Knowledge base / Analysis and remediation
Reading a finding
A finding is one user holding one risk. ClearDuty shows the evidence down to the authorization value, so the conversation with the business owner is about facts rather than t-code lists.
The row
The coloured stripe is the risk level. Scope says whether the conflict sits within one role (the role itself is unsafe — fix it once for everyone) or across roles (each role is fine; the combination for this user is the problem). Usage says whether both sides were really executed. Status says whether a valid mitigating control covers it.
Why it fires
For each side of the risk: the business function, the t-code the user holds, the role that grants it, and the authorization object, field and value that complete the match — including org levels such as company code. Objects that do not discriminate (for example a generic display check) are shown as context but never blamed.
How to fix it
Options are listed in order of effort:
- Remove one role — a single role removal that clears the finding without breaking the job.
- Trim an unused side — usage shows one side was never run.
- Narrow a value — a wildcard (
*) where a specific company code or activity would do. - Hand off or accept with a control — when the job truly needs both, move one duty to someone else or record a mitigating control with an owner and an expiry date.
Record the decision
Use the Remediation box: status, owner, due date and a note. It appears in the dashboard, in the remediation filter and in the audit pack.
Still stuck? Ask us — we answer within one working day.