[ P&G s Painless Migration to Structural Authorizations Mark Kirschner-HR Security Architect, P&G
[ Learning Points Introducing Org Management to an already mature landscape can be especially challenging from a security standpoint. SAP does not provide customers with any tools to migrate security roles to context-sensitive HR objects It can still be done, however, with a little creativity. 2
[ Agenda Agenda Introduction Characters from our Story The Case for OM at P&G The Security Dilemma Quick HR Security Primer The Challenge The Solution Lessons Learned
[ Introduction Mark Kirschner Agenda 22 Years @ P&G 15 Years in SAP HR Custom Development (ABAP) Security Enterprise Portal Platform Operations Business Controls/Compliance
[ Cast of Characters The HR Function Wants to dramatically improve HCM capabilities Will pay whatever it costs!! Just get it done! End-to-end Talent Management
[ Cast of Characters IT Department / Data Architect Must overhaul the custom OM solution and adopt SAP OM integration. Must sell the new concept of OM to the organization
[ Cast of Characters SAP Security Team Must implement OM Structural Authorizations without breaking anything. Must quietly modify >2000 security roles affecting >100000 employees.
[ The Case for OM @ P&G
[ Why OM? What s Changed? The Industry has caught up to P&G in terms of some HCM offerings & capabilities Time to switch tracks and shift from nonintegrated custom solutions to SAP standards powered by OM P&G s HCM Capabilities ERP HCM Capabilities 1998 2010
[ Business Drivers Productivity SAP OM Build From Within Simplification
Global Core Recruiting Learning Skill Management Performance Management Succession Planning Compensation Benefit [ HCM- Industry View P O R T A L ESS MSS DUET Adobe Personnel Administration (PA) Organizational Management (OM)
Global Core Recruiting Learning Skill Management Performance Management Succession Planning Compensation Benefit [ Human Capital Management at P&G HR data is comprised of PA (e.g.: employee data) along with partial, custom OM data HR data is supplied to our HCM systems/services via custom interfaces Each HCM system and its underlying OM data is independent and not globally accessible across systems Lack of end to end Talent Management integration introduces Shadow systems and manual data reconciliation Managers and employees have multiple, disconnected access points OM data not leveraged outside of HCM Key Strengths to Preserve: Global PA data drives transactional systems (e.g. Payroll) Organization & Staffing Flexibility Life & Career SAP NW Portal CUSTOM PORTAL SAP PORTAL Custom MSS ESS Custom Interfaces Personnel Administration (PA) Custom organization management C 3 = Reports = Database = Interface(s)
[ What is SAP Organization Management? In its simplest form, OM is: Taking a bunch of data we have today Business Unit Cost Center Person Function Region / Skills / Country Qualifications Plus a few new fields Band Level Position Location Free Critical Position Organization And storing / linking it in a new way in order to utilize core SAP capability and enable flexibility & integration!
[ P&G s HR Data Today One Way, Singular Flow, Limited Everything links to a person BU can only be determined by Cost Center (Financial Hierarchy) Can t report below the BU / Cost Center Level Custom data structure makes it difficult to integrate HCM systems Band Level Person Business Unit Region / Country Position Skills / Qualifications (GCSDS) Cost Center Function Location Free Critical Position Organization
[ P&G s HR Data Enabled by OM Flexible, Agile, Accurate, Complete Employees can roll-up to a BU / organization independent of Cost Center Reporting can occur down to any level manager of others Standard SAP data structure makes it easy to integrate & enables flexibility Attributes can tie to people AND positions (for history tracking, broadening assignments, etc.) Band Level Cost Center Business Unit / Organization Function Other Personal Information: Critical Position Position Person Salary, Rating, Address, Birth Date, Hire Date, Etc. Location Free Skills / Qualifications (SAP) Region / Country
[ OM Data & Job Architecture Description Short / Technical Name Example Long / Descriptive Name Example Functional Area Represent the various functions in the Company. Functions are categories of work or skill groupings at the most basic, foundational level of the job architecture. They do not belong to the individual employee, but rather form the foundation for the job and position and are used in talent & succession planning. PS-MAN IDS-IDS PS-Manufacturing, IDS- Facilities Job Family Classifies the various Job Groupings or Families within an Organization. Used for Compensation and is the basis/starting point for defining Jobs. Job Families will be defined using the existing role families as defined by the Functions in the Company. IDS-ARCH HR-OPS Architects, HR Operations Job Jobs, which cannot be directly held by a person, are classifications of functions in the Company, which are defined by the assignment of characteristics. Jobs serve as job descriptions that apply to several positions with similar tasks or characteristics. Jobs will be defined using the existing role types as defined by the Functions in the Company. Band Level will also be incorporated here due to direct relationship to compensations codes & levels. ARCH-BUS-B2 CM-MGR-B3 Band 2 Business Architect, Band 3 Client Manager Position Represents a specific chair or post which can be occupied by a person (employee) in the staff assignments of an organizational unit. Positions differ from jobs. A job is not concrete but rather the basis for the creation of various positions with similar tasks and characteristics. <OrgUnit-JobFamily> ITDO-ARCH1 <customer><primary & secondary skills/role title><level Desc>, HRSS Architect and Java SME Org Units Represents a functional unit in the Company. According to how tasks are divided up within the Company, this could be a business unit, department, group or project team, for example. Note: Organizational units differ from other units in the SAP enterprise structure such as personnel areas, company codes, business areas etc. GBS-ITDO CF-Legal GBS - IT Development & Operations, Corp Function - Legal
Simplification, Integration & Cost Savings [ End 2 End Talent Management Project Evolution Phase 1: Discovery Organization Management Proof of Concept Benchmarking Enrollment Reporting COMPLETE Phase 2: Develop & Build Track 1: SAP OM Digital Foundation Build Basic, Stand Alone SAP OM Structure OM Data Collection & Verification with HR BAMs Establish OM COE & Governance Model Track 2: Talent Management Organizational Charts Organizational Modeling Band 6+ Succession Planning Talent Visualization Track 3: Workforce Analytics Analytics Workshop to Define KPIs, Definitions, Data Source and Data Readiness Vendor Discovery Design of Solution Purchase Phase 3: Integrate/Leverage Track 1: SAP OM Digital Foundation Integrate Stand Alone SAP OM Structure with PA Integration Managed with EDM Transformation Track 2: Talent Management Expansion of Talent Management Processes Decision on Developing Position Qualifications Decision on Replacing or Integrating HR Point Systems Track 3: Workforce Analytics Real-Time Reporting and Visualization of Workforce Analytics Introduce Predictive Analytics Time
[ Questions OM Will Answer Is the span of control for each of your managers consistent across sites? What organizational changes did you make last week, month, year? Who in your organization is in a critical role? How many employees work in each region, BU, function, organization? Who in your organization has a dotted-line reporting relationship? What will the org look like after this restructure/acquisition/divestiture? How many layers removed from senior leadership are the employees calling on customers? What is the position history for a person or the person history for a position? Which employees are part of a particular organization? Where are your vacant positions? How many positions are location free? Which positions are filled with nonharmonized? Contractors? Employees?
[ OM Will Not Immediately Answer But rather provide the Data Foundation and enable: o Workforce Planning & Analytics Cost and Workforce Projections, Financial Impact of Org Changes, NOS per FTE Talent Visualization o Talent Management Succession Planning Skills & Competency Tracking HCM System & Employee Data Integration New Industry Capabilities (if/where desired) Automation (Workflow) Learning 2.0 o System & Process Integration Automation (Workflow) for manager and HR tasks Automation of security roles & access (Company wide, not just HR systems) E2E HR Process globalization, automation & simplification (HR Forms renewal)
[ Impact & Readiness for OM at P&G Data Existing HCM Technology SAP OM Business & Process Applications Governance
[ HR Security Background
[ 3 Types of HR Security Objects, Organizational (ORGIN) P_ORGIN, P_ORGINCON Administrative (ORGXX) P_ORGXX, P_ORGXXCON Custom (NNNNNN) P_NNNNN, P_NNNCON 2 Flavors of Each Type Standard (non-om) Context-Sensitive (OM)
[ 3 Types, 2 Flavors.
[ HR Security Switch Framework (transaction OOAC) 1. Transaction OOAC sets all the switches for HR Authorizations (table T77S0)
[ Standard vs Context-Sensitive Objects
[ The Challenge: For every security role on the system, we need to upgrade from the existing standard objects to the new context-sensitive objects. P_ORGIN P_ORGINCON P_ORGXX P_ORGXXCON Z_ORGX1 Z_ORGXCON 6000+ roles to maintain!
[ How to modify 6000+ roles quickly and accurately? As SAP does not provide a utility to perform a mass role conversion from standard HR authorizations to context sensitive HR authorizations, a custom program is necessary for this.
[ The Solution: ABAP Program to Modify 6000+ Roles ZSXXMIGRATE_TO_CONTEXT_AUTHS Reads tables AGR_1250 and AGR_1251 and appends new entries into them, maintaining node linkages. Automatically regenerates roles to update underlying SAP security profiles (table USR10,USR12 ) Must be run separately in each client, as roles are client dependent
[ AGR_1250
[ AGR_1251
[ Key Learnings Even in mature landscapes it is possible to introduce structural authorizations to thousands of roles without too much disruption. 31
[ Key Learnings Sandbox environments are essential for trying novel ideas without risking your development landscape. 32
[ Key Learnings Sometimes you can have all three. (if you can find a way to automate)! 33
[ ] Thank you for participating. Please remember to complete and return your evaluation form following this session. For ongoing education on this area of focus, visit the Year-Round Community page at www.asug.com/yrc [ SESSION CODE: 1711 34