Implementation of SAP s Compliant User Provisioning solution at Vodafone

Transcription

1 Implementation of SAP s Compliant User Provisioning solution at Vodafone Nick Tuffs Vodafone Global Identity Management Team 21 st November 2011

2 Agenda Background to Vodafone About the EVO Programme Existing and proposed UAM processes Why, What and Who we chose to implement Gathering Requirements Implementation timeline Success Next steps Lessons Learnt Questions 2

3 Background to Vodafone HQ in London and Newbury World s largest mobile telecoms company (by revenues) Second-largest by subscribers (341 million) 4 th largest company on London Stock Exchange Networks in 20+ countries Partner networks in 30+ countries Market capitalisation 93 billion 3

4 4 Vodafone s Global Footprint

5 What is the EVO Project? EVO stands for the Evolution of our existing multi-country business model, to a single, uniform way of running our global business in the finance, human resources and supply chain functions. The largest transformation programme ever approved by the Vodafone Board. The Future State Operating Model is supported by a single IT system - EVO SAP. i. The Core Business Model ii. Shared Service Centres iii. Vodafone Global Procurement Centre (VPC) iv. A Single Enterprise Resource Planning (ERP) system

6 Key Benefits and figures for EVO Consistent and timely cost information Simple and efficient business operations Standardised global processes Leveraged shared services for back office processes The best commercial solutions for global purchasing IT landscape simplification through system consolidation Expected annual cash savings of over 600m 284m savings (08/09) 731m savings (09/10) 2.5bn cash savings over 7 yrs

7 What phase is EVO in now? Evo is approaching the 8 th release phase with live users LIVE MARKETS: UK Germany Vodafone Group Services Portugal Spain Netherlands Ghana Ireland Italy Greece Turkey STILL TO GO-LIVE New Zealand Qatar Czech Republic Romania Egypt South Africa

8 Existing AS-IS UAM process and tools for EVO LOCALLY OWNED APPROVAL PROCESS AND TOOLS GLOBAL APPROVAL PROCESS AND TOOLS VF-HU VF-Ghana VOCH VPC VGS VF-NL MS Excel form Line Manager and Role Owner approvals sent via Ticket can come from OpCo SPOC or via EVO service desk. Ticket is considered as preapproved. Global SoD rules in RAR. CUA connects to all EVO SAP systems VF-ES VF-PT SASI inhouse tool PASI inhouse tool Line Manager and Role Owner approvals managed via SASI workflow Line Manager and Role Owner approvals managed via PASI workflow Manually created ticket Remedy 7 IT Ticketing Tool VOCH UAM perform SoD check Risk and Remediation module of SAP GRC VOCH UAM perform user provisioning Central User Administration System in EVO SAP VF-DE Compliant User Provisioning module of SAP GRC Line Manager and Role Owner approvals managed via CUP workflow CUP performs SoD check CUP performs user provisioning Different local processes to trigger VOCH UAM team to act. Interface is via Remedy tickets and EVO Service Desks. End to end time to process requests is variable as local processes vary SLAs exist for Global side via VOCH UAM team. Manual activity is costly and prone to errors causing SoX issues and cost overheads.

9 Global Solution Piloted for VOCH SSC GLOBAL PROCESS AND TOOLS IDM R3 (OIM) Line Manager and Role Owner approvals sent via IDM workflow IDM creates approved request in CUP and recieves updates on request status EVO PROCESS AND TOOLS CUP module of SAP GRC CUP performs automated SoD check CUP performs automated user provisioning RAR module of SAP GRC VOCH UAM Team manage exceptions Central User Administration System in SAP Automation: IDM provides front end, workflows and triggers CUP to perform SoD check and provisioning. Manual: VOCH UAM team handle exceptions such as SoD conflict and mitigation, provisioning failures and IDM profile loads. This solution has been piloted and proved for VOCH in September 11 and will now be rolled out for all EVO live markets.

10 Project Partners and Scope The Chosen Partners needed to; i. work closely with the in house support teams ii. collaborate closely on the integration of the two tools iii. work to the same project time scales The Project covered i. Online request and approvals. ii. Automatic SoD checks and role assignment iii. The revoke of role assignments The ability streamline the current SPM (fire fighter) request process. Chosen partners were su53solutions for the GRC-CUP integration Wipro for the Oracle Identity Management Solution 10

11 Gathering Requirements Key task performed were; i. Agree the scope for CUP and the division of control with OIM ii. Integration of OIM to CUP via webservices iii. Integration of CUP to RAR iv. Integration of CUP to CUA The Requirement to i. Allow users to raise and track requests in a self-service manner ii. Remove the service desk input by automatically sending requests for approval to be performed directly in the system iii. have all request automatically processed with a back ground Risk analysis. iv. have as little manual intervention as possible in the provisioning process to reduce headcount in the UAM team. Compliance approval of unmitigated risks, before assignment in the EVO system. 11

12 Gathering Requirements Agree the detailed web interface connector requirements for OIM-CUP connectivity. Agree the required Workflows for the OIM CUP integration Agree the required Workflows for the CUP SPM workflow Agree the Systems in scope Agree the roles and role owners in scope Agree the Mapping of Single to Composite roles to match internal Job Aid Agree the SPM ID s and Owners are correct Agree how role data and assignment would be exchanged between OIM and CUP 12

13 Implementation Timescales Extremely demanding timeline i. Inception (early April) ii. Expected Go-live (1 st August) The project was broken down into the following stages i. Design Phase ii. Build Phase iii. Test Phases (integration, product and user acceptance) iv. End user training for the local support team v. Deployment to production (Technical Cutover) vi. Go-Live support vii. Post Go-Live Support Phase (Warranty) 13

14 Success? Since go-live on 15 th September, over 300 requests have been processed to completion for the VOCH. The volume of tickets handled manually by the user administration team has dropped by 160 tickets per month. User feedback on the turn around time end to end has been positive. 14

15 Lessons Learnt Any change to an established user administration process requires training and communications on a detailed level. Vodafone took ownership of the shared project plan and co-ordinating the activities across the multiple teams involved was an intensive process. Connection of the CUA child systems and updating CUP master data must be performed in detail to prevent failed provisioning that has to be debugged. HR master data errors caused workflow approval and provisioning errors. From OIM perspective the schedulers to check and retry tasks sent to CUP are critical to BAU operations. Check that the GRC systems have the hardware required to handle CUP, RAR and SPM as this is managed by IBM for Vodafone. Due to the different platforms involved the support model for end users must be clearly thought out with supporting use cases and training. Line managers and role owners still take some time to approve requests despite it being easier! 15

16 Next Steps We are planning a phased roll out as part of the ongoing EVO release plan following a standardised release plan. Next implementation is for Vodafone Group Services, Vodafone Hungary and Indian Shared Service Center. Our solution although more complex integration wise for the first go-live is relatively simple to rollout to additional markets as technically just the role master data and initial loads have to be prepared for OIM and CUP. Important part is the involvement of the individual markets contacts: HR, Communications, UAM process owners and role owners. Future enhancements of the platform are planned to include user attestation for compliance processes. 16

17 17 Questions