2
Introduction
Simone RebaDefense Logistics Agency
Deputy Director, DLA Finance
Bob ThorsonAccenture Federal Services
Manager, Management
Consulting and GRC Solutions
Steve BrownUS Army/PEO EIS
Director, GFEBS Sustainment
Copyright © 2015 Accenture All rights reserved. 3
Governance, Risk, and Compliance
Oversight
Governance Risk Compliance
GRC Technology and Enablement Tools
Globally manage the GRC program and ensure synchronization between information and
activities
Ensure that critical
management information is
sufficiently complete,
accurate, and timely to enable
appropriate management
decision making, and provide
the control mechanisms and
policies to ensure that
strategies and directions from
management are carried out
systematically and effectively
Manage risks to the business
by assessing, evaluating and
responding appropriately to
risks that might adversely
affect realization of the
organization's business
objectives
Identify applicable
requirements (laws,
regulations, strategies and
policies), assess the state of
compliance and potential
costs of non-compliance
against the projected
expenses to achieve
compliance, and hence
prioritize, fund, and initiate
any corrective actions
deemed necessary
Implement GRC tools to automate GRC reporting and reduce labor required for compliance
5UNCLASSIFIED:
Agenda
■ GFEBS
■ Why GRC Was Chosen
■ GFEBS Journey to GRC Controls
■ Segregation of Duties Lessons Learned
■ Privileged Account Management (Firefighter)
■ Policies
■ In the Middle Came FISCAM
■ GRC in support of audit
5
6UNCLASSIFIED:
Why a General FundEnterprise Business System?
■ Congressional directives including:
– Federal Managers Financial Integrity Act of 1982
– Chief Financial Officers (CFO) Act of 1990
– Federal Financial Management Improvement Act (FFMIA) of 1996
– Other statues
■ US Army leadership needs:
– Leaders and managers need to make well-informed decisions
– Most decisions impact across many functions and organizations
– Well-informed decisions require analysis based on relevant, accurate,
integrated and timely data from many functional areas
• US Congress requires auditable financial documents
• Army leaders and managers require high-quality
decision support information
7UNCLASSIFIED:
Army’s General Fund Enterprise Business System
7
~150B obligated per year
53 appropriations (Army and DOD)
5,500 regulatory requirements,
standards, attributes and rules
51 partner systems and 151 unique
interfaces
33,000 active users
8,400 unique user roles
200,000 transactions/day and ~66
million transactions in FY14
215,000 civilian employees -- payroll
processed biweekly
Includes –
– 29 Army commands + 1 non-Army
Command with full functionality
(DHA/NCR MD)
200+ locations in 71 countries
■ Funds Management– Distribution of General Funds
– Budget management and execution
■ Spending Chain– Initiate purchase requisition, approve funds,
record obligation, manage receipts and process disbursements
– Includes Def. Medical Logistics Standard Support (DMLSS) interface
■ Reimbursables– Execute full order to cash life cycle
– Process accounts receivable
■ Property, Plant and Equipment– Real Property, Plant Maintenance,
Equipment and Assets, and Project Systems
■ Cost Management– Full cost capability and civilian payroll
■ Financials– General Ledger accounting (USSGL)
– Financial statement reporting to departmental level
– Month end/ Year end closing process
Enter & Distribute
Funds
Execute & Record
TransactionsConsolidate & Report
8UNCLASSIFIED:
Why was GRC selected?
