Understanding the Concept of Planning in SAP Process Control

In SAP Process Control, the planning phase plays a pivotal role in ensuring effective control activities and risk management. One critical aspect of this phase is the creation of question and survey libraries. These libraries serve multiple purposes:

1. Alignment with Organizational Goals: By defining specific questions related to control design and effectiveness, organizations ensure that control activities are directly aligned with their strategic objectives and compliance requirements.
2. Systematic Risk Assessment: The survey libraries enable organizations to systematically assess critical risks by collecting relevant data and insights from control owners. This structured approach ensures thorough coverage of potential risk areas.
3. Support for Decision-Making: The collected data from surveys provides valuable information for informed decision-making. It helps identify areas of strength and weakness in control design, allowing organizations to prioritize improvements effectively.
4. Continuous Improvement: Regular surveys and assessments support a culture of continuous improvement by enabling organizations to identify evolving risks and adapt control measures accordingly. This iterative process ensures that control frameworks remain effective and responsive to changing regulatory landscapes.
5. Enhanced Collaboration: The process of creating question and survey libraries facilitates collaboration between control owners and the internal control team. It encourages communication and knowledge sharing, fostering a deeper understanding of control requirements and promoting alignment across departments.

Question Library

The Question Library provides comprehensive functionality for creating, maintaining, and organizing questions based on different categories or topics relevant to the organization's Governance, Risk and Compliance (GRC) objectives. It allows users to develop standardized sets of questions that can be reused across multiple surveys, ensuring consistency and accuracy in data collection.

The questions can be designed for following assessments:

• Control design assessment: These questions are used to evaluate the completeness and accuracy of the design effectiveness of a control.
• Subprocess design assessment: These questions are used to evaluate the completeness and accuracy of the design effectiveness of a subprocesses.
• Indirect entity-level control assessments: These questions are part of the survey to obtain sign-off on the effectiveness of the indirect entity-level controls from the organization owner.
• Self-assessment: These questions are part of the survey to obtain sign-off on the operating effectiveness of the control from the control owner.- Sign-off assessment: The organization or the corporate owner should respond to these questions before providing sign-off on the master data and assessment results.

The following answer types are available:

• Rating: Used when the control owner must provide a rating for a question on a scale of 1-5.
• Yes/No/NA: Used when the control owner must respond to the question with the options as yes, no, or not applicable.
• Text: Used if response expectation of the question is a detailed explanation from the control owner.
• Choice: Used if custom options are to be provided to the control owner to choose from the answer list.

Control design assessment and Self-assessment will be explained in the Unit Identifying the Key Capability: Perform and Monitor in more detail.

Survey Library

These surveys are strategically designed to evaluate various aspects such as operational risks, regulatory compliance, or adherence to company policies.

They are typically integrated into the Governance, Risk and Compliance (GRC) system and are utilized to conduct assessments across different business areas, from financial processes to operational activities.

The survey library in SAP Process Control serves as a repository of predefined survey templates, each crafted to address specific compliance or risk-related objectives. These templates are curated from a pool of questions stored in the Question Library, ensuring consistency and standardization in data collection.

When setting up a survey, it is essential to establish a clear naming convention and categorize questions based on relevant criteria. This not only streamlines the survey creation process but also helps in organizing and analyzing the collected data effectively.

Once a survey is created, it can be disseminated through workflow-driven processes, reaching relevant stakeholders such as process owners, compliance officers, or internal auditors.

The insights gathered from these surveys provide valuable feedback on the efficacy of existing controls, potential areas of improvement, and emerging risks. This information empowers organizations to make informed decisions, prioritize remediation efforts, and strengthen their overall governance and risk management practices.

There are three types of workflows in SAP Process Control:

1. Planner-Based Workflows

These workflows are usually associated with a schedule or frequency set up by a user using the Planner application. The Planner dictates when certain actions or processes run based on the defined parameters like timeframes, rules, or tasks. It arranges for tasks such as assessments, surveys, tests, and controls to be triggered at predetermined intervals. Planner-based workflows are commonly used in scenarios that require regular, repeatable actions. To ensure compliance, the confirmation of control execution and the effectiveness test are conducted as separate processes. The control execution is confirmed by an individual who is responsible for operational processes and control. On the other hand, the effectiveness test in the evaluation phase can only be performed by a person who is independent from the control execution.

Following Planner-Based Workflows are usable in SAP Process Control 

• Perform Control Design Assessment (optionally with Survey)
• Test Control of Effectiveness
• Perform Control Self-Assessment (optionally with Survey)
• Perform Policy (Acknowledgement; Survey; Quiz)
• Perform Risk Assessment for Financial Scoping
• Perform Manual Control Performance (optionally with Survey)
• Perform Subprocess Design Assessment (optionally with Survey)
• Perform Disclosure Survey (Org; Subprocess; Control) (optionally with Survey)
• Perform Indirect Entity Level Control Assessment ; Effectiveness (optionally with Survey)
• Perform Sign-Off (optionally with Survey)
• Aggregation of Deficiencies

2.Event-Based Workflows

These workflows are triggered by specific events occurring within the system rather than being tied to a pre-set schedule. An event could be a data change, a system status update, or the completion of another task. Once the specified event occurs, the workflow is initiated. Event-driven workflows are generally used for non-routine, unpredictable tasks that rely on specific system events or changes.

• Master Data Workflows (Notification / Approval)
• Issue and Remediation Workflows
• Repeat Evaluation Workflow

3. Scheduler-Based Workflows

These workflows are typically automated and run based on a scheduler within the system. They differ from Planner-Based workflows in that they are typically system-driven and less reliant on user input. Scheduler-based workflows might be applied to regular system maintenance tasks, report generation, or automatically updating and syncing data at fixed intervals. This will be in detail explained in the Unit "Identifying the Key Capability: Perform and Monitor".

In every workflow with an effectiveness rating, like test control of effectiveness, a mandatory check is in place to ensure that the user creates an issue if the control assessment, test, or sub-process assessment fails. This automatically initiates an issue workflow, which can be used to address the issue, implement corrective and preventive actions, or begin a remediation workflow. You will learn more about this feature in the Unit "Identifying the Key Capability: Evaluate".