Hi Andrzej,
We run an user level simulation report to get a month end audit report. As well as we also check the dashboard reports.
For various risk Ids the mitigations are not same as no. of violations in GRC. Also when we compare the same report between 4 and 10 the Violation matches but mitigations dont.
The risk Ids are not static. For example for the risk ID F018 the violation and mitigation matches for the month of June and it dont match for the month of July.
Thanks & Regards
Ratan.