GRC Tuesdays: Breaking Up Is Hard to Do—Top 5 Things to Consider When Selecting a Partner

I meet many customers and many prospects in my job and one thing they always ask me for is implementation advice.  Using my experience as a former SAP GRC consultant (specifically focusing on SAP Process Control) I think my best advice is about finding the right partner.

1)Find a partner who has experience in your region.  What I mean is that, while it’s great that they have references globally, you want to make sure that the team that is going to be implementing your solution actually has true experience and has not only taken classes on the subject matter.

2)Find a partner that is familiar with the entire GRC suite of solutions or at least the solutions at you are considering.

• You don’t want to have a journey with a partner for SAP Access Control and then break up only to court another party for SAP Process Control implementation and then repeat the dance for SAP Risk Management.
• It’s best to have partner continuity especially because these solutions are running on the same platform.
• Further, there are interdependencies with the master data and configuration decisions that you make can affect another module’s behavior.  You’ll want to think about the big picture.

3)If the partner refers to “SAP GRC” as a solution, I would run.  It tells me that they may not necessarily up-to-date when it comes to the solutions in the market.

• You want to work with someone who is up-to-date, knows how to navigate the materials which are publicly available online, and is also familiar with the latest advancements in the solutions they plan to implement.
• You don’t want a partner whose skills have gotten stale.
• Continuous learning is very important as the solutions are continuously evolving with innovations such as SAP HANA and ‘Fioritization.’

4)When implementing, I would recommend you implement as standard as possible without any customizations.  I know every business is unique and one size does not fit all, but with customization you’re jeopardizing your ability to upgrade to future releases and take advantage of the newer innovations everyone else will receive in future Support Packs and releases.

5)Leverage a partner that has content that will enhance your implementation.

• Partners may have experience with specific risks/controls/fraud detection strategies and so on for your industry and this content may be an accelerator for your organization when it comes to giving you a return on your investment.
• Yes, SAP has predelivered content for several solutions, but your organization may want to leverage partner content to tackle industry-specific scenarios or operational activities.

Implementation Consultants Determine Your Results

I hope these tips prove helpful when you consider which partners will handle your implementation needs.  I spoke to a customer who felt there was no need for the GRC solutions because their configuration for the ERP had been “stable” for several years and there were strict change management processes in place.

As a former consultant who has looked at many an IMG (i.e. the configuration backend of the ERP and GRC solutions), I’ll tell you that there are several settings that can be turned on and off which define the behavior of a system and that your configuration is only as good as the consultant who did it.

What do you think? Share your experiences with me here, or on Twitter @SAPGRCWirkS .