User Guide | PUBLIC2021-03-18

Sizing Guide for SAP Process Control

© 2

021 S

AP S

E or

an

SAP affi

liate

com

pany

. All r

ight

s re

serv

ed.

THE BEST RUN

Content

1 Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31.1 Functions of SAP Process Control. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31.2 Architecture of SAP Process Control. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .5

2 Sizing Fundamentals and Terminology. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

3 Initial Sizing for SAP Process Control. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .93.1 Assumptions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93.2 Factors that Influence Performance. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93.3 Sizing Guidelines. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

Refreshing the Work Inbox. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10Creating Plan for Manual Testing. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10Managing Organizations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

4 Related Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

2 PUBLICSizing Guide for SAP Process Control

Content

1 Introduction

SAP Governance, Risk and Compliance (GRC) solutions offer your organization a preventive, real-time approach to governance, risk, and compliance. Automated risk and compliance monitoring activities can help you prevent risk events and compliance violations, helping you protect the value of your organization.

SAP Process Control 12.0 is a SAP GRC product, which provides an end-to-end solution for documenting, evaluating, monitoring, reporting, and certifying the status of internal controls within an enterprise. Process Control supports better management of processes by automating previously manual and time-consuming tasks while increasing reliability and transparency.

SAP Process Control 12.0 is powered by the SAP NetWeaver® platform. SAP NetWeaver unifies technology components into a single platform, allowing organizations to reduce IT complexity and obtain more business value from their IT investments. It provides the best way to integrate all systems running SAP or non-SAP software. SAP NetWeaver also helps organizations align IT with their business. With SAP NetWeaver, organizations can compose and enhance business applications rapidly using enterprise services. As the foundation for enterprise service-oriented architecture (enterprise SOA), SAP NetWeaver allows organizations to evolve their current IT landscapes into a strategic environment that drives business change.

This guide provides guidelines and rules for sizing SAP Process Control in your environment. Sizing is the process of translating business requirements into the overall hardware requirements (such as physical memory, CPU processing power, and network capacity) needed to implement the solution. The guide describes the steps of this process and explains the factors that influence performance and hardware requirements.

1.1 Functions of SAP Process Control

SAP Process Control provides a series of features including control documentation, control evaluation, certification, and reporting and analysis, among other features. SAP Process Control offers the following capabilities:

Control Documentation

SAP Process Control supports a flexible environment for setting up corporate master data, which includes the following categories:

● Organization structure: A multilevel hierarchy showing all organizations within the scope of internal controls management.

● Process catalog: A catalog of key business processes, as well as underlying sub-processes and associated controls, created in hierarchical form.

● Account groups: A list of the key financial account groups and their related financial assertions.● Control objectives and risks: A comprehensive, hierarchical catalog of control objectives and associated

risks relevant to compliance.

Sizing Guide for SAP Process ControlIntroduction PUBLIC 3

● Entity-level controls: A catalog of central management controls, which may be classified by groups conforming to the five COSO (Committee of Sponsoring Organizations) components.

● Policy Lifecycle: A policy library allowing users to maintain policies and execute policy reviews and approval processes.

Control Evaluation

SAP Process Control includes the following principal types of evaluation activity:

● AssessmentsProcess Control provides a survey capability, which enables users to assess the design of sub-processes and controls, or perform self-assessments on a periodic basis. If the assessment results in a deficiency, the solution supports issue creation, remediation activities, and subsequent reassessment.

● Effectiveness TestingProcess Control provides two methods for testing the effectiveness of controls – manual testing using test plans, and automated testing using system rules and programs.○ Manual testing method

Auditors or other testers use test plans from a repository to manually perform periodic tests of controls and follow-up remediation actions if required.

○ Automated testing methodControls are automatically tested on a predetermined schedule using system-driven rules.

● Automated control monitoringProcess Control supports monitoring controls, which allow the tracking of non-compliant business events in an ERP system through a combination of automated programs and exception reports. The system also supports the ability to run ad hoc data queries for data retrieval, and to convert them into new controls.

● Planning and SchedulingCentral to the evaluation activities is the ability to create an evaluation plan, which includes specification of the test time frame, organizations involved, and type of evaluation.

● Policy distributionPolicy managers can distribute policy acknowledgments, quizzes, and surveys to employees, requesting acknowledgment.

