Auditing and GRC Automation in SAP

Maxim Chuprunov

Auditing andGRC Automationin SAP

Maxim ChuprunovRiscomp GmbHRothenthurm, Switzerland

ISBN 978-3-642-35301-7 ISBN 978-3-642-35302-4 (eBook)DOI 10.1007/978-3-642-35302-4

Library of Congress Control Number: 2013932469

©2011 by Galileo Press, Bonn, Germany.Title of the German original: Handbuch SAP-RevisionISBN: 978-3-8362-1603-6

ACM Computing Classification (1998): J.1, K.4, K.5, K.6

Springer© Springer-Verlag Berlin Heidelberg 2013This work is subject to copyright. All rights are reserved, whether the whole or part of the material is concerned, specifically therights of translation, reprinting, reuse of illustrations, recitation, broadcasting, reproduction on microfilm or in any other way,and storage in data banks. Duplication of this publication or parts thereof is permitted only under the provisions of the GermanCopyright Law of September 9, 1965, in its current version, and permission for use must always be obtained from Springer.Violations are liable to prosecution under the German Copyright Law.

The use of general descriptive names, registered names, trademarks, etc. in this publication does not imply, even in the absenceof a specific statement, that such names are exempt from the relevant protective laws and regulations and therefore free forgeneral use.

Printed on acid-free paper.

Springer is part of Springer Science+Business Mediawww.springer.com

v

Foreword

Over the last few years, financial statement scandals, cases of fraud and corruption, dataprotection violations, and other legal violations have led to numerous liability cases,damages claims, and loss of reputations. As a reaction to these developments, numer-ous regulations have been issued: Corporate Governance, Sarbanes-Oxley Act, IFRS,Basel II and III, Solvency II, BilMoG, to name just a few. The requirements behind theseregulations are complex and no longer affect only internationally active listed compa-nies – the topic of “compliance” has also found its way into management levels andmonitoring bodies (such as supervisory boards, internal audit teams, auditing).

Under the term compliance, we generally understand the observance of legislation,guidelines, and voluntary codes within an organization. There are generally recognizedframework concepts for setting up a compliance management system (for example,COSO,OECDprinciples of corporate governance), alongwith framework concepts thatemphasize the specific details of individual industries or compliance-relevant areas (forexample, FDA compliance).

The first step has been taken in many ways: organizations have reacted to the floodof national and international compliance laws and directives and have taken measuresto ensure compliance. The task now is to integrate the individual activities, such as theinternal control system, the risk management system, contract management, internalaudit, etc. in a compliance management system and – as far as possible – to automateit in order to achieve a balance between compliance and performance. The observanceof compliance alone represents an additional cost factor for organizations; it is onlywith the balance between compliance and performance that the opportunities offeredby the implementation of the regulatory requirements can be used. Therefore, the im-provements in the processes, combined with efficiency increases, can and should beimplemented within the scope of observance of the regulatory requirements. In gen-eral, an improvement in and standardization of the processes, under consideration ofregulatory requirements, requires the inclusion of the IT systems; here, the SAP solu-tions for GRC are an option.

The literature currently available restricts itself primarily tomapping controls in SAPERP and auditing SAP systems. This book also provides help in this respect, but goesfar beyond this content. Starting with the requirements for compliance (Part I), it notonly addresses and answers compliance-relevant questions in the form of an audit guidefor an SAP ERP system (Part II), but also shows how to map an (automated) compli-ance management system in an SAP ERP system (Part III). This book thus addressesthe current need for solutions for implementing compliance management systems inan organization. Furthermore, the book shows which risks and controls internal andexternal audit should focus on when auditing an internal control system mapped inSAP or a compliance management system.

The implementation of a compliance management system in SAP ERP requiresknowledge of both the underlying legislation and legal standards and the technicaloptions for implementation. In this book, Maxim Chuprunov has applied his extensiveexperience from both areas. This experience comes from his professional career to date,during which he has been involved on one hand with auditing IT systems in general,

vi Foreword

and SAP systems in particular, and on the other hand with the implementation of SAPERP systems and the SAP solutions for GRC.

I am convinced that it is precisely this combination of theoretical and practicalknowledge that make this book so special. Both those who decide on and those whoimplement compliance and compliance management systems in an organization, aswell as internal and external auditors and monitoring bodies, will benefit from thisbook in their respective fields of activities.