■ Initially, GFEBS was using a manual provisioning process
– User role assignment process was ‘manual’ using MS Excel spreadsheets
– Provisioning authorization approvals were managed via email for: i.) Role eligibility, ii.) Security
Manager verification, and iii.) Training completion
– Segregation of Duty (SOD) conflict analysis was performed at the role level
– Updates to user role assignment were processed through Helpdesk tickets
■ GFEBS PMO realized the manual process was not sustainable
– Initial release to ~250 users was complex with management by spreadsheets
– Complexity was reinforced with the second deployment to 1,200 users
• Only 20% of users were provisioned before go-live
– Implemented GRC to facilitate deployment activities
• Automated the DD 2875 process through workflow approvals
• Automated an interface to the Army’s Learning Management System (ALMS) to confirm training
completion and auto-provision the user roles
8
Deployment Challenge: Manual provisioning was time intensive and
required extensive document management for auditability
Over 50,000 users have been processed through GRC
9UNCLASSIFIED:
Other GRC Benefits
■Manages routing to designated approvers and maintains all approvals including user ID,
date/time stamps, and action performed within an audit log
■Verifies Credentials: Integration with AKO LDAP to confirm user credentials
■Auto-approval of Training Coordinator requests in which training is complete in Army
Learning Management System (ALMS)
■Upon workflow completion, role assignment changes, including additions and deletions,
are automatically performed in SAP
■GRC Request are analyzed for SOD conflicts – only requests with approved ‘waiver’
recorded
9
10UNCLASSIFIED:
GFEBS Journey to GRC Controls
10
Initial GFEBS Program
Deployment
Full GFEBS Deployment
Additional System
Controls
Operations & Maintenance
• Manual collection
of 1,000s of users
and roles
• Collection and
storage of email-
based approvals
• Large volume of
manual interaction
Challenge Identified:
Documentation &
Large Volume
• Workflow based
solution to manage
access controls
• Central repository of
approvals for user
access to automate
DD- 2875
Solution Identified:
Implement Automated
GRC Access Control
• Implement solutions
for Segregation of
Duties (SODs)
• Manage critical
access through
restricted roles and
critical transaction
monitoring
Solution Expanded:
Leverage Additional
GRC Controls
• Enable role
assignment
changes
• Perform user
account
reaffirmation
• Utilize privileged
management
monitoring
Solution Maintained:
End User Self-Service
GRC SOD ApproverGRC Role
ApproverGRC Supervisor
Identify GFEBS
Users
Assign GFEBS
Roles to Users
Resolve SoD
ConflictsApprove
GFEBS Roles
Verify
Background
Investigation for
GFEBS Users
Validate
Training
Completions
Provision UserSAP Secuirty
GRC Security
Manager
GRC Training
Coordinator
System
Administrator
11UNCLASSIFIED:
Segregation of Duty (SOD):Lessons Learned and Process
11
Implementation Schedule
• Implemented system automation after
approximately 15,000 GFEBS Users
• Analyze standard SOD ruleset and
customize for Army business operations
• Implement multiple GRC Risks at ones
to prevent Site / Command re-work • Iteratively for ~2 years on GFEBS
• Use tools to accelerate remediation
(e.g., Role Conflict Matrix)
Flag User with SOD
Conflict
(Report or Workflow)
Site /
Command
Request SOD
Waiver
Apply
Mitigating
Control
Army
Approval
• Weekly Monitoring
• GRC Request
Workflow
Remove
Role
No
Yes
Monitor
Mitigating
Controls
Identify
System
Change
Yes
Confirm Role
Removal
Confirm
Conflict
Removed
Update GRC
Risk Ruleset
Update SAP
Role Design
• Review role design to determine if there
is risk to the business process
• Work closely with business process
stakeholders to confirm impact to
business operations
• Enforce strict process for approval and
management of SOD waivers • Requires Deputy Assistant Secretary of
the Army for Financial Operations
(DASA-FO) approval
Monitor
Remediation
(30-day Notice)
Define &
Implement
SOD Rule
Conflicts
Risk Approval & Mitigation
12UNCLASSIFIED:
Privileged Account Management (Firefighter)
12
GRC toolsets enable management of critical access defined by the Army
organization and monitoring for unauthorized activity
Firefighter Account Management
• Used for the execution of business activity and
system maintenance activity by GFEBS
Support Staff
• Logs activity performed during execution
of SAP T-Codes
• High risk transactions are managed in
Firefighter accounts and assigned with
GFEBS Project Manager approval
• Activity logs are pulled by the Service
Management team and sent to leadership for
review
• Note: Automated email logs are
recommended from an audit perspective
• GFEBS team members are assigned one
Firefighter ID (not typical practice)
Critical Access Review & Monitoring
• Define “Least Privilege” by creating separate
GRC risk rulesets for critical transactions based
on organizations
• System Administration
• Army Functional Owner
• Army Cost & Economics
• Review is identified as a detective control for the
GFEBS system, not preventative like SODs
• Tailor risks based on SAP Transactions and
Authorizations
• Process Payment Certification (F110) with
‘execute’ as opposed to ‘view’
• Execute analysis at a User and Role level
13UNCLASSIFIED:
Policies
13
Deploying a GRC framework requires more than “just a tool”
Policies & procedures must be deployed in parallel to provide instruction and
responsibilities to the user community.