● In SAP Process Control, all evaluation activities are governed by a set of robust work flows and notifications. Based on evaluation schedules, users are automatically notified through work flow tasks which cover test performance, issue management, remediation and retesting.

Certification

To support regulatory requirements, SAP Process Control provides the process of sign-off, which is a formal process of attestation by organization owners and officers of the company on the state of internal controls. Certification is achieved using a combination of sign-off surveys and work flows, and provides historic period reporting for audit requirements.

4 PUBLICSizing Guide for SAP Process Control

Introduction

Reporting an Analysis

SAP Process Control provides detailed and flexible reporting features that enable users to gain full visibility into the control environment and make data-driven decisions. It supports a catalog of standard reports, which cover areas such as master data setup, evaluation activities, audit logs and authorization analysis. All reports come with selection criteria, export and print functionality, and drilldown capability for ease of use.

1.2 Architecture of SAP Process Control

GRC solutions are an add-on (software component GRCFND_A) to SAP NetWeaver 7.40 (ABAP) that allows you to use all databases and operating systems supported by the SAP Web Application Server.

SAP Process Control Architecture

Integrated scenarios, principally between SAP Access Control and SAP Process Control, require you to have both applications activated on the same SAP client (SAP Access Control resides in the same software component as SAP Process Control and SAP Risk Management). Furthermore, GRC Plug-In Adapters are required for standard integration of SAP/non-SAP systems and SAP Access Control.

Sizing Guide for SAP Process ControlIntroduction PUBLIC 5

NoteAdditional extensions (not considered in this initial sizing) are also available, including Identity Management Solutions integration, LDAP user repositories integration, non-SAP systems provisioning, and SAP NW Enterprise Portal provisioning integration, among others.

6 PUBLICSizing Guide for SAP Process Control

Introduction

2 Sizing Fundamentals and Terminology

SAP provides general sizing information on http://www.sap.com/sizing . For the purpose of this guide, we assume that you are familiar with sizing fundamentals. This section explains the most important sizing terms, as these terms are used extensively in this document.

Sizing

Sizing means determining the hardware requirements of an SAP application, such as network bandwidth, physical memory, CPU processing power, and I/O capacity. The size of the hardware and database is influenced by both business aspects and technological aspects. This means that the number of users using the various application components and the data load they put on the server must be taken into account.

Benchmarking

Sizing information can be determined using SAP Standard Application Benchmarks . Released for technology partners, benchmarks provide basic sizing recommendations to customers by placing a substantial load upon a system during the testing of new hardware, system software components, and relational database management systems (RDBMS). All performance data relevant to the system, user, and business applications are monitored during a benchmark run and can be used to compare platforms.

SAPS

The SAP Application Performance Standard (SAPS) is a hardware-independent unit that describes the performance of a system configuration in the SAP environment. It is derived from the Sales and Distribution (SD) Benchmark, where 100 SAPS is defined as the computing power to handle 2,000 fully business processed order line items per hour. (For more information about SAPS, seehttp://www.sap.com/benchmark → Measuring in SAPS).

Tips for Calculating SAPSYou need to identify which tasks run in parallel and which tasks run in sequential order to calculate SAPS correctly.

Note● If tasks are done at the same time (parallel), add the SAPS for all parallel tasks to get a total SAPS

number.● If tasks are done sequentially (one after another), do not add them together.

Sizing Guide for SAP Process ControlSizing Fundamentals and Terminology PUBLIC 7

ExampleSynchronization and Batch User Risk Analysis tasks run in sequential order.

● Synchronization with 10.000 users = 5000 SAPS● Batch User Risk Analysis with 10.000 users = 20,000 SAPS

Therefore, you would need 20,000 SAPS, instead of 25,000 SAPS.

Initial Sizing

Initial sizing refers to the sizing approach that provides statements about platform-independent requirements of the hardware resources necessary for representative, standard delivery SAP applications. The initial sizing guidelines assume optimal system parameter settings, standard business scenarios, and so on.

Expert Sizing

Expert Sizing refers to a sizing exercise were customer-specific data is analyzed and used to provide more detail for the sizing result. The main objective is to determine the resource consumption of customized content and applications (not SAP standard delivery) by comprehensive measurements. More information can be found here .

