Rise with SAP – Safe and CompliantSome customers embracing Continuous Control Monitoring (CCM) journey are complaining about Users flooded with too many CCM exceptions and getting same results over and over again. We would like to share our experience and to outline most important considerations helping to avoid beginner`s mistakes. Few hints shall help to understand the underlying reasons, improve the user experience and effectiveness of CCM.
Let`s start with general CCM use case considerations: on a higher level, CCM scenarios are designed for two purposes:
- Checking for deviations from pre-defined values, – e.g. mandated by a policy or design documents. Examples here could be changes of critical configuration (e.g. tolerance limits for three way match), or deviations from mandated values (e.g. SAP Security Baseline Template).
- Supporting control or testing activities by providing data, which needs to be further worked on, and judgement to be applied. Examples here could be a list of manual invoices without PO reference, with samples to be taken and tested; or a list of all changes done to sensitive fields in business partner master data to be reviewed and confirmed for correctness. This second use case tends to generate a lot of data in deed, – which is not wrong. Usability considerations are important here: the structure of fields and additional information for users needs to enable them to work intuitively.
You need to be clear on what the CCM is used for, and provide sufficient guidance to end users accordingly!
Why is CCM generating too many hits? We would like to highlight the following three root-causes:
#1 Fix what is broken!
In some cases, CCM is doing exactly what it’s meant to do—flagging real issues. However, an excessive number of hits can indicate that the process itself is broken and needs fixing before CCM can continue monitoring effectively. For example, if client settings are changed daily to perform direct changes in productive system, there is a real issue in your change management process. Identifying and resolving the root cause is essential.
#2 Tackle False Positives:
If the system is generating unnecessary alerts, it’s often a sign that the logic behind the monitoring is not precise enough. Refining the logic (e.g. exact attributes of manual posting documents in SAP S/4HANA) will help reduce these false positives, ensuring that only significant issues are flagged.
#3 Avoid Beginner`s mistakes when working with Date Fields The main goal in monitoring data via SAP GRC is to pick the right one, – based on the date and time frame. For example, if you would like to check events happened or data created during the period “January 2025”, then the logic you want to set up shall apply the following condition to relevant date fields (e.g. “created on” or “changed on”): Date field “= or > January 1st 2025” AND “= or < January 31st 2025”. How can you achieve that?
Good news: Changelog scenarios handle this consideration automatically! Date fields do not require special treatment in this case. All you need to do is select the correct handler type (SCU3) in the deficiency criteria of a Business Rule.
Another piece of good news: If you are setting up a value check scenario, there is a special feature available that allows you to specify relevant date fields within the logic. We would like to elaborate on this in more detail since overlooking this important concept can undermine your CCM use case!
How Date field filters and CCM Scheduler work together?
In CCM, Date filters allow you to refine your data analysis by specifying the exact time periods you want to monitor. The Runtime Method settings for fields that involve dates in the Filter Criteria section help you define the time period for analysis:
- Between Job Step Period from Date and Period to Date
This option filters data within a specific time frame based on the job step dates in the CCM Scheduler. For example, if the Test Period is set for 01.01.2025 to 31.01.2025, the filter in the Business rules will use these exact dates for monitoring.
- Customized Date Period
This allows you to set a custom time range for data analysis, independent of the job step. - Equal to Job Step from Date
Filters data based on the start date of the job step. For instance, if a task starts on 01.01.2025, this filter will focus on data from that specific start date. - Equal to Job Step to Date
Similarly, this option restricts the analysis to the end date of the job step.
CCM is a powerful framework in SAP GRC for continuous monitoring, but to maximize its potential, it’s essential to use it correctly. Contact us if you have questions or need further assistance!