Issues can be manually identified through failed manual control effectiveness tests. For manual control effectiveness tests, issues can also be submitted via the offline Adobe Interactive test form. Issue identification process is similar for assessments, the only difference is that in assessments the rating must be less than 'adequate'. When the test of effectiveness fails or the assessment rating is less than adequate he task can only be closed when an issue was created.
When 'retest' option is configured, the original evaluation owner receives a 'retest' task and opens the History tab (which appears for this particular case) to review the activity related to the assessment.
Ad-hoc Issues are unplanned and informal. These arise from unexpected events like compliance incidents or business issues, not driven by predefined rules. Ad hoc issue management in SAP Process Control offers an effective solution for monitoring and managing issues beyond the scope of regular control assessments. Using this feature, issues can be identified at various levels, including organizational, subprocess, control, or regulatory, and can be tracked and monitored accordingly.
The Issue Management function within SAP Process Control enables also the creation of Ad-hoc issues to effectively manage issues that are identified outside of the standard testing and assessment process. These issues may not have arisen from an evaluation-based test and can take the form of an issue, question, action item, or planned task. Ad hoc issues can be prompted by compliance or business events, or they may result from the identification of a problem area.
The implementation of issue management enhances SAP Process Control by providing an extended capability to identify relevant issues, document them, and enhance transparency during external auditing processes. This improvement offers increased flexibility and traceability on an enterprise-wide scale, with a centralized issue management repository accessible across all GRC (Governance, Risk, and Compliance) applications. This consolidation allows users to document their complete compliance efforts within a single tool, eliminating the need for separate external issue documentation.
SAP Process Control includes the audit trail functionality which captures any field changes (user or system initiated) for issues captured during "Save" or "Submit" actions, including "Void" and "Reassignment". The link to the Audit Trail will be choosable once the issue is submitted. The changes include the Date/Time stamp.
The following text showcases the process flow of the issue and remediation, which is divided into 2 parts:
- Part: Report Issue and assign remediation plan:
The Issue Reporter needs to maintain mandatory fields like Name, Description, Priority (Low, Medium, High), Object type, which can be Activities, Controls, Loss Event or many more. In addition, every issue needs an owner to process it. Optional you can also enter a due date, add a currency & an estimated loss amount, add a regulation and add attachments & links. The issue can be saved in a draft version and the issue reporter can also void the issue, which will then be canceled.
When the issue is submitted, the issue owner receives his task. He can either assign a remediation plan, close the issue without a plan or reassign the issue to a different person if he is not the correct person.
- Part: Perform Remediation plan:
A remediation plan consist of mandatory fields like Plan Name, Start & Due Date, Owner and a description of the plan. The Remediation Owner can either perform the plan and therefore complete the plan so the issue is closed or he can assign the plan to the next processor if multiple processor are needed or the wrong processor was assigned.
Demonstration: The Issue and Remediation Process
After Jenny Ma, in her role as Control Tester, reported the issue regarding "Lack of validation from the legal department," Julia Armstrong received the item in her work inbox for evaluation. Julia's responsibility includes assessing the severity and impact of the issue to determine the appropriate actions.
Julia reviewed the details of the issue and needed to decide whether a formal remediation plan was necessary. This decision was based on factors such as the priority of the issue, regulatory requirements, and company policies.
Upon receiving confirmation from the legal department that they had completed the required validation, Julia considered this information in making her decision about closing the issue.
Based on the legal department's validation, Julia concluded that the issue could be closed. This determination was made because the root cause of the problem (lack of validation) had been addressed.
Julia then proceeded to close the issue within by updating its status to indicate that it had been resolved. Closing the issue signified that the necessary steps had been taken and that the issue was no longer a pending concern.
Overall, proper documentation of the issue closure and any remediation actions taken is crucial. This documentation ensures transparency, facilitates audits, and ensures compliance with internal and external regulations.