Policies & Procedures
• Policy documents for internal program management and end users
• All GFEBS application provisioning is performed through the GRC tool
• Army Sites / Commands are instructed to use GRC tool to manage all access changes,
including responsibility for terminations and transfers
• Extensive procedure documents were created
• Training was provided on the use of the GRC tool and responsibilities of the user community
14UNCLASSIFIED:
Policy Related Controls
• Alternative workflow path identifies the Role Owner
and injects additional oversight into the end-to-end
provisioning process for critical access
• Example roles include• Payment Certifier (F110): DFAS
• General Ledger Data Master Maintainer: DASA-FO
• Funds Execution Controller: Army Budget Office (ABO)
• Control Accounts: DASA-CE
• Other roles as needed (PII, sensitive data, etc.)
• System Admin Roles: GFEBS PMO
• Clean-up was required because we didn’t implement
at the beginning
Restricted Role Approval
• Requires Site / Commands to reapprove
user role assignments on an annual
basis
• Required per FISCAM Guidelines
• Procedures may elect to expire role
assignments if not reapproved
Annual Role Re-Affirmation
15UNCLASSIFIED:
And in the Middle Came “Federal Information System Control Audit
Manual (FISCAM)”
■ Established by the Government Accountability Office (GAO) as a methodology for performing information systems
control audits of federal & other governmental entities in accordance with generally accepted governmental auditing
standards
■ Every system with a financial component will be subject to FISCAM
■ Categorized into General and Application level controls
General Controls Application ControlsControl activities that are applied across all IT systems
that the organization relies upon.
Control activities that ensure the completeness, accuracy
and validity of transaction data within a system.
Data Management• Storage
• Cryptography
• Data Reporting/
Extraction
System Interfaces• Data Exchanges
• Exception Reporting /
Handling
Business Process• Master Data
Setup/Maintenance
• Transaction Data
Application Security• User Authorization
• Audit Logging /
Monitoring
Access Controls• ID/Authentication
• Physical Security
• Incident Handling
Security Management• Policies / Procedures
• Risk Assessment
Contingency
Planning• Disaster Recovery
• Business Continuity
• Backups
Segregation of
Duties (SODs)• User Access
Provisioning
Configuration
Management• Change Management
• System Testing
Example FISCAM Control Activity
addressed with GRC tool
16UNCLASSIFIED:
GRC in Support of the Audit
■GFEBS worked closely with the Audit component (DASA-FOA) within ASA(FM&C) for conducting pre-
audit examinations
– Realized the value of GRC with regard to audit compliance, especially in the area of provisioning
– Identified gaps with Segregation of Duties and Critical Access which the program worked to resolve
■Pre-audit examinations identified additional actions to be performed using the GRC tool
– Implementation of SODs and Critical Access required refinement and documentation
• Authorizations were found in roles which were not expected
• SODs were identified through the unintended coupling of authorizations across roles
• Months were spent reducing access within individual roles to better align with least privilege
– Use of Firefighter module enabled the program to track critical activities performed by support staff
• Implemented “points system” for undocumented / unallowed use of privileged accounts
• Procedures outline the documentation requirements for use of elevated access
■To this day, GFEBS continues to perform ‘clean-up’ activities to further strengthen the security posture
of GFEBS
– Redesigning Firefighter access based on 2 years of usage history
– Continuing to refine the restrictions for System Administration access to remove ‘unnecessary’
access
– Further separate roles between teams and remove transaction codes that are rarely used or not part
of controlled business process
16
17
DEFENSE LOGISTICS AGENCYAMERICA’S COMBAT LOGISTICS SUPPORT AGENCY
WARFIGHTER SUPPORT ENHANCEMENT STEWARDSHIP EXCELLENCE WORKFORCE DEVELOPMENT
1818
DLA’s Mission, Vision, and Values
Mission
America’s Combat Logistics Support Agency, the Defense Logistics
Agency (DLA) provides effective and efficient worldwide support to
Warfighters and other customers
Vision
Warfighter-focused, globally responsive, and fiscally responsible supply
chain leadership
Values
– Warfighter’s needs guide DLA
– Integrity defines DLA
– Diversity strengthens DLA
– Excellence inspires DLA
1919
What is DLA?
