GRC-Boxx vs. SAP Process Control

SAP Process Control is well suited for managing the end to end lifecycle of controls across different regulations. When managing a risk and controls framework it is better suited for public companies that have regulation requirements. The tool does not offer good capabilities for managing robust IT regulations. It would be good if there's improvement to the tool so it can be used to manage IT assets.

Incentivized

• Workflows - The workflows of SAP Process Control are extremely helpful
• Reporting - Standard reports as well as the connection to SAP AC is very helpful
• Continuous Control Monitoring is the way to go in ICS Topics in the future.
• Handling of users - Assignment and Replacements
• Spot Checks - Helpful workflows and setup

Incentivized

• Integrated attachments functionality (i.e., edit Word/Excel documents within SAP PC, rather than having to download the files locally)
• More flexible dashboarding capabilities
• Better out of the box reporting
• No out of the box content for Controls, Regulations

Incentivized

The connectivity with other SAP products out of the SAP GRC suite, like Access Control and so on, was key for the decision. Also we had an already mature SAP System landscape as well as having internal processes that were similar to the SAP Process Control standard processes helped us with the decision to implement SAP Process Control.

Incentivized

• Significant control on risks
• Significant savings on audit testing can be achieved
• Automation of risk management has a lot of audit standardization and confidence in compliance
• Reliability of automated controls reduces time vested in testing the standard controls