Briefly explain the common roles and key duties of GRC based on SoD.

These are the following common roles and their key duties based on SoD:

Business Process Owner:

• Identifying and approving risks for monitoring.
• Approving remediation that involves user access.
• Designing controls to mitigate conflicts.
• Communicating about role changes or access assignments.
• Performing proactive continuous compliance.

Senior officers:

• Approving or rejecting risks between business areas.
• Approving mitigation risks for selected areas.

Security Administrator:

• Assuming the ownership of GRC tools and security processes.
• Designing and maintaining rules to identify the risk conditions
• Customizing GRC roles to enforce roles and responsibilities.
• Analysing and remediating SoD conflicts at the role level.

Auditors:

• Performing risk assessment on a regular basis.
• Providing specific requirements for audit purpose.
• Performing periodic testing of rules and mitigation controls
• They act as a liaison between external auditors.

SoD Rule Keeper:

• Performing GRC tool configuration and administration.
• Maintaining controls over rules to ensure integrity.
• They act as a liaison between basis and GRC support center.