Upgrading to SAP GRC 12: Down to the Wire

We are just weeks away from the SAP GRC application reaching the end of its mainstream maintenance on December 31 of this year (see illustration below).  Organizations who are running Access Control, Process Control or Risk Management 10.x should be upgrading to GRC 12 now; otherwise, the consequences for not upgrading could include entering the extended maintenance period or customer-specific maintenance (which often equates to higher fees). As a reminder, after the maintenance period ends, companies will not be able to log support incidents for the 10.x versions, however, but  will still be able to search the SAP Support Portal to find existing issues and solutions.

Referenced from SAP Product Availability Matrix (requires login)

Back in March, we wrote about upgrading to GRC 12 and taking advantage of the opportunity to optimize the use of GRC.  As we are down to the wire on the maintenance window, we have clients who are opting to first perform a “technical upgrade” to get up-to-date as quickly as possible and then planning for optimization later in 2021. Organizations choosing to go with the technical upgrade first should consider allocating enough time and resources to perform the necessary regression testing. This may sound like a large burden, but with the right skillset and documentation, is something that can be easily accomplished.

Organizations in this boat should follow the organization’s systems development life cycle, including ensuring there is adequate project governance and documentation.

Some of the key areas to consider include ensuring appropriate resourcing, time commitment and coverage of the following areas:

• Project management – includes establishing project plan, timeline, key milestones, task owners and coordination between key stakeholders
• Regression testing script development
• Regression testing execution and support

Often, auditors classify GRC systems as critical to the organization (due to the processes it impacts, such as user provisioning, assignment of temporary elevated access and reporting on segregation of duties/sensitive access), so it is no coincidence that implementations and upgrades related to GRC software are selected for SDLC audits.  When we know this is the case, we want to make sure we have all our i’s dotted and t’s crossed!

If you are interested in discussing this topic further, please contact us directly.

Visit Protiviti’s SAP consulting services page for more information on our solutions.