Webclass 96: Why is process mining much better than SAP GRC?

Q1. What are the five main areas of SAP GRC?

Access control, process control, risk management, audit management, fraud management

Correct Incorrect Correct answer

Access control, separation of duties matrix, data selection, mitigating controls, risk analysis

Correct Incorrect Correct answer

Q2. If you have SAP GRC, does that mean that you have all the areas of SAP GRC?

No – you can get different modules

Correct Incorrect Correct answer

Yes

Correct Incorrect Correct answer

Q3. In SAP GRC can the business users modify separation of duties matrix?

Yes

Correct Incorrect Correct answer

No

Correct Incorrect Correct answer

Q4. In SAP GRC, normally are separation of duties conflicts set-up to be active only within a company code or cross-company codes?

Within a company code

Correct Incorrect Correct answer

Cross company code

Correct Incorrect Correct answer

Q5. Does the standard SAP GRC list of separation of duties conflicts include customized transactions?

No

Correct Incorrect Correct answer

Yes

Correct Incorrect Correct answer

Q6. Is it possible for business or IT users to be able to create exceptions to the rules?

Yes

Correct Incorrect Correct answer

No

Correct Incorrect Correct answer

Q7. Is it possible for the business or IT to do a mass update of all fo the SAP GRC rules?

Yes

Correct Incorrect Correct answer

No

Correct Incorrect Correct answer

Q8. How many sensitive SAP GRC roles do we mention in the webclass?

11

Correct Incorrect Correct answer

5

Correct Incorrect Correct answer

Q9. Why should the auditor not rely on the SAP GRC datasheet as the basis for creating an audit test plan?

Because processes or risks could be overlooked/ omitted in SAP GRC

Correct Incorrect Correct answer

Because the datasheet is only the raw data from the SAP system

Correct Incorrect Correct answer

Q10. Why might it not be beneficial for auditors to only use the audit management module of SAP GRC?

Because the audit module is fed by information from the process control module and the risk management module that are set-up by the business, and so it is not independent

Correct Incorrect Correct answer

Because the audit module only takes into consideration data from SAP

Correct Incorrect Correct answer

Q11. If you have alerts set-up in SAP GRC, then can internal audit rely on these for continuous auditing?

No because these rules and alerts can be modified by the business and so the audit would not be independent

Correct Incorrect Correct answer

Yes because these rules and alerts are defined by the business

Correct Incorrect Correct answer

Q12. Why might it not be a good audit test to check who has Fire Fighter access at the time of the audit

Because the Fire Fighter accounts are usually checked in and out of SAP GRC for a short period of time and for a specific purpose

Correct Incorrect Correct answer

Because the Fire Fighter accounts are not risky user accounts since they are only for IT admin tasks

Correct Incorrect Correct answer

Q13. Why might the set-up of business rules in SAP GRC not be as flexible as an auditor using their own data analytics/ data visualization tool?

Because the SAP GRC system relies on existing data structures in the Data Warehouse, which might not enable the auditor to answer all of the audit questions that they have

Correct Incorrect Correct answer

Because the SAP GRC system does not enable the analysis of business transactional data from SAP, only user access and master data

Correct Incorrect Correct answer

Q14. Can we see a full overview of the entire business process in SAP GRC?

No

Correct Incorrect Correct answer

Yes

Correct Incorrect Correct answer

Q15. How can we easily see if we have transactions that are occurring in an unexpected chronological order within the business process?

By using Process Mining

Correct Incorrect Correct answer

By using SAP GRC

Correct Incorrect Correct answer

Q16. What is the difference between an SOD analysis in SAP GRC access control compared to that in a process mining dashboard?

In the SAP GRC access control module we only see who has too much access in terms of transaction codes and business objects, whereas in process mining we can see if there are users that have entered all parts of the process for a same document flow

Correct Incorrect Correct answer

In SAP GRC we can see if there are users that have entered all parts of the process for a same doucment flow, whereas in process mining, we can only see who has too much access in terms of transaction coes

Correct Incorrect Correct answer

Q17. Why might an auditor be more agile using process mining in their own data analytics tool, than using SAP GRC?

Because the auditor can add graphs and analysis through drag and drop to answer other questions, such as are there payments that exceed invoice value or long lead-times between the purchase order and the goods receipt

Correct Incorrect Correct answer

Because the auditor can get data out of the SAP system quicker

Correct Incorrect Correct answer

Q18. Why might the auditor want to know if there are any suppliers that only ever work with one user?

Because there could be collusion with that supplier and the supplier may also be related to the employee or even fictitious

Correct Incorrect Correct answer

Because it is inefficient to get one staff member to do all the tasks in the company

Correct Incorrect Correct answer

Webclass 96: Why is process mining much better than SAP GRC?

Webclass 96: Why is process mining much better than SAP GRC?

admin June 9, 2026

Quiz Summary

Information

Results

Results

Categories

1. Question

2. Question

3. Question

4. Question

5. Question

6. Question

7. Question

8. Question

9. Question

10. Question

11. Question

12. Question

13. Question

14. Question

15. Question

16. Question

17. Question

18. Question