Having worked with the product as a recipient of its reports, this reviewer appreciates that the findings are presented in clear business terms, making them easy to understand and act upon. The limitation is that the reviewer had to rely on the team for deeper analysis, lacking self-service access to explore specific conflicts.
View Full Review
As a SAP Security & Authorization consultant, I run analyses on client environments without waiting for a full enterprise GRC deployment. Uploading a role catalogue and user assignments as flat files gives me a working SoD, SAT and FUE analysis in one afternoon.
The what-if capability changed how I present recommendations. Instead of "remove this transaction", I show clients the FUE impact instantly - data-driven trade-offs beat opinions every time.
What I use most:
-Bulk role import via XML or file upload
-SoD ruleset with sensible defaults for standard SAP areas
-Risk definitions in business terms - process owners read reports without me translating
The UI is genuinely intuitive, which is rare in the GRC category. Review collected by and hosted on G2.com.
The API documentation could be more detailed - I had to reach out to support when integrating smartGRC with a client-side automation pipeline. Mobile experience is also limited (understandable for a GRC tool, but occasionally I need a quick check from my phone during a client meeting). Nothing that blocks day-to-day work, but worth flagging for consultants who juggle multiple client environments in parallel. Review collected by and hosted on G2.com.
The best part of smartGRC is the consistency it brings to compliance reporting. Because the reports are built on defined rules, they’re easier to reproduce, reconcile, and stand behind when it comes time for audits. Review collected by and hosted on G2.com.
What do you dislike about smartGRC?
Draft:
Report formatting customisation is a little limited when I need output to match a
specific regulator or auditor template exactly — I tidy it up afterwards. And with the
AI-flagged items, I'd like slightly more explanation behind each flag. Review collected by and hosted on G2.com.
We use smartGRC for mofe than 12 years by now. Key advantages include:
Depth of customization, issue-oriented support by the developer.
Mass user UI streamlined, yet powerful.
Not limited to SAP environment, but features universal XML data import
Instant reporting and key mass user functionality, reasonable batch processing performance.
Price positioned very competitively against SAP access analytical solution (GRC module), with similar and in some areas even better functionality. Risks are not determined by technical access roles, but can be defined in generic business terms, easy to understand by risk owners, consequently translated by smartGRC underlying queries.
We use smartAccess to manage superuser access across 5 different SAP instances and for some 30 IT support staff. We are currently migrating the landscape to S/4 HANA, with plan to keep current smartGRC functionality.
Additionally we consider enrolling access role design and provisioning with smartGRC support, as a part of the migration.
We've also enrolled periodic user access reviews. Each campaign some 40 tho. individual risks are reviewed by approximately 300 risk owners, both on SAP and various SQL-based business systems.
Both these functionalities significantly ease proving adequate ITGC controls during statutory financial audit (performed by one of Big-4 practices). Review collected by and hosted on G2.com.
I await full transition to containerized environment, as current system setup is quite complex from technology standpoint. Review collected by and hosted on G2.com.
As the IT manager responsible for SAP security, I need a clear view of where SoD risks are concentrated and confidence that access reviews are being performed consistently, all within a single solution. The SoD analysis helps identify and prioritise the areas of highest risk, allowing my team to focus on the roles that require the most attention, while the review workflow provides an auditable record of who reviewed access, when it was reviewed, and what decisions were made.
What makes this especially valuable is the business-oriented risk terminology. It enables meaningful discussions with process owners and allows me to report findings and progress to management in a clear and understandable way, without having to translate technical SAP authorisation details into business language. Review collected by and hosted on G2.com.
The PDF/export styling is a little rigid. When I need a report to match our internal templates exactly, my team usually performs some additional formatting afterwards. It's a relatively minor issue, but probably the limitation I notice most often.
I would also say that some parts of the user interface can feel a bit cluttered and not always intuitive, especially when working with larger data sets or reviewing multiple risks at once. While all the necessary information is available, the screens can sometimes be overloaded with details, making it slightly harder to quickly focus on the most important items. Review collected by and hosted on G2.com.
From the administration side, what I value is that access provisioning runs through
an approval workflow with an SoD check built into the request. Instead of granting
access and finding the conflict later, the conflict surfaces before approval, so
risky combinations don't get provisioned in the first place. As the person administering the platform, I also like that every request keeps a
full approval trail. When someone asks how a given access was granted, the history
is already there and I'm not reconstructing it after the fact. Review collected by and hosted on G2.com.
Some of the more advanced workflow configuration isn't documented as deeply as I'd
like — I got there, but a richer setup guide would have shortened the work. Nothing
that affects day-to-day running once it's configured. Review collected by and hosted on G2.com.
Pricing details for this product isn’t currently available. Visit the vendor’s website to learn more.