What exactly is an HR Trigger? In short, it is a request automatically launched by GRC Access Control when a specific change is made in HR master data.
HR Triggers are commonly used to monitor employee terminations in a company, as each time HR processes a termination, GRC will launch an automatic request at the moment of the change recorded by HR, updating the validity date in all SAP systems connected to GRC where the user exists by the end date of the contract. Of course, there are more possibilities, all in which an organization wants to monitor changes in HR infotypes, for example: launching requests like:
- Request for account deletion and/or blocking due to company termination.
- Request for a new account due to hiring in the company.
- Account change request due to a change in an infotype value (e.g., position, company, etc.).
- Account change request (validity date) due to termination in the company.
Operating Basis
Expanding a bit more on this concept, the operation is quite simple. From the system where the client has the HR master data (normally the central ECC system), a queue is created with all the changes made to the HR infotypes. This queue contains the infotype, the modified field, the previous value, and the new one. This queue is passed to GRC through an RFC connection, which reads all the changes through a BRF and detects those that the client wants to control, and once one of those changes is made, GRC will automatically open a GRC ARM request in the format the client wants to design.
Configuration Requirements
What are the prerequisites? Before starting a project to configure HR Triggers in GRC, it is necessary to ensure that the following points are already configured. There are several points to consider:
- GRCPIERP & GRCPINW components must be installed in the HR system.
- The Access Request Management module must be implemented so that GRC can launch automatic requests (in the GRC system).
- All employees who may be affected by HR Triggers must have their SAP ID correctly maintained in infotype 105 (data found in the HR system, usually the central ECC system). This point requires a more extensive explanation, as it is very important. In infotype 105, the SAP ID relationship with the employee number is maintained, and when GRC locates a change in a field that needs to be monitored, it will search in this infotype for the SAP ID of the updated employee number and launch the automatic request for this SAP ID. The importance of maintaining this attribute (SAP ID in infotype 105) at the employee level is explained with two examples:
- Unexecuted termination: imagine we have configured HR Triggers for employee terminations, if a case occurred where an employee did not have an SAP ID assigned in infotype 105, although HR would process the termination, the automatic request could never be managed, as GRC would not find their SAP ID.
- Incorrectly executed termination: if the maintained SAP ID were that of another different employee, the wrong employee would be terminated.
Key Points
In short, with HR Triggers, changes in infotypes that the organization needs to be always controlled can be automated, without exceptions and without possible human errors due to forgetfulness, preventing actions, such as user terminations, which are essential for the proper functioning of an organization.
HR Triggers are requests that can have the approval stages considered by the client, but for example, for terminations, they tend to be requests without approval stages, meaning they are completed as soon as they are opened, in which the user’s validity date in the SAP systems is updated. Thus, when the contract expires, the validity of the user will have expired.
Additionally, there is a standard SAP program that blocks expired users, so if this program is run in a daily job, the termination system is very effective.