Configuration and System Landscaping

Hardware resource and system configuration greatly depend on the requirements of the customer-specific project. This includes the implementation of distribution, security, and high availability solutions by different approaches using various third-party tools. In the case of high availability through redundant resources, for example, the final resource requirements must be adjusted accordingly.

There are “best practices” which may be valid for a specific combination of operating system and database. For guidance on NetWeaver configuration, please search for SAP NetWeaver on SAP Help Portal.

8 PUBLICSizing Guide for SAP Process Control

Sizing Fundamentals and Terminology

3 Initial Sizing for SAP Process Control

This section describes the procedure for sizing SAP Process Control.

3.1 Assumptions

This section describes the assumptions used when sizing Process Control.

The following performance-influencing parameters in Process Control have been turned off:

● Report buffering● Table logging

NoteThese requirements are only to create a standard environment for determining the sizing data. In your production environment we recommend you enable both reporting buffering and table logging.

3.2 Factors that Influence Performance

The following factors can impact the performance:

● HANA database use. Refer to the following for more information:○ Suite on HANA memory sizing: SAP Note 1872170○ Sizing for SAP Suite on HANA: SAP Note 1793345○ SAP HANA 1.0 Sizing SAP in-Memory Database: SAP Note 1514966

● Master data volume (for example, size of the central risk and control matrix, subprocesses and controls assigned to organizations)

● Transaction data volume● Configuration settings (for example, activation or deactivation of the report buffer)● Number of concurrent users

3.3 Sizing Guidelines

The sizing results described in this section were obtained by measuring the following scenarios:

Sizing Guide for SAP Process ControlInitial Sizing for SAP Process Control PUBLIC 9

● Refreshing the work inbox● Creating plan for manual testing● Managing organizations

The results include memory usage and the minimum number of SAPS required for supporting the corresponding number of users.

NoteSwitching on the shared objects memory will improve the performance for creating plans.

3.3.1 Refreshing the Work Inbox

In this scenario, users open their work inbox and manipulate work items relevant to them.

Procedure

1. Choose My Home Work Inbox Work Inbox .2. Choose the Refresh link.

The inbox has been refreshed.

The following table shows the sizing guidelines based on this test:

Max number of scenarios per hour ABAP [SAPS] HANA [SAPS]

ABAP Memory [GB]

HANA Runtime Memory [GB] Network [Mbit/s]

1000 1150 1150 0.5 0.03 0.010

2000 2300 1150 0.9 0.05 0.010

5000 3450 2300 2.3 0.13 0.020

More Contact SAP or your hardware partner

Max number of scenarios per year Kb per scenario Disk space [GB]

1000000 66 63

3.3.2 Creating Plan for Manual Testing

In this scenario, users create plans for manual testing and assessments using the Planner application.

10 PUBLICSizing Guide for SAP Process Control

Initial Sizing for SAP Process Control

Procedure

1. Choose Assessment Assessment Planning Planner .2. Click the Create button.3. Complete the wizard to creating a new plan.4. Click the Activate Plan button.

The following table shows the sizing guidelines based on this test:

Max number of scenarios per hour ABAP [SAPS] HANA [SAPS]

ABAP Memory [GB]

HANA Runtime Memory [GB] Network [Mbit/s]

1000 1150 1150 7 3 0.003

2000 2300 2300 14 5 0.003

5000 4600 3450 34 14 0.006

More Contact SAP or your hardware partner

Max number of scenarios per year Kb per scenarios Disk space [GB]

1000000 108 103

3.3.3 Managing Organizations

In this scenario, organization owners manage relevant organizational data.

Procedure

1. Choose Master Data Organizations Organizations .2. Click the Add button and select Create new organization in the dialog that appears.3. Fill in all required fields.4. Click the Save button.

The following table shows the sizing guidelines based on this test:

Max number of scenarios per hour ABAP [SAPS] HANA [SAPS]

ABAP Memory [GB]

HANA Runtime Memory [GB] Network [Mbit/s]

1000 1150 1150 1.4 0.03 0.004

2000 2300 2300 2.9 0.07 0.004

5000 5750 5750 7.1 0.16 0.009

Sizing Guide for SAP Process ControlInitial Sizing for SAP Process Control PUBLIC 11

Max number of scenarios per hour ABAP [SAPS] HANA [SAPS]

ABAP Memory [GB]

HANA Runtime Memory [GB] Network [Mbit/s]

More Contact SAP or your hardware partner

Max number of scenarios per year Kb per scenarios Disk space [GB]

1000000 4 3.8

12 PUBLICSizing Guide for SAP Process Control

Initial Sizing for SAP Process Control

4 Related Information

This section describes the resources available related to sizing procedures and guidelines, as well as benchmark and installation guides.