DLA is the largest agency within the DoD
Provides technical and logistics services to military services and several
agencies
Supplies almost every consumable item military services need to
operate, from food to fuel
FY15 DLA Statistics
Military and civilian personnel (48 states and 28 countries) ~25,500
Items managed in 9 supply chains ~6M
Requisitions per day ~98,000
Contract actions per day (new awards and mods) >9,000
Annual Revenue $38B
Weapon systems supported ~2,400
Distribution centers managed worldwide 25
Support items annually for 110 nations $2B
2020
Enterprise Business System (EBS)
EBS is DLA’s enterprise approach utilizing necessary leading edge technology, to allow DLA to focus on its core business
• Re-engineered and transformed
how DLA does business
• Enables DLA to consistently
deliver new capabilities,
minimizes transition risk to DLA
and the warfighter
• Integrates all enterprise system
capabilities
• Financial system of record
• Single face to customers, suppliers,
and external stakeholders
SAP HANA
SidecarSAP BW SAP CRM SAP SRMSAP SCM
EBS
Encl
ave
Greenlight/Laserfocus
JDA ManuSAP ECC
Enterprise Portal (Internal) - SAP Enterprise Portal , Role, Navigation
Web/Application Services/SOANetweaver/WAS, SAP PI WS, BEA Web Logic,Tomcat
Terminal ServicesCitrix (SAPGUI, BEX)
Smart FormsAdobe
External Portal Direct
Web ServicesMicrosoft IIS
Access Controls
Process Controls
Risk Management
GRC
2121
• Eliminate or mitigate Segregation of Duties violations within the System Access Profiles (Job Role)
• Establish enterprise process to prevent recurrence of violations with future access profile maintenance or creation
• Guard against employee fraud, abuse, mistakes, and mistake cover-ups
• Implement a tool to manage risk, reduce costs, and minimize complexity to support day-to-day management efforts across DLA
• Pass FISCAM and Internal Controls A-123 audit
GRC Audit Readiness Goals
2222
GRC Implementation Timeline
June 2013: Established enterprise access control processes & procedures
March 2014: SAP GRC Access Controls identifies and monitors risks for enterprise systems based on enterprise SoD ruleset
June 2014: Implemented Emergency Access Management (EAM) for IT Production Support users
June 2015: Redesigned end user system access to remove or mitigate SoD violations
July 2015: Established ongoing monitoring of critical roles with SoD violations using Access Violation Management (AVM)
In Process: Implement SAP GRC Process Controls
and Risk Management
23
SoD Rule Set and Violations Analysis
SoD Violations Analysis
High RisksMed. Risks
Low Risks Total Risks
Critical Transactions
Order Fulfillment 2,825 1,033 0 3,858 261
Procurement 2,973 3,436 16 6,425 198
Tech Quality 510 1,543 42 2,095 190
Planning 376 444 0 820 17
Real Property 15 57 0 72 66
Finance 4,633 8,060 31 12,724 794
CRM 2 50 0 52 29
Total – User JDs 11,334 14,623 89 26,046 1,555
CRM0%
Real Property
0%
Planning3%
Tech Quality
8%
Order Fulfillment
15%
Procurement25%Finance
49%
SoD Violations Analysis
High RisksMed. Risks
Low Risks Total Risks
Critical Transactions
Sustainment 24,736 33,098 21 57,849 772
DLA’s Segregation of Duties (SoD) Enterprise Rule Set
• Defined 268 Business function risks defined in the rule set (approximately 65,000
transaction level risks)
• Identified 237 Critical transactions. These transactions, by themselves, provide a user with
extra-ordinary or high-risk access
24
Decision Tree for End User SoD Conflict
Cleanup/Mitigation
Access conflict identified
Can the conflict be eliminated by removing access to one of the conflicting transactions?
Can the Job/Role be broken up into multiple Roles to eliminate the conflict?
If BPA, can access to the conflicting transaction be removed from the Job/Role and accessed via a designated Firefighter on an emergency/infrequent basis?
