SIZING GUIDE

Sizing SAP BusinessObjects Process Control, Version 3.0

Released for SAP Customers and Partners

Document Version 2.0, November 2009

 Copyright 2009 SAP AG. All rights reserved. No part of this publication may be reproduced or transmitted in any form or for any purpose without the express permission of SAP AG. The information contained herein may be changed without prior notice. Some software products marketed by SAP AG and its distributors contain proprietary software components of other software vendors. Microsoft, Windows, Outlook, and PowerPoint are registered trademarks of Microsoft Corporation. IBM, DB2, DB2 Universal Database, OS/2, Parallel Sysplex, MVS/ESA, AIX, S/390, AS/400, OS/390, OS/400, iSeries, pSeries, xSeries, zSeries, z/OS, AFP, Intelligent Miner, WebSphere, Netfinity, Tivoli, and Informix are trademarks or registered trademarks of IBM Corporation in the United States and/or other countries. Oracle is a registered trademark of Oracle Corporation. UNIX, X/Open, OSF/1, and Motif are registered trademarks of the Open Group. Citrix, ICA, Program Neighborhood, MetaFrame, WinFrame, VideoFrame, and MultiWin are trademarks or registered trademarks of Citrix Systems, Inc. HTML, XML, XHTML and W3C are trademarks or registered trademarks of W3C, World Wide Web Consortium, Massachusetts Institute of Technology. Java is a registered trademark of Sun Microsystems, Inc. JavaScript is a registered trademark of Sun Microsystems, Inc., used under license for technology invented and implemented by Netscape. MaxDB is a trademark of MySQL AB, Sweden. SAP, R/3, mySAP, mySAP.com, xApps, xApp, SAP NetWeaver, and other SAP products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of SAP AG in Germany and in several other countries all over the world. All other product and service names mentioned are the trademarks of their respective companies. Data

contained in this document serves informational purposes only. National product specifications may vary. These materials are subject to change without notice. These materials are provided by SAP AG and its affiliated companies ("SAP Group") for informational purposes only, without representation or warranty of any kind, and SAP Group shall not be liable for errors or omissions with respect to the materials. The only warranties for SAP Group products and services are those that are set forth in the express warranty statements accompanying such products and services, if any. Nothing herein should be construed as constituting an additional warranty.

Disclaimer Some components of this product are based on Java. Any code change in these components may cause unpredictable and severe malfunctions and is therefore expressly prohibited, as is any decompilation of these components. SAP Library document classification: CUSTOMERS & PARTNERS Documentation in the SAP Service Marketplace You can find this documentation at the following address:
http://service.sap.com/sizing

SAP AG

Sizing SAP BusinessObjects Process Control 3.0

Table of Contents
1 INTRODUCTION................................................................................................................................... 2 1.1 1.2 1.3 2 3 FUNCTIONS OF SAP BUSINESSOBJECTS PROCESS CONTROL ................................................................. 2 ARCHITECTURE OF SAP BUSINESSOBJECTS PROCESS CONTROL ........................................................... 4 FACTORS THAT INFLUENCE THE PERFORMANCE ................................................................................... 4

SIZING FUNDAMENTALS AND TERMINOLOGY ........................................................................... 5 SIZING SAP BUSINESSOBJECTS PROCESS CONTROL................................................................. 6 3.1 3.2 ASSUMPTIONS .................................................................................................................................... 6 SIZING GUIDELINE .............................................................................................................................. 6

4 5

MISCELLANEOUS................................................................................................................................ 9 COMMENTS AND FEEDBACK ........................................................................................................... 9

SAP AG

Sizing BusinessObjects Process Control 3.0

1 Introduction
SAP BusinessObjects Process Control 3.0 (Process Control) is a solution for internal controls management that enables members of audit and internal controls teams to gain better visibility into key business processes and ensure a high level of reliability in financial statement reporting. SAP solutions for governance, risk, and compliance are powered by the SAP NetWeaver platform. SAP NetWeaver unifies technology components into a single platform, allowing organizations to reduce IT complexity and obtain more business value from their IT investments. It provides the best way to integrate all systems running SAP or non-SAP software. SAP NetWeaver also helps organizations align IT with their business. With SAP NetWeaver, organizations can compose and enhance business applications rapidly using enterprise services. As the foundation for enterprise service-oriented architecture (enterprise SOA), SAP NetWeaver allows organizations to evolve their current IT landscapes into a strategic environment that drives business change. This guide provides guidelines and rules for the sizing of the SAP BusinessObjects Process Control. Sizing is the process of translating business requirements into overall hardware requirements, such as the physical memory, the CPU processing power, and the network capacity needed to implement the SAP BusinessObjects Process Control. The guide describes the different steps of the process and describes the factors that influence performance and hardware requirements. Please note that this document only covers general information about the initial sizing of the SAP BusinessObjects Process Control and focuses on pure server sizing. Our experience from customer projects shows that every GRC Suite implementation is unique in its scope and complexity. That is why we can only provide general GRC recommendations and point out the most important factors that influence sizing. Complex scenarios are not covered in this document. If your business requirement does not fit the standard T-shirt, we recommend performing an expert sizing as every change in the infrastructure might have a significant impact on sizing and hardware requirements. Furthermore, the implementation of various SAP Business Packages or customerspecific content has great impact on the sizing of the server and the performance. Therefore, the hardware requirements can vary dramatically.

