Knowledge base / Analysis and remediation
Rulesets
Findings are calculated from the ruleset you load: your own, or your SAP GRC export. ClearDuty provides a template with the exact columns and a sample ruleset to start from. Separately, the Role designer and Access lookup apply 89 built-in good-practice activity pairs when you design or check access.
Format
One row per condition: risk → function → action → permission. Values are separated by |.
| Column | Meaning |
|---|---|
RISK_ID, RISK_DESC, LEVEL | The risk and its level: critical, high, medium or low. |
FUNCTION_ID | One side of the risk. |
ACTION | The t-code. Leave blank for a critical permission with no transaction. |
OBJECT, FIELD, VALUE | The authorization values that make the action usable. |
GENERIC | Marks non-discriminating objects: shown, never blamed. |
GROUP | Marks alternative permissions: any one of the group is enough. |
ORG_LEVEL | For example BUKRS: the risk fires only when both sides share an org value. |
ACTIVE | N marks a risk as not applicable. |
Importing from SAP GRC
Export functions and risks from Setup → Access Rule Maintenance. GRC's own column names are recognised automatically.
Not applicable rules
A rule that does not fit your company — for example a payroll risk when payroll runs outside SAP — is switched off with a reason. It stays listed and is reported in the audit pack as an exclusion, never quietly deleted. Auditors expect to see what was excluded and why.
Approval
On the Audit tab, record the ruleset version, the approver and the approval date. It is one of the twelve readiness checks.
Still stuck? Ask us — we answer within one working day.