Yes, one transaction not
needed to perform roleRemove transaction from Role
No, both conflicting transactions
are needed to perform role
Yes, multiple roles can be
created to separate
conflicting transactions
among users
No, same user needs to be
able to perform these
conflicting transactions
Yes, access to one of the
conflicting transactions is
infrequent (<5/month)
* No, not BPA or user will access both of
the conflicting transactions frequently
(>5/month)
Create LaserFocus monitoring report to monitor user access or other mitigation action
Break up Job/Role into multiple Job/Roles
Have access to the transaction via Firefighter
Jobs, Training, Communications updates
25
SoD Role Redesign
EBS Production Support Role Redesign
• Production Support redesign created a 70% reduction in primary roles
• SAP’s Emergency Access Management (aka Firefighter) was
implemented to manage and monitor emergency access needed to
perform extra-ordinary system maintenance and/or data updates in the
EBS Production environment
• 38 Firefighter roles set up by business function to reduce SoD
violations and limit access to sensitive data (SSNs, for example)
EBS End User Role Redesign
• Over 200 End User job roles for Finance, Procurement, and Order
Fulfillment were redesigned
• All SoD violations were removed or had a mitigation strategy designed
2626
ECRT (Front Door)
Insert Audit Readiness Role(s)
Insert Audit Readiness
User Role(s)
Posting Logic Library
ARIS/ERwin Model Mart
DLA Audit Sustainment Operational Concept
(AS-IS)
GLACs, Controls
Functions, Interfaces, Systems, System Exchanges, Organizations,
Activities, Capabilities
ACLR
Evidential Matter
Repository
DACS-RM
ProSight
Portfolio Management
Registry
Visualization
(does not exist)
Visual Analysis and Discovery
EA Tool Suite
(Manual) CAPS/SCR Data
Evidential Matter
Controls Database CAPS/SCR Database
Controls, Processes
Controls, PCMs
PCM Content Database
Control Data, Deficiencies , PCMs
1) Enterprise Architecture
Repository
2) Process Models
Track progress of SCRs,
Deficiencies and CAPs
Manage Controls and
Testing
Relates Controls, PCMs
and Systems
Controls, Processes, Activities, Data
Capabilities, Systems, Mission Area
EBS
Official Repository of
Evidential Matter
Roles and Responsibilities
(SOD)
LEGENDPotential , not consistent
Relationship Identified, Process Established (automated, manual or combination)
Business Rules, Functions, System Exchanges, Tables, Controls, GLACs
*EA Metadata includes a variety of “all” architecture objects
Cost Centers, Fund
Centers, Controls, EA Metadata*
2727
Process Controls and Risk Management
• The objective is to implement a tool to manage risk, reduce costs, and
minimize complexity in its management and compliance functions by
collecting, aggregating, analyzing, and reporting a wide variety of management
information
• The objective is risk management and internal control reporting supported by
use of day-to-day management efforts across DLA through an enterprise-
wide automated solution that provides:
• A strategic capability to improve and enhance risk management, internal
controls assessment, management review, and assurance reporting activities
• A decision support tool to enable more informed leadership decision making via
use of integrated information
• A means to reduce the cost & effort of compliance activities and increase the
confidence in internal controls
• A mechanism to facilitate collaboration across functional silos
2828
Here’s How We Identify Risk
Hire, develop, and retain a high-performing, valued, resilient, and
accountable workforce that delivers sustained mission – Goal 2Hire, develop, and retain a high-performing, valued, resilient, and
accountable workforce that delivers sustained mission – Goal 2
Hire, develop, and retain a high-performing, valued, resilient, and
accountable workforce that delivers sustained mission – Goal 2
High
Low High
IMP
AC
T
LIKELIHOOD
1,
14
2, 3, 4,
6, 10,
13,
5, 9, 11
1 3 5 7 9
3
5
7
9
1
8
7
12
Enterprise Risks
1Inability to adapt to constantly and evolving mission threat environment
2 Industrial Base Degradation
3 Degraded Network Availability
4Improper handling or release of controlled materials
5 Scarcity of Raw Materials
6Disruption of capabilities due to contract/contractor transition
7 Loss of Auditability
8 Loss of positive cash flow
9 Sub optimization of Resources
10Inability to recruit, retain, develop “the right” workforce to support DLA mission
11 Focus Change MGT and Culture
12
Inability to adapt to constantly and evolving personnel and physical infrastructure threat environment
13 Natural Disasters
14 Customers do not see DLA as the first choice
28
Enterprise Risk Profile Heat Map
2929
End-to-End Compliance Process Management
Perform Self-
Assessments
Test Automated Controls Test Manual Controls
Do
cu
men
tT
est
Mo
nit
or
Cert
ify