AnnettNowatzki,member of the board of directors at DSJ Revision undTreuhand AG,Berlin.

vii

Trust Is Good, Control Is Cheaper:Introduction

Thenecessity of overcoming risks and establishing an internal control system (ICS) is atthe very top of the agenda for top management in organizations and has brought auditand consultancy companies good business for many years.

Why compliance?Can the implementation of legal requirements have a deeper meaning and benefitbeyond simply complying with legislation? Of course it can – if you do it correctly.Experience from practice shows the following:4 One aspect that is often neglected is the fact that due to its traditional orientation

on compliance, an ICS can also include the monitoring of business processes withregard to efficiency, profitability, and performance. Therefore, an ICS is not justabout legislation.

4 Even if the compliance is only in the sense of legislative compliance, this is generallymore cost-effective as non-compliance can be expensive (as shown, for example,by the bribery scandal at SIEMENS in 2006, which was covered extensively in thepress).

4 As a set of rules issued by the state in the exercise of its regulatory role, complianceprotects the general public from many evils. You may remember the spectacularbankruptcies of ENRON, FLOWTEX, etc. Amongst other things, they were causedby manipulation of external financial reporting.

4 Various compliance initiatives require that complex processes in an organizationare described cleanly (often for the first time). It is easier to control transparentprocesses, and the controls identified also benefit business operation.

4 An inefficient compliance management process uses up a lot of resources. Au-tomating this process can ease the workload for the organization’s managementconsiderably.

4 And last but not least: compliance can have direct financial advantages, such aslower capital lockup as a result of more precise or risk-specific equity definition, orcheaper credit due to an improved rating by rating agencies.

Why is compliancea challenge?

Thus, there are numerous reasons for considering compliance requirements assomething other than just a necessary evil. However, efficient implementation of theserequirements and setting up an effective ICS were, and still are, not easy:4 The complex ERP environment requires specific know-how, and in the case of IT-

supported business processes, it is not always clear what risks they bear and whatcontrol mechanisms are in place.

4 Neglecting compliance requirements during the implementation of an SAP systemcan have serious consequences. Hindsight is always a great thing – but not con-sidering compliance requirements when implementing SAP generally makes youpoorer. Implementing SAP is a costly undertaking and a subsequent redesign istime-consuming and expensive.

4 Controls must be lived: it is not the controls that are correctly documented andtested that are effective, but those that are actually executed. However, withouta check, compliance is unimaginable – but the automation that is often missing

viii Trust Is Good, Control Is Cheaper: Introduction

in practice causes a great deal of administrative effort. Microsoft Excel sheets,e-mails, and manual system evaluations often dominate the audit and ICS world,and real-time reporting is frequently not possible.

4 The automation of an ICS could provide answers to many of the questions that cur-rently occupy the world of compliance:5 How can you bring operative and audit-specific views of control mechanisms

together?5 Is real-time reporting of the status of compliance available at the push of a but-

ton?5 How can youmap the ICS so that the different requirements of riskmanagement,

internal audit, external financial statement audit, and industry-specific controlare fulfilled efficiently?

How to do itcorrectly

In order to implement an ICS correctly, you have to bring together many parts of thepuzzle:4 Internal ICS and compliance objectives with regard to efficiency, profitability, and

performance4 Legal requirements and their effect on today’s world of ERP-supported processes4 “Translation” of the compliance requirements into the language of a respective ERP

system – for example, SAP ERP4 Design and structure of an ICS model in the IT environment4 Automation of an ICS compliance process4 Automation of test and monitoring scenarios through integration4 Handling of internal and external audit as well as risk management integration.

The highly topical and exciting overview and the vision of the automated ICS andcompliance processes in the SAP ERP environment of a well-managed organization,in which the individual pieces of the puzzle come together, motivated me to write thisbook.

Subject, Structure, and Content of the Book

Ever-increasingrequirements

The big wave of legislation-driven ICS projects was triggered by the Sarbanes-OxleyAct in 2002. It also affected all European companies listed on the US stock exchange.Gradually, the requirements and risks etc. to be made transparent and minimized bythe ICS encroached on other organizations in Europe through EU directives and otherlocal legal initiatives. Overall, the worldwide trend, regardless of whether we considerthe impending introduction of China SOXor developments in other emergingmarkets,shows that a functioning ICS, as a compliance requirement demanded by the state, isestablishing itself quickly.

