuous Control Monitoring, and many other features. It is also five day course delivered virtually or in a classroom.
There are corresponding courses for SAP Risk Management (GRC340), International Trade Management (GTS100 and GTS200), Business Integrity Screening, and SAP Tax Compliance.
On top of this, because many of the SAP solutions dealing with Governance, Risk and Compliance are updated quarterly in order to respond to changes in the material circumstances of their application and to new legislation as it comes into force, there are Stay Current courses which can be used to update your skills as appropriate.
It should be made clear that participating in these courses and the SAP Global Certification Exams represents a financial investment which should be assessed ahead of enrolment. For example, Access Control Implementation and Configuration (GRC300) costs 3,750.00 € (EUR) excluding tax, and one attempt at the following exam will be 200.00 € (EUR), but achieving certified status as an SAP consultant specialising in this area should result in substantial salaries and contract fees in the course of a career in SAP GRC. There are also a few things which can minimise the cost.
IT consultants can pay for each course as necessary, but the best way to get value for money from learning and getting qualified is to get a subscription to the SAP Learning Hub, which can be as low as 2,760.00 € (EUR) per year and represents a significant cost reduction, and gives access to “Digital learning content across the SAP solution portfolio, including partner-specific content, SAP Learning Journeys, expert-led live sessions, and peer-to-peer learning opportunities” as well as hands-on experience of a fully functional educational SAP system with 60 hours of SAP Live Access during that period.
The best way to finance this is through your employer, who may have a budget set aside for ongoing learning and up-skilling of their workforce. If a program of this type doe not exist then it may be possible to make a business case for it, because a more highly skilled and qualified workforce will result in greater business outcomes for a consultancy. Also, as a freelance consultant, personal membership of SAP user groups can also offer you substantially reduced rates for subscriptions to SAP Learning Hub.
There is no doubt about the need for IT consultants who are able to confidently and implement and configure GRC solutions. IDC released forecasts in August 2021 that global GRC revenues would grow from “$11.3 billion in 2020 to nearly $15.2 billion in 2025”.
The main reason given was that the market had expanded at an accelerated rate due to macro-economic events such as Covid-19. Since that date we can add the further complication of the war in Ukraine: which means that the need for internal corporate governance, as well as more accurate and realtime risk analysis has again increased.
The third term in this equation is an acceleration of national government legislation change: in part as a reaction to the previously mentioned problems of pandemics and wars, but also in response to the wider issues of climate change and digitisation. If the number of laws being passed and the speed at which they are being passed is increasing, so then the problem of ensuring a business is acting in accordance with the laws in each area of its activities is also becoming more pronounced.
The solution is for corporations to implement GRC software so that all areas of business activity and processes can be made more transparent, and preferably with automation of the GRC workload. Businesses and organisations across the world are subject to increased risk, and they will happily invest in the process of reducing that risk. As a consequence IT consultants who are capable of implementing software that reduces and manages those risks will naturally be in high demand, with their respective salaries reflecting that need.
Do you have the SAP skills and qualifications to implement a GRC strategy for businesses?
Are you looking to see how to make the most of this rapidly changing section of the SAP software services market?
Get in touch with IgniteSAP and our team will help you achieve your ambitions.
