Knowledge base / Analysis and remediation
Rulesets
ClearDuty ships 89 built-in conflict rules as a starting point. Most companies should load their own ruleset or their SAP GRC export, so the result matches their control framework.
Format
One row per condition: risk → function → action → permission. Values are separated by |.
| Column | Meaning |
|---|---|
RISK_ID, RISK_DESC, LEVEL | The risk and its level: critical, high, medium or low. |
FUNCTION_ID | One side of the risk. |
ACTION | The t-code. Leave blank for a critical permission with no transaction. |
OBJECT, FIELD, VALUE | The authorization values that make the action usable. |
GENERIC | Marks non-discriminating objects: shown, never blamed. |
GROUP | Marks alternative permissions: any one of the group is enough. |
ORG_LEVEL | For example BUKRS: the risk fires only when both sides share an org value. |
ACTIVE | N marks a risk as not applicable. |
Importing from SAP GRC
Export functions and risks from Setup → Access Rule Maintenance. GRC's own column names are recognised automatically.
Not applicable rules
A rule that does not fit your company — for example a payroll risk when payroll runs outside SAP — is switched off with a reason. It stays listed and is reported in the audit pack as an exclusion, never quietly deleted. Auditors expect to see what was excluded and why.
Approval
On the Audit tab, record the ruleset version, the approver and the approval date. It is one of the twelve readiness checks.
Still stuck? Ask us — we answer within one working day.