1.1

Functions of SAP BusinessObjects Process Control

The main capabilities of SAP BusinessObjects Process Control include: Control Documentation Process Control supports a flexible environment for setting up corporate master data, which includes the following categories: Organization structure: A multi-level hierarchy showing all organizations within the scope of internal controls management. Process catalog: A catalog of key business processes, their underlying sub processes and associated controls, created in hierarchical form. Account groups: A list of the key financial account groups and their related financial assertions. Control objectives and risks: A comprehensive, hierarchical catalog of control objectives and associated risks relevant to compliance. Entity-level controls: A catalog of central management controls, which may be classified by groups conforming to the five COSO (Committee of Sponsoring Organizations) components. Control Evaluation In Process Control, there are four main types of evaluation activity: Assessments: Process Control provides survey functionality, which enables users to assess the design of sub processes and controls or perform self-assessments on a periodic basis. If the assessment results in a deficiency, the solution supports issue creation, remediation activities and subsequent reassessment.

SAP AG

Sizing BusinessObjects Process Control 3.0

Effectiveness Testing: Process Control provides two methods for testing the effectiveness of controls manual testing using test plans, and automated testing using system rules and programs. o o In the manual testing method, auditors or other testers use test plans from a repository to manually perform periodic tests of controls and follow-up remediation actions if required. In the automated testing method, controls are automatically tested on a predetermined schedule using system-driven rules.

Automated control monitoring: Process Control also supports monitoring controls, which allow the tracking of noncompliant business events in an ERP system through a combination of automated programs and exception reports. The system also supports the ability to run ad hoc data queries for data retrieval, and to convert them into new controls. Planning and Scheduling: Central to the evaluation activities is the ability to create an evaluation plan, which includes specification of the test time frame, organizations involved, and type of evaluation. In Process Control, all evaluation activities are governed by a set of robust workflows and notifications. Based on evaluation schedules, users are automatically notified through workflow tasks which cover test performance, issue management, remediation and retesting. Certification To support regulatory requirements, Process Control provides the process of sign-off, which is the formal process of attestation by organization owners and officers of the company on the state of internal controls. Certification is achieved using a combination of sign-off surveys and workflows, and provides historic period reporting for audit requirements. Reporting and Analysis Process Control provides detailed and flexible reporting features that enable users to gain full visibility into the control environment and make data-driven decisions. It supports a catalog of 30 standard reports, which cover areas such as master data setup, evaluation activities, audit logs and authorization analysis. All reports come with selection criteria, export and print functionality, and drilldown capability for ease of use. Process Control also provides Business Warehouse (BW) reporting to enable specialist users to view aggregate metrics, trends and patterns, and to provide decision support.

SAP AG

Sizing BusinessObjects Process Control 3.0

1.2

Architecture of SAP BusinessObjects Process Control

SAP BusinessObjects Process Control consists of three main components: SAP GRC Process Control Core GRC Process Control contains the core PC components such as master data hierarchies, automated controls, surveys etc. This layer comes with a web service interface that enables standards-based integration with other applications. The underlying services used by PC, such as the scheduler and ABAP workflow engine which are part of Netweaver. The GRC Process Control core is an Add-on (GRCFND_A) on SAP Web Application Server (ABAP). You can use all the databases and operating systems supported by SAP Web Application Server. SAP Portal The SAP Portal is the browser-based SAP integration platform that provides end users with a seamless integration of portal-based transactions, classic SAP GUI-based transactions, and new applications developed in Web Dynpro (ABAP and Java). SAP Portal forms the UI layer and SAP Process Control application requires the add-on portal business package: GRC_PC_POR and GRC_RFW

Graphic 1: Architecture of SAP BusinessObjects Process Control

1.3

Factors that influence the performance

Master Data volume Transaction Data volume Configuration Settings (For e.g. activation/deactivation of report buffer) Number of concurrent users

The performance influencing factors in SAP BusinessObjects Process Control are:

SAP AG

Sizing BusinessObjects Process Control 3.0

2 Sizing Fundamentals and Terminology

SAP provides general sizing information on the SAP Service Marketplace. For the purpose of this guide, we assume that you are familiar with sizing fundamentals. You can find more information at http://service.sap.com/sizing Sizing General Sizing Procedures. This section explains the most important sizing terms, as these terms are used extensively in this document.

Sizing
Sizing means determining the hardware requirements of an SAP application, such as the network bandwidth, physical memory, CPU processing power, and I/O capacity. The size of the hardware and database is influenced by both business aspects and technological aspects. This means that the number of users using the various application components and the data load they put on the server must be taken into account.

Benchmarking
Sizing information can be determined using SAP Standard Application Benchmarks and scalability tests (www.sap.com/benchmark). Released for technology partners, benchmarks provide basic sizing recommendations to customers by placing a substantial load upon a system during the testing of new hardware, system software components, and relational database management systems (RDBMS). All performance data relevant to the system, user, and business applications are monitored during a benchmark run and can be used to compare platforms.

SAPS
The SAP Application Performance Standard (SAPS) is a hardware-independent unit that describes the performance of a system configuration in the SAP environment. It is derived from the Sales and Distribution (SD) Benchmark, where 100 SAPS is defined as the computing power to handle 2,000 fully business processed order line items per hour. (For more information about SAPS, see http://www.sap.com/benchmark SAPS).

Initial Sizing
Initial sizing refers to the sizing approach that provides statements about platform-independent requirements of the hardware resources necessary for representative, standard delivery SAP applications. The initial sizing guidelines assume optimal system parameter settings, standard business scenarios, and so on.

Expert Sizing
This term refers to a sizing exercise where customer-specific data is being analyzed and used to put more detail on the sizing result. The main objective is to determine the resource consumption of customized content and applications (not SAP standard delivery) by comprehensive measurements. For more information, see http://service.sap.com/sizing Sizing Guidelines General Sizing Procedures Expert Sizing.

Configuration and System Landscaping

Hardware resource and optimal system configuration greatly depend on the requirements of the customer-specific project. This includes the implementation of distribution, security, and high availability solutions by different approaches using various third-party tools. In the case of high availability through redundant resources, for example, the final resource requirements must be adjusted accordingly. There are some "best practices" which may be valid for a specific combination of operating system and database. To provide guidance, SAP created the NetWeaver configuration guides (http://service.sap.com/instguides SAP NetWeaver).

Minimum Hardware Requirements

Hardware for the SAP BusinessObjects Process Control Version 3.0 application should be based on the applicable SAP NetWeaver Installation Guide and should also take into account volume of master data, transaction, and user numbers.

SAP AG

Sizing BusinessObjects Process Control 3.0

Processor: o Two single core Processor or o One dual core processor Processor Speed: o 3.20 GHz or above WAS RAM: o Recommended 8 GB or above Hard Disk: o 80 GB Minimum o Swap Space 2* RAM o 1.2 GB temporary space

3 Sizing SAP BusinessObjects Process Control

3.1 Assumptions
Performance-influencing parameters in Process Control version 3.0 that have been turned on/off o Report Buffering is off o Table logging is off Additional performance-influencing factors that are beyond the scope of the initial sizing but that can have a potential influence o Master / Transaction Data Volume o Number of users (concurrently active) o Reporting This could have a potential influence on performance but it is not possible to build a general algorithm due to volatile inputs and data retrieval. o NetWeaver Portal This guide does not include sizing aspects of NW Portal. For more information regarding Sizing Guide for SAP Netweaver Portal http://service.sap.com/sizing Sizing Guidelines Solutions & Platforms Sizing SAP Netweaver Portal o Report Printing This guide does not consider the report printing using Adobe Document services (ADS). For more information regarding Sizing Guide for Adobe Document Services available at: https://www.sdn.sap.com/irj/scn/go/portal/prtroot/docs/library/uuid/10c87e0c-4d89-2a10-8ea7ccd59072a7db

3.2

Sizing guideline

For sizing, customer/partner has to make sure that this is done for the peak hour of the year. T-Shirt Model The table below gives you an indication of the resource consumption according to usage categories. Effectiveness Testing: Process Control provides two methods for testing the effectiveness of controls manual testing using test plans, and automated testing using system rules and programs. In the manual testing method, auditors or other testers use test plans from a repository to manually perform periodic tests of controls and follow-up remediation actions if required. In the automated testing method, controls are automatically tested on a predetermined schedule using system-driven rules.

SAP AG

Sizing BusinessObjects Process Control 3.0

Test Description: Test performance: The test of effectiveness uses a test plan that may include both step and test activities. Step refers to the preparation or gathering of information for the test. Test refers to the validation of data to determine whether the control is effective. To trigger workflow for manual tests of effectiveness, you create a plan for a test period with a start date and due date. Once the plan start date occurs, the system routes the tasks of performing manual tests to the testers 1. By number of effectiveness testing executions: Category No of Concurrent Planner Created Up to 50 Up to 100 Up to 150 SAPS Memory (GB)

Small Medium Large

4000 8000 12000

2 4 6

Here we consider the concurrently executed manual controls. This was performed with single user / multi users creating Test of Effectiveness with 1, 10 and 100 controls attached to the plan. 2. Refresh Work Inbox Test Description: To view the latest received workflow tasks in your inbox, open your inbox and the refresh program will run automatically. Category No of Concurrent Users Up to 50 Up to 100 Up to 150 SAPS Memory (GB)

Small Medium Large

750 1500 2250

3.4 7.2 10.6

3. Process Inbox Tasks Test Description: 1. If your overall rating for a test is Fail, you are required to create at least one issue and assign an owner before submitting the test. 2. If you need to gather information before creating and assigning the issue, save your test as a draft and return to complete it later. 3. On the General tab, choose Report Issue. Enter the issue details: o o o Issue Name (required) Priority (required) high, medium, low Owner (required) accept the default, enter the owner name, or use search functionality to look up and select the owner

SAP AG

Sizing BusinessObjects Process Control 3.0

o o o

Description (suggested) provide a full description of the issue Compensating controls Potential impact

4. Choose OK to save changes or Cancel to abort the session. 5. If the issue was raised in error, you can void the issue before submitting your test. To void an issue, choose Void. An Issue Void Comments screen appears. Enter your comments. Choose OK or Cancel. 6. Once you have created any required issues and completed your test, choose Submit.

Category

Small Medium Large X-Large

No of Concurrent Users Up to 50 Up to 100 Up to 150

SAPS

Memory (GB)

8450 16900 25350

1.7 4 5.6

Please get in contact with SAP or hardware partner

4. Create Manual Test Plan Test Description: 1. A manual test plan consists of a sequence of test steps that are performed during testing to determine that a control is operating effectively. A manual test plan may test either a manual or an automated control. If you define the test method as manual, a manual test plan applies. 2. When you create a manual test plan, you assign the following attributes to it: o o o Detailed test steps comprising the test plan and the required steps Sampling methodology and initial sample size Indicator that says whether or not a test step failure results in a failed control and requires further action

3. All required test steps must be completed, in sequence, before the final validation of a manual control Category No of Concurrent Users Up to 50 Up to 100 Up to 150 SAPS Memory (GB)

Small Medium Large X-Large

6700 13400 20100

1.8 3.5 5.3

Please get in contact with SAP or hardware partner

SAP AG

Sizing BusinessObjects Process Control 3.0

5. Assign Manual Test Plan to Control Test Description: At the global level, you can assign a manual test plan to global controls or to Indirect Entity-Level Controls (IELCs). 1. Select SAP BusinessObjects Process Control Global Compliance Office Global Evaluation Setup Manual Test Plans. 2. The Manual Test Plans screen displays test plans with the validity dates that are included in the selected time period. 3. Select a test plan and select Assign To. 4. From the dropdown menu, select either Central Controls or Central IELCs. 5. Select the controls that you want to assign to your test plan. 6. The Assign Test Plan to Control screen displays the central controls and related sub processes available for manual test plan assignment. The system only displays controls for which no test plan has yet been assigned. 7. Select OK after you complete your selection. Category No of Concurrent Users Up to 50 Up to 100 Up to 150 SAPS Memory (GB)

Small Medium Large X-Large

9200 18300 27500

5.5 10.5 16

Please get in contact with SAP or hardware partner

It is important to consider how many concurrent users are logged and functions will be running concurrently, at peak time, when selecting the Category. Internal control is a process designed to provide reasonable assurance regarding the achievement of objectives such as: Effectiveness and efficiency of operations Reliability of financial reporting Compliance with applicable laws and regulations

4 Miscellaneous
For more information to the sizing procedures, general as well as expert guidelines for sizing, benchmarks and installation guides visit: Sizing http://service.sap.com/sizing General Guidelines http://service.sap.com/sizing Sizing General Sizing Procedures Expert Sizing http://service.sap.com/sizing Sizing Guidelines General Sizing Procedures Expert Sizing Benchmarking http://www.sap.com/benchmark Business Process Experts https://www.sdn.sap.com/irj/sdn/bpx-grc Installation Guides http://service.sap.com/instguides -> Release & Upgrade Info ->Installation &Upgrade Guides ->Additional Application ->SAP Solutions for GRC -> GRC Process Control

5 Comments and Feedback

Both are very welcome; please send them to GRC Sizing Team, RIG, GRC_RIG@sap.com

SAP AG

Sizing BusinessObjects Process Control 3.0