Compliance as partof GRC

The topic of governance, risk, and compliance as a single concept (referred to as anintegrated GRC approach) appeared on the market only recently, and the merging ofGRC with the topics of strategy and performance is a very new trend. It is reflected inrelevant software solutions as well as recognized reference models. Thus, it is no longerappropriate to consider compliance in isolation.

Trust Is Good, Control Is Cheaper: Introductionix

ICS in the ITenvironment

In this book, compliance is understood as the process, mapped in an ICS, that isintended to guarantee conformity with legal requirements and internal policies andobjectives (in particular, efficiency and profitability). An ICS was already known be-fore the age of the computer, but new special features have arisen with the progress ofinformation technology: the transaction audit as an audit approach, and in particu-lar, the consideration of the ICS and the software-specific application controls withinthe framework of external audit have become established as mandatory. The answer tothe question of what that all means for organizations whose processes run with ERPsupport must be clearly structured and described.

Compliance at thepush of a button

The last few years have seen an increase in the number of software products on themarket that allow you to design the ICS process efficiently – where applicable, in inter-action with risk management. However, the basic understanding of the processes in anIT-supported compliance management process is not delivered with the software.

Concept of thisbook

As you have seen, there are numerous puzzle pieces around the highly topical issuesof ICS and compliance. You have to bring them together to get a good overview. Thisbook considers the connection of compliance with the other parts of GRC (corporategovernance and risk management), insofar as this is required by the integration view,in order to indicate the possible synergies and to explain the integrated GRC approach.This book, however, focuses on ICS compliance itself. It looks at this topic from the viewof an SAP ERP-dominated IT environment, and develops it, from a design perspective,in three stages:

1. From legislation to concept2. From concept to content3. From concept and content to automation

Figure 1 summarizes the idea and structure of this book.

PART I – From Legislation to Concept:ICS and Compliance in the ERP Environment

ICS compliance in the SAP ERP environment – these words trigger many questions,even for experts: Which view of compliance is meant? Which legal and internalrequirements are in focus? What does an integrated GRC approach based on SAPsoftware look like? The first part of the book provides answers to these fundamentalquestions.

In Chap. 1, “Legal Requirements in ICS Compliance,” you will learn what is under-stood under the term ICS, and what the relevant legal compliance requirements are inan international and cross-industry comparison.

Chapter 2, “The Auditor Is Coming: When, Why, and How to Cope,” explains thespecial conditions that the audit in the IT environment is subject to and summarizesthe most important facts and recommendations from audit practice.

In Chap. 3, “ICS Requirements and ERP Systems: Basic Principles, Frameworks,Structure,” we show you the basic principles for defining the content of an ICS in theSAPERP environment and the internationally recognized studies and referencemodelsthat can help you to do this. The chapter highlights the importance of the continuous

x Trust Is Good, Control Is Cheaper: Introduction

Concept of this book

From legislation to ICS concept

The ICS: criteria and requirements

Frameworks for ICS implementation

SAP AG & compliance — overview

ICS compliance

ICS automation

- DIY approach: understand SAP- Controls and auditing them in the SAP environment: structured according to ICS principles- Special topics: fraud and FDA

From ICS concept to SAP content

ICS automation: Process modelingand implementation with SAP GRCPC

Automated monitoring and audit through integration with SAP ERP

Implementation experience

From ICS concept and SAP content to automation

1.

2.

3.

. Figure 1 Concept of this book

monitoring approach. A new feature in this edition is the description of how to set upan efficiency-oriented and profitability-oriented ICS framework.

Chapter 4, “HowDoes SAPDeal with Risk- and Compliance-Related Topics?” sum-marizes the most important facts for making your compliance-relevant processesmoreefficient. These facts range from certification of SAP software solutions to sources ofdocumentation for controlmechanisms in SAP and an itemization of the software prod-ucts. This chapter also describes the integrated GRC approach that is based on thecomponents of the SAP solutions for GRC Release 10.0.

PART II – From Concept to Content: Audit Guide for SAP ERP

Howdo you translate the ICS compliance requirements into the language of SAP?Whatrisks and controls are there in SAP ERP-supported processes? And how can you im-plement and monitor the efficiency of the SAP ERP-supported processes? You will findthe answers to these questions in the second part of the book.

