October, 2009

Automated GRC management for SAP security administrators

Producing the records that auditors need in order to certify a company’s books and its processes can take up to months if done manually. Automated governance, risk and compliance (GRC) management solutions offer two major benefits: they can substantially reduce the cost of an audit, and auditors tend to look less deeply into automated record reports.

This week I spoke to Jeff Rishel, vice president of IT at Graham Packaging Co., a manufacturer headquartered in York, Pa., about his company’s GRC efforts. The company, which has 80 plants in 16 countries, has been an SAP user since 1999.

Rishel said that Graham purchased SAP Virsa in the early 2000s to help with Sarbanes-Oxley compliance. But even with Virsa, he said, there was one big problem: His team still had to gather all the information manually from various sources to give to the auditors.

Graham eventually replaced Virsa with ControlPanelGRC from SymSoft Corp.,  hoping to reduce the time spent on audit preparation, attain better SOX compliance and to streamline the Segregation of Duties (SOD) process.

All three goals were accomplished. The two weeks spent preparing for the audit process was reduced to one, and Rishel said that he personally no longer has to spend two hours a month doing SOD reporting. Much of the savings in time are because of the workflow engine embedded in ControlPanelGRC. The engine automates not just SOD but many IT business processes, allowing repetitive manual tasks to be done automatically with a workflow that tracks who requested changes, who developed, who tested, who approved, etc.

But the product has other features, including a bunch of utilities that make the day-to-day lives of security administrators and SAP technical administrators easier. “It’s not software you dust off once a year to get through an audit,” said Dan Wilhelms, president and founder of SymSoft, and a leading Basis consultant.

At SAP TechEd 2009, I attended a session on compliance tips for security administrators given by Maria Jenkins, SAP’s GRC senior technical architect. During her presentation, she said, “Auditors are like accountants, they always say, ‘Show me the money.’” She went on to say that there’s really only one way to keep the auditors happy, and that’s documentation. “Documentation is the most important thing that a security administrator can provide for SOX and security compliance.”

I asked Rishel about that, and he agreed that documentation is vital. “If we have SODs we can’t resolve, they require a lot of documentation,” he said.

SAP recently announced that it will work more closely with Novell to extend GRC to more of the IT infrastructure. If you’re an SAP security administrator, what do you think of that? I’d like to hear from other SAP administrators about the GRC issues they’re facing.

Jon Reed: SAP to start paying more attention to R/3 users

Checking in from SAP TechEd 2009

The SearchSAP.com team has been here at SAP TechEd 2009 in Phoenix since Monday, covering the conference and talking to SAP users from all around the world. Despite the dry technical subject matter (which goes well with the dry heat outside), attendees have been enthusiastic about what the future offers for SAP - and technology in general.

The keynote set the tone. As you’ll read in coverage from Site Editor Peter Bochner, SAP executives talked about “timeless software” and the importance of being ready for change - and futurist and inventor Ray Kurzweil provided some inspiration about the logarithmic pace of change over the course of history.

After the keynote, we got a press briefing on announcements from SAP about two new partnerships - or well, extended partnerships. SAP is working more closely with Novell on integrating GRC products. It’s also getting cozy with HP in data warehousing - the two companies are currently developing a major data warehousing platform with SAP BW running on HP’s Neoview data warehousing platform. At a session on the SAP-HP deal, attendees had tons of questions while speakers had some answers. I think this will be an interesting area to watch.

Tuesday night was my first experience with “DemoJam.” Introduced as “American Idol for Geeks,” the contest pits innovative application demos against each other and the winner is chosen by crowd reaction. While our SearchSAP.com assistant editor Matt Perkins focused on the visuals from the event (check out our DemoJam coverage and pictures), I roamed the standing room area talking to people about their favorite demos. No doubt the open bar contributed to the rowdy support many attendees gave their favorite demos. I have to say - picking the winner was not difficult. Using a beer keg as a prop was bound to take home the trophy!

Most of all, I really enjoyed talking to people. We met people from all across the U.S. - and across the globe. We learned about the BI plans at a sugar distributor and the manufacturing IT updates going on at a corn products manufacturer. I heard about SAP consolidation at a luxury car maker, and expanded use of Solution Manager at an oil and gas company. I learned about how SAP is used by a European grocery chain and got an update on SAP in the Netherlands — along with a lunchtime tutorial on how to say goodbye in Dutch.  And on that note, before I ramble on too much about all the great people I met here at TechEd — Tot ziens to my Dutch friends and goodbye to all from Phoenix!

What’s next for SAP sustainability?

Last month, SAP was named the highest-ranked software company in the 2009 Dow Jones Sustainability Indexes for the third time. This is good news for SAP, but hardly surprising, given SAP’s focus on sustainability and endorsing a “green” life.

This past May, SAP outlined its sustainability strategy at Sapphire in Orlando. The vendor explained how its approach to ‘going green’ focuses more on the business benefits rather than the environmental benefits alone.

If it’s the business benefits SAP is interested in, things should roll out nicely, at least according to a new report by IDC Manufacturing Insights titled Seeing the Business Benefits of Sustainability: Revenue, Profit and Inventory Management.

Continued »

Does SAP have to give away CRM?

I’ve covered SAP as a reporter and editor for over four years, and the CRM market in particular for six

So I took more than a little interest in recent reports that SAP is giving away CRM licenses. Of course, as several have noted, there’s FreeCRM and there’s free CRM and this is neither. Don’t forget to read the fine print, Thomas Walgium wrote. Free software isn’t really free, Ray Wang chimed in.

First and foremost, customers are still paying maintenance on the licenses, a not inconsiderable cost. Continued »