Certify and Sign-off(A-123, Designs,…)
Process-Control-Objective-Risk
IT Infrastructure
Business Processes
…
Review Exceptions Remediate Issues
1
13
45
6
910
11 12
1516
1718 19
78
1314
2223
24 2526
2021
2930
2728
2
Integrated Compliance
One system for end-to-end
financial compliance process
Flexible, configurable set-up with
complete audit trails
Enterprise-wide visibility into risks
and controls
3030
EA Tool Suite
DLA Audit Sustainment Operational Concept (with GRC)
GRC
ECRT (Front Door)
Controls, Processes, Activities, Data
Functions, Interfaces, Systems, System Exchanges, Organizations, Activities, Capabilities
GLACs, ControlsPosting Logic Library
Business Rules, Functions, System Exchanges, Tables, Controls, GLACs
Controls, Processes, Activities, Data
1) Enterprise Architecture
Repository
2) Process Models
2) Portfolio Management Registry
3) Visual Analysis
Manage Risks, PCMs,
Controls, Testing and
Evidential Matter, Track
progress of SCRs,
Deficiencies and CAPs
Evidential Matter
Repository
DACS-RM
EBS
Official Repository of
Evidential Matter
Evidential Matter
Controls, Risk Management Data
Roles and Responsibilities (SOD)
Cost Centers, Fund
Centers, Controls, EA Metadata*
*EA Metadata includes a variety of “all” architecture objects
Processes, Controls, Organizations, Relationships, Functions, Activities, Models
LEGENDPotential , not consistent
Relationship Identified, Process Established (automated, manual or combination)
31
GRC-Process Controls/Risk Management
- Organization View
Significant
Account
CAP
(Remediation)Test Plans
(ToD/ToE)
Controls
Risk/Control
Objectives
DLA Director
J5/J8
Assessable
Unit/
EBCO
Organizational View
(Certification)Account Hierarchy Process / Risk / Control Hierarchy
Assessments
J Code/ PLFA
Dir/Comm
Process
Sub-process
Account
Groups
Deficiency
(Issue)
Business Process end-to-end view:
A-123 Attestation (Sign-off)
Enterprise view:
The DLA Organization GRC-PC/RM
DLA Director
J5/J8
J Code/ PLFA
Dir/Comm
MICASub Assessable
Unit
32
Continuous Controls Monitoring (CCM)
Continuous Controls Monitoring allows automated testing of system based
controls
- Exceptions reported automatically and continuously
- Reduces labor required for audit compliance
- Provides transaction, master data, SoD, and configuration monitoring
34UNCLASSIFIED:
What issues did GRC uncover
within your business?
■Excessive Access within Roles
–Required roles to be ‘split’ in order to pass Segregation of Duties
–Required the GFEBS Operations & Support Team to limit access
–Roles has authorizations which were excessive or unused for the intended
activities of the role
■Management of Roles within Production Landscape
–Review and clean-up of roles migrated to production was required
–Confirm that development roles did not exist within Production
■Developed Reaffirmation requirement
–Policy is for annual review of roles
6/21/2016 34
35UNCLASSIFIED:
What are some of the biggest challenges
implementing Access Control?
■Initial deployment of the system roles had minimum SODs controls in place
–Developed plan to bring in SOD controls over time
–As SODs were identified, we created an approach to eliminate the SODs for
the deployed users
•Two year process - 10k users at a time to remediate new role changes
•Allowed 90 days for existing users to eliminate SODs once new SODs
implanted in the system
•Implemented SODs prior to the next roll out for the next wave
■Segregating out the firefighter access and internal roles
–Change in approach for operations for break fix and emergency fixes
•Separated roles into teams to eliminate SODs
•Created check out roles and review processes by use
–Critical roles have time limits for use and greater oversight
6/21/2016 35
36UNCLASSIFIED:
How did you combat pushback
from the business?
■Really translates into running the business
■Initially– OP ORD from the Chief of Staff of the Army
– ASA(FM&C) support
• SOD approvals by DASA-FO - Strictly enforced
– Functional forums
– News letters
– Management Briefings at the two star level
■On-going– Joint Review Program
– Tier II direct support – moved after deployment to ASA(FM&C)
• Included audit needs
• Included GRC role approvals
– ASA(FM&C) policies on IDOC error resolution and turn around time
– Putting in recycle programs to reduce site manual efforts
– Secretary of the Army is making audit one of his top priorities
6/21/2016 36
37UNCLASSIFIED:
What do you most look forward to in the solution?
■GFEBS is currently working closely with another PEO/EIS Program,
AESIP, to develop a joint use GRC 10.1 upgrade
–One instance for these ERP systems
–Could enable verification across Army ERPs for SODs
■GRC 10.1
–Has out of the box solutions for reporting and remediation
–ABAP code allows for more flexibility
–Will enable a better user experience – easier to maneuver through the system
–More auditable for GRC 10.1 itself
6/21/2016 37