General Sizing

https://www.sap.com/about/benchmark/sizing.html : Sizing Guidelines General Sizing Procedure

Expert Sizing

https://www.sap.com/about/benchmark/sizing.html : Sizing Guidelines General Sizing ProcedureExpert Sizing

Benchmarking

http://www.sap.com/benchmark

Installation Guides

You can find the latest installation and upgrade guides for SAP Process Control here.

Sizing Guide for SAP Process ControlRelated Information PUBLIC 13

Important Disclaimers and Legal Information

HyperlinksSome links are classified by an icon and/or a mouseover text. These links provide additional information.About the icons:

● Links with the icon : You are entering a Web site that is not hosted by SAP. By using such links, you agree (unless expressly stated otherwise in your agreements with SAP) to this:

● The content of the linked-to site is not SAP documentation. You may not infer any product claims against SAP based on this information.● SAP does not agree or disagree with the content on the linked-to site, nor does SAP warrant the availability and correctness. SAP shall not be liable for any

damages caused by the use of such content unless damages have been caused by SAP's gross negligence or willful misconduct.

● Links with the icon : You are leaving the documentation for that particular SAP product or service and are entering a SAP-hosted Web site. By using such links, you agree that (unless expressly stated otherwise in your agreements with SAP) you may not infer any product claims against SAP based on this information.

Videos Hosted on External PlatformsSome videos may point to third-party video hosting platforms. SAP cannot guarantee the future availability of videos stored on these platforms. Furthermore, any advertisements or other content hosted on these platforms (for example, suggested videos or by navigating to other videos hosted on the same site), are not within the control or responsibility of SAP.

Beta and Other Experimental FeaturesExperimental features are not part of the officially delivered scope that SAP guarantees for future releases. This means that experimental features may be changed by SAP at any time for any reason without notice. Experimental features are not for productive use. You may not demonstrate, test, examine, evaluate or otherwise use the experimental features in a live operating environment or with data that has not been sufficiently backed up.The purpose of experimental features is to get feedback early on, allowing customers and partners to influence the future product accordingly. By providing your feedback (e.g. in the SAP Community), you accept that intellectual property rights of the contributions or derivative works shall remain the exclusive property of SAP.

Example CodeAny software coding and/or code snippets are examples. They are not for productive use. The example code is only intended to better explain and visualize the syntax and phrasing rules. SAP does not warrant the correctness and completeness of the example code. SAP shall not be liable for errors or damages caused by the use of example code unless damages have been caused by SAP's gross negligence or willful misconduct.

Gender-Related LanguageWe try not to use gender-specific word forms and formulations. As appropriate for context and readability, SAP may use masculine word forms to refer to all genders.

14 PUBLICSizing Guide for SAP Process Control

Important Disclaimers and Legal Information

Sizing Guide for SAP Process ControlImportant Disclaimers and Legal Information PUBLIC 15

www.sap.com/contactsap

© 2021 SAP SE or an SAP affiliate company. All rights reserved.

No part of this publication may be reproduced or transmitted in any form or for any purpose without the express permission of SAP SE or an SAP affiliate company. The information contained herein may be changed without prior notice.

Some software products marketed by SAP SE and its distributors contain proprietary software components of other software vendors. National product specifications may vary.

These materials are provided by SAP SE or an SAP affiliate company for informational purposes only, without representation or warranty of any kind, and SAP or its affiliated companies shall not be liable for errors or omissions with respect to the materials. The only warranties for SAP or SAP affiliate company products and services are those that are set forth in the express warranty statements accompanying such products and services, if any. Nothing herein should be construed as constituting an additional warranty.

SAP and other SAP products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of SAP SE (or an SAP affiliate company) in Germany and other countries. All other product and service names mentioned are the trademarks of their respective companies.

Please see https://www.sap.com/about/legal/trademark.html for additional trademark information and notices.

THE BEST RUN