That sentiment jived with a survey we recently conducted on SAP priorities on SearchSAP.com. Most of our readers said they weren’t using SAP’s GRC applications, either because they weren’t aware of them or they didn’t need them.

But Caldwell’s clients are finding that managing everything in Excel leads to “spreadsheet chaos,” he said. Therefore, he’s seeing more interest in buying one platform to automate these processes.

And to that end, they’re looking for something to manage both Enterprise GRC and IT GRC. Enterprise GRC software automates the process of collecting data related to risk and compliance. IT GRC applies controls around the infrastructure and validates the controls enabled by these applications are working properly.

SAP isn’t ready to meet all of their needs, but it took a step in that direction last week with a partnership announcement with CA.

SAP has steadily been boosting its GRC platform, Caldwell said. Last year, SAP enabled integration between the compliance management piece (controls and testing of controls) and the risk management piece (risk assessments are a very important part of planning and scoping where put compliance efforts)

Now, SAP’s looking at how improve the visibility and integration of both audit management and the policy management, Caldwell said. SAP’s doing the development work now, and the software should be in ramp-up by the end of the year sometime in 2011.

With CA, SAP plans to sell customers integrated tools to manage IT GRC and Enterprise GRC.

In turn, the partnership with CA is not exclusive – and that is a good thing. SAP customers already have other products to manage IT GRC — such as Symantec and McAfee — and SAP needs to make it easier to integrate with those products, Caldwell said.

Yet it’s still playing catch-up – vendors such as Oracle and best-of-breeds like OpenPages still lead the way.

But SAP’s making headway here – including against its “next largest competitor,” according to a blog by Michael Rassmussen.

“To date, Oracle has had the broadest ala carte GRC offering. But customers regularly complain to Corporate Integrity about the lack of integration between the breadth of Oracle GRC solutions. SAP and CA offer a deeper suite of GRC solutions but have already demonstrated interesting integration between critical products. If you consider SAP’s additional partnership with Greenlight Technologies – SAP extends into the Oracle environment for managing GRC.”

This week I spoke to Jeff Rishel, vice president of IT at Graham Packaging Co., a manufacturer headquartered in York, Pa., about his company’s GRC efforts. The company, which has 80 plants in 16 countries, has been an SAP user since 1999.

Rishel said that Graham purchased SAP Virsa in the early 2000s to help with Sarbanes-Oxley compliance. But even with Virsa, he said, there was one big problem: His team still had to gather all the information manually from various sources to give to the auditors.

Graham eventually replaced Virsa with ControlPanelGRC from SymSoft Corp.,  hoping to reduce the time spent on audit preparation, attain better SOX compliance and to streamline the Segregation of Duties (SOD) process.

All three goals were accomplished. The two weeks spent preparing for the audit process was reduced to one, and Rishel said that he personally no longer has to spend two hours a month doing SOD reporting. Much of the savings in time are because of the workflow engine embedded in ControlPanelGRC. The engine automates not just SOD but many IT business processes, allowing repetitive manual tasks to be done automatically with a workflow that tracks who requested changes, who developed, who tested, who approved, etc.

But the product has other features, including a bunch of utilities that make the day-to-day lives of security administrators and SAP technical administrators easier. “It’s not software you dust off once a year to get through an audit,” said Dan Wilhelms, president and founder of SymSoft, and a leading Basis consultant.

At SAP TechEd 2009, I attended a session on compliance tips for security administrators given by Maria Jenkins, SAP’s GRC senior technical architect. During her presentation, she said, “Auditors are like accountants, they always say, ‘Show me the money.’” She went on to say that there’s really only one way to keep the auditors happy, and that’s documentation. “Documentation is the most important thing that a security administrator can provide for SOX and security compliance.”

I asked Rishel about that, and he agreed that documentation is vital. “If we have SODs we can’t resolve, they require a lot of documentation,” he said.

SAP recently announced that it will work more closely with Novell to extend GRC to more of the IT infrastructure. If you’re an SAP security administrator, what do you think of that? I’d like to hear from other SAP administrators about the GRC issues they’re facing.