PolicyManager vs. SAP Process Control

The part I like the most is our staff not having to log in to view policies. We have so many passwords to remember having this convenience is a big satisfier.

SAP Process Control is well suited for managing the end to end lifecycle of controls across different regulations. When managing a risk and controls framework it is better suited for public companies that have regulation requirements. The tool does not offer good capabilities for managing robust IT regulations. It would be good if there's improvement to the tool so it can be used to manage IT assets.

Incentivized

• If I ever have any technical issues or questions the support team is great at getting back to me very quickly. I also like all the resources available to help as well.
• Policy reports, there are so many to choose from. These reports help me track several different things in the system. Compliance, attestations, past due, and so much more.
• Another plus for me is being able to add linkages to outside programs like TJC and Elsevier. Linking these to policies saves a lot of time.

• Workflows - The workflows of SAP Process Control are extremely helpful
• Reporting - Standard reports as well as the connection to SAP AC is very helpful
• Continuous Control Monitoring is the way to go in ICS Topics in the future.
• Handling of users - Assignment and Replacements
• Spot Checks - Helpful workflows and setup

Incentivized

• The program doesn't work well with Chrome, would like to see that fixed. We have several staff members that use Chrome.

• Integrated attachments functionality (i.e., edit Word/Excel documents within SAP PC, rather than having to download the files locally)
• More flexible dashboarding capabilities
• Better out of the box reporting
• No out of the box content for Controls, Regulations

Incentivized

Overall this program is great. I am continuously in the program and find it very simple to use. I do have some staff that struggle, only because they are not in the program as often as I am

The connectivity with other SAP products out of the SAP GRC suite, like Access Control and so on, was key for the decision. Also we had an already mature SAP System landscape as well as having internal processes that were similar to the SAP Process Control standard processes helped us with the decision to implement SAP Process Control.

Incentivized

• The program has kept us compliant on reviewing and updating all of our policies.

• Significant control on risks
• Significant savings on audit testing can be achieved
• Automation of risk management has a lot of audit standardization and confidence in compliance
• Reliability of automated controls reduces time vested in testing the standard controls