Unable to render embedded object: File (Emp18Notice.png) not found.
Skip to end of banner
Go to start of banner

reviewingsodviolations

Skip to end of metadata
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

Version 1 Next »

---title: Reviewing Separation of Duties Policies---

Reviewing Separation of Duties Violations

When a Separation of Duties policy is compiled, EmpowerID creates a review task for each policy violation it finds based on the rules applied to the policy. For example, if you have a SoD policy with a rule that specifies a violation should occur whenever any one person is assigned to both Management Role "A" and Management Role "B" at the same time, when the SoD engine runs it checks to see if any one person belongs to both of those roles. If the engine finds people with both roles, it creates a SoD review task for each violation (one per person). These tasks can then be reviewed and remediated by anyone assigned theEnterprise Compliance Officer Management Role as well as anyone assigned to all of the following Access Levels:

  • The Reviewer Access Level for the people violating the policy
  • The Reviewer Access Level for the Separation of Duties policy
  • The Viewer Access Level for theAuditor Compliance Dashboard (if you want the person to have access to the dashboard)
  • The Viewer Access Level for the Auditor Compliance Open Violations page of the Auditor Compliance Dashboard and/or the Viewer Access Level for the User Compliance Open Violations page of the User Compliance Dashboard

To review Separation of Duties Violations

Log in to the EmpowerID Web application as either a person assigned the Enterprise Compliance Officer Management Role or a person with all of the above mentioned Access Levels. From the Navigation Sidebar, navigate to the Open Violations page by expanding Compliance and Reports > For Auditors and clicking Policy Violations To Do. From the Open Violations page, search for the SoD Policy with the violation(s) you wish to review and then click the link for the violation(s) in the SoD Violations grid.
The below image shows what the Navigation Sidebar looks like for someone who has been granted limited access to the Auditor Compliance Dashboard via the Access Level assignments mentioned above. If the person was a member of the Enterprise Compliance Officer Management Role, that person would see all available pages for the dashboard.

This directs you to the View page for this violation. This page allows you to view the details of the violation, including the combination assignments comprising it as well as provides you with a set of decisions that can be submitted to remediate the violation.

From the Separation of Duties page, click the Submit Decision link beside the decision that reflects the remediation taken. These decisions include the following:
  • Acknowledged - The SoD Violation has been noted, but no corrective action has been taken by the reviewer.
  • Corrected - The SoD violation has been corrected.
  • Permitted - The SoD violation is unresolved but allowed.
  • Policy Changed - The SoD Policy has been changed to allow any exceptions to a previous version of the policy.
Enter comments for the resolution and click OK.

The SoD Policy Violation Details page updates to show the decision.

  • No labels