Trust Is Good, Control Is Cheaper: Introductionxi

In Chap. 5, “Audit-Relevant SAP Basics,” we explain the basic connections in theSAP system and provide you with a tool for an independent search for control- andaudit-relevant information in SAP ERP.

Chapter 6, “IT General Controls in SAP ERP,” looks at both general organizationalcontrols and topics around change management, critical authorizations, and the basicsystem security.

In Chap. 7, “General Application Controls in SAP ERP,” you will learn how to en-sure the general observance of the principles of traceability and completeness duringprocessing in SAP ERP.

The titles of Chap. 8, “Controls in Financial Accounting,” Chap. 9, “Control Mech-anisms in the SAP ERP-Supported Procure to Pay Process,” and Chap. 10, “ControlMechanisms in the SAP ERP-Supported Order to Cash Process” speak for themselves:these SAP-supported processes bear risks that directly endanger observance of com-pliance. The related control mechanisms are vital for survival and are described in therespective chapters.

In Chap. 11, “Data Protection Compliance in SAP ERP Human Capital Manage-ment,” you will learn which legal requirements regulate the treatment of personal dataand how to implement these requirements in SAP ERP.

Chapter 12, “Fraud in an SAP System,” is dedicated to the topic of fraud. There isalways a risk of fraudulent activities wherever material values andmoney are dealt withusing SAP. In this chapter we use examples to show how you can handle this risk.

Chapter 13, “Excursion: FDACompliance andControls in SAP,” affects every readerof this book either directly or indirectly: the control mechanisms required by law inthe pharmaceuticals and food industries, which focus primarily on the quality of theproducts manufactured, must be mapped in the SAP processes. We address the mostimportant of these controls here.

Chapter 14, “Examples of Efficiency-Oriented and Profitability-Oriented AnalysisScenarios in SAP ERP,” gives detailed examples for each of the four elements of anefficiency-oriented ICS framework: process-oriented analyses, quality of master data,master data changes and user input, and supplementing reports. The aim of the highlevel of detail presented is to provide you with “do-it-yourself ” instructions for settingup various analysis scenarios. It is also intended to give you an impression of the workinvolved in implementing continuous monitoring scenarios.

PART III – From Concept and Content to Implementation:Automation of an Internal Control System

Compliance at the push of a button is a realistic scenario. Software products that helpyou to automate an ICS are now available on the market. What is not widely availableon the market, however, is a range of ICS processes and ICS content, together with theirsoftware-based implementation, from one source. On one hand, the Big Four auditingcompanies, as well as various compliance consultancy agencies, offer ICS content andconcepts often based onMicrosoft Excel; on the other hand, the conceptual complianceview is missing in both existing literature about ICS and GRC software and from con-sultants from software companies. The aim of this part of the book is to give you bothconceptual and technical instructions for implementing ICS and compliance manage-ment processes (based on the SAP solutions for GRC Release 10.0).

xii Trust Is Good, Control Is Cheaper: Introduction

In Chap. 15, “ICS Automation: How to Set the COSO Cube in Motion,” we ad-dress the conceptual importance of ICS automation and explain the individual buildingblocks that you can use to model the automation of ICS processes. You do this in theform of an ICS implementation matrix.

InChap. 16, “ICSAutomation Using SAPProcess Control,” we show you how to im-plement the compliance and ICSmanagement process using SAPGRCProcess Control.You will also learn why, and using which integration scenarios, Process Control can beseen as part of an integrated GRC concept and strategy and performance managementconcept.

In Chap. 17, “Implementation of Automated Test and Monitoring Scenarios in theSAP ERP Environment,” we explain which options – including the integration of SAPProcessControlwith your SAPERP systems–make the great vision of a “test at the pushof a button” possible. We will take you step-by-step through the setup of the continuousmonitoring approach in SAP GRC Process Control 10.0.

Chapter 18, “Experiences from Practice and Projects,” presents numerous projectexperiences that show how organizations from various industries have automated theircompliance processes. The chapter summarizes the most important facts about projectsetup for implementing SAP GRC Process Control and gives some examples of imple-mentation projects at SAP customers.

Target Audience for this Book

As a reader, what existing knowledge do you have? Although only healthy commonsense and some basic business knowledge is required for Part I of this book, overall,and particularly for the remaining parts, SAP ERP experience would be an advantage.A compliance and ICS consultancy background is ideal for this book.

