Vrishabh Sanas

Total of 8 years of experience in SAP GRC Access Control, Process Control, Risk Management Application, SAP Audit Management, SAP BIS & SAP Security. Certified SAP GRC Access Control 12.0 Professional. Involved in multiple GRC AC, PC, RM & AM implementations as well as Role design and multiple SAP Security and GRC support projects.

SAP GRC & SECURITY SENIOR CONSULTANT - ERNST & YOUNG INDIA

(2025-10)

• Collaborated closely with business process owners to define, document, and implement business and ITGC controls, using Continuous Control Monitoring (CCM) capabilities within SAP GRC Process Control to automate control execution, monitoring, and exception handling.
• Designed, implemented, and tested automated CCM configurations in SAP GRC Process Control using advanced table queries and ABAP-based logic; performed evidence extraction, execution testing, and supported audit reliance activities. Successfully automated P2P and O2C control testing to enable near-real-time deviation detection.
• Managed organizational hierarchies, processes, sub-processes, and control master data uploads via MDUG, including configuration of master data maintenance workflows to streamline control management.
• Planned and executed comprehensive manual and automated test plans for process controls, including scheduling and monitoring background jobs to ensure continuous control monitoring.
• Architected and deployed a centralized CCM framework integrating a single SAP GRC 12.0 hub with 35 remote SAP ECC and S/4HANA systems. Developed Data Sources (Config Check type) and Business Rules to systematically monitor critical configuration table changes (e.g., company codes, payment terms, three-way match tolerances).
• Implemented workflow-based email notifications for automated monitoring workflows, CDA, and self-assessments, enhancing timely communication and issue resolution.
• Monitored SAP GRC Process Control background jobs, resolved system dumps, and managed daily batch processes to maintain uninterrupted compliance operations.
• Delivered structured end-user and administrator training sessions, conducted knowledge transfers, and provided hyper care support (access troubleshooting, stabilization, and configuration fine-tuning) to ensure smooth operational transitions.
• Conducted SoD and Critical Access risk analysis and documentation using SAP GRC Access Control (ARA), including granular rule-level analysis at authorization object and field-value levels, and prepared risk assessment reports for stakeholder approval.
• Executed SoD risk simulations to validate the impact of proposed roles, access changes, and user assignments, fine-tuning system rules to ensure accurate, real-time risk detection prior to provisioning.
• Evaluated segregation of duties (SoD) and access controls across applications to ensure compliance with SOX standards and internal policies.
• Authored comprehensive business proposals and pitch decks for SAP GRC and Security projects, detailing project scope, resource requirements, timelines, and cost-benefit analyses to support stakeholder decision-making.
• Defined strategic roadmaps for GRC Access Control modules (ARM, ARA, EAM) and continuous control monitoring across SAP S/4HANA and ECC landscapes, driving enhanced governance and risk management.

SAP Security & GRC Consultant - Deloitte USI

(2024-09 - 2025-10)

• Leading SoD Review and Process Control implementation for a major American mining client.
• Implemented automated Control Continuous Monitoring, Manual Test of Effectiveness to proactively identify and address control deficiency, ensuring accurate evaluation of control performance and supporting audit readiness.
• Enabled both offline and online surveys for control design assessment and self-assessment.
• Developed data source and business rules for multiple systems to effectively automate control monitoring across different landscapes.
• Implemented SAP GRC Process Control Policy Management functionality for centralizing policy documentation, version control, and ensure compliance with regulatory requirements.
• Reviewed existing risk rulesets, sensitive actions, and permissions; provided actionable recommendations for improvement.
• Conducted risk analysis, identified high/critical access risks, and advised on remediation strategies.
• Facilitated client kick-off sessions to map current risk compliance processes and identify configurable controls.
• Designed and built data sources and business rules for ITGC controls, configured workflows per client requirements.
• Delivered training to IT teams and control owners; led User Acceptance Testing (UAT). Mentored project team members on SAP GRC Access Control configurations and SoD rulesets.
• Developed SAP GRC Risk Management training materials and delivered sessions to internal Deloitte teams.

SAP GRC & SECURITY SENIOR ASSOCIATE - PWC SERVICES LLP

(2021-11 - 2024-08)

• Implemented SAP GRC Access Control 12.0, Process Control, and Risk Management for a Middle Eastern government client.
• Performed post-installation activities and conducted stakeholder sessions to gather requirements.
• Designed BRF+ initiator and agent rules; configured MSMP workflows for ARM, BRM, EAM, and UAR modules.
• Built and configured Process Control (ToE, CDA, CCM) and Risk Management workflows.
• Developed user-defined fields and maintained master data in Arabic and English.
• Prepared business blueprint documents and led UAT with client stakeholders.
• Managed cutover and go-live activities for Access Control and Risk Management applications.
• Configured SAP Audit Management and integrated GRC Access Control with client ticketing tools via web services.
• Guided teams in developing BRF+ applications and optimized GRC configurations for multiple clients (pharma, oil & gas, motorcycle manufacturing).
• Analyzed security data (user, SU24, roles, transactions) to inform design decisions.
• Automated mass role creation using SECATT scripts, reducing maintenance time.
• Supported business development by preparing client proposals, presentations, and system demonstrations.

SAP SECURITY AND GRC CONSULTANT - LARSEN & TOUBRO INFOTECH

(2018-06 - 2021-10)

• Supported SAP Security projects for global clients, managing user IDs and security roles across environments.
• Created and maintained single, composite, and derived roles; managed transports via SOLMAN Change Management.
• Implemented and analyzed task-based roles, identifying and remediating SoD violations.
• Automated mass role changes and user master record creation using scripts.
• Maintained authorization objects (SU24) and resolved authorization issues using ST01 and SU53 traces.
• Supported GRC Access Control provisioning, business role creation, and SAP Fiori role development.
• Produced and analyzed SAP security reports (SUIM, AGR*, USR*) to address audit points and periodic reviews.
• Managed Firefighter and emergency access through GRC; automated user ID termination for separated employees.
• Resolved operational issues via Service-Now ticketing system.

Bachelor of Engineering - Electronics - RAMRAO ADIK INSTITUTE OF TECHNOLOGY, UNIVERSITY OF MUMBAI (2014 - 2018)