Skip to Content
Author's profile photo Baithi Srinivas

Master Data in Process Control-GRCV10.0/10.1

Dear all,


This blog will give you an overview about the master data in GRC Process Control


As we know already, the master data is shared between all 3 components (AC, PC and RM) of GRC.


Master data in Process controls like Organizations, Business processes, Sub processes, controls, owners, regulations, policies, entity level controls etc.


HR structures have been used in the technical software execution of the master data in SAP Process Control. All objects are contained in info type 1000 (table HRP1000).The link to the long text fields (for example, the fields under Description) is located in info type 1002 (table HRP1002, field TABNR), and the texts themselves in table HRT1002.


Centralized data is nothing but at corporate level Decentralized data (Local) is nothing but at individual unit level.


We have two types of Master data.

  • Central Master data
  • Local Master data


Central Master Data


Central (or Corporate) master data applies to the entire company


• Organization Hierarchy

• Central Process Hierarchy

• Account Group Hierarchy

• Control Objectives

• Indirect Entity-Level Control Hierarchy

• Regulations and Policies



Created from master data work center





Local Master Data


Local (organization-dependent) master data applies to data within each Organization


• Organization-dependent sub processes

• Organization-dependent controls

• Organization-dependent policies

• Organization-dependent indirect entity-level controls


Created from master data work center





The only difference between central and local objects is the organization object.


When we use the central objects like Sub Processes and controls in organization then these objects will become local objects.


All master data changes can be traced by using Audit log under Reports




Master data can be uploaded using 2 ways and also we enter manually

  1. MDUG(Master data upload generator)
  2. CLM(Content life cycle management)


Both are designed to get large amounts of data quickly into the system


MDUG is only available for PC Master Data during initial implementation and Not available for subsequent loads, which is Included within the PC client


CLM is Available for subsequent loading, Must reside as an instance on a portal, Must have someone administering and Master Data for AC, PC and RM can be loaded with CLM.


Master Data that can be moved using CLM

• Organization

• Regulation

– Regulation Group

– Regulation

– Regulation Requirements

• Control Objective

• Business Process

– Central Process

– Central Sub process

– Central Control

• Indirect Entity-Level Control

– Central IELC Group

– Central IELC

• Risk

– Central Risk Category

– Central Risk Template

• Account Group

• Assessment: Manual Test Plan


Master data can be set up and manage by using two work centers from NWBC

  1. Master Data
  2. Access Management


Create master data objects in the following order:

  1. Organizations
  2. Account Groups and Assertions
  3. Control Objectives and Risks
  4. Central Process Hierarchy: processes, sub processes, and controls


When all objects are created, perform the master data assignments:

  1. Assign corporate and organization roles
  2. Assign sub processes to organizations
  3. Assign roles to local processes.
  4. Policies and indirect entity-level controls may be created at any time and assigned to existing organizations and regulations.


Regulations are assigned to the following objects and inherited by the organizations when assigned to them.


1.Sub processes


3.Indirect Entity-Level Controls


5.Ad-Hoc Issues


Feel free to add anything related to master data,hope it helps.




Assigned Tags

      You must be Logged on to comment or reply to a post.
      Author's profile photo Rakesh Ram
      Rakesh Ram

      One more great post from you baithi.

      Thanks a lot


      Deepak M

      Author's profile photo Former Member
      Former Member

      Thanks a lot for sharing Baithi.



      Author's profile photo Kesava Mullati
      Kesava Mullati

      Thanks for Sharing this useful information.

      Best Regards,


      Author's profile photo GAD CUA Support
      GAD CUA Support

      Thanks for sharing.. Very informative

      Author's profile photo Former Member
      Former Member

      Hi Baithi,

      This document is useful but there are few things which is either not true or incomplete.

      I would like to share my knowledge based on the experience I got after working on few GRC PC Projects.

      1. You are right that there are two types of master data: Central and Local. Central master data depicts the company enterprise structure including Org hierarchy, Process and sub processes hierarchy and control. SAP Provides central master data to maintain it centrally to reduce maintenance complexity. When these central data gets assigned to a org unit (legal entities) it may become local, depending on method of assignment. If local changes are allowed during assignment then the assigned object becomes Local else it will still be central.

      2. Audit Log report: You mentioned that 'All master data changes can be traced by using Audit log under Reports'. I have tested this report in GRC 10.0, it is not at all working. Also in 10.1 it somehow works but information that you get in the log is not that useful, logs are in number code difficult to interpret.

      3. You have mentioned that 'MDUG is only available for PC Master Data during initial implementation and Not available for subsequent loads, which is Included within the PC client', I am sorry but this statement is not at all true. MDUG can also be used for Subsequent loads. I have tested at many places and it really ease the subsequent upload provided you have sound knowledge of MDUG functionality.

      4. You have also mentioned 'Assign roles to local processes', this statement is not true rather unclear. Roles in PC are assigned at entity level (org, process, sub processes etc.) this is a one time configuration exercise done during first implementation. Later we only assign users to these entities.

      I just wanted to make the blog more meaningful by imparting my project experience.

      Hope it helps.



      Author's profile photo Baithi Srinivas
      Baithi Srinivas
      Blog Post Author

      Dear Amit,

      Thanks for your feedback.

      Your experience adds advantage to this blog.



      Author's profile photo Former Member
      Former Member

      Hi Amit,  

      Thanks for your feedback,

      I agree with all your point,  but I have question on audit log,

      Yes we are not able to extract  log for master data change from audit log report.

      Normally we are doing analysis & collection change data from backend table & database table,  and it's very complicated & time consuming process, I have raised OSS message for audit log report. Request your help to suggest alternate option for it


      Amit Nanaware

      Author's profile photo Former Member
      Former Member

      hi Amit,

      the audit log reports does not work in 10.0 and in 10.1 it only shows new values updated in master data in number codes , you can not see the the old value.

      PC product is still not matured and widely used hence these options are overlooked.

      I do not know of any other option to see the master data Change log in PC.

      Do let me know if you get reply from sap please?


      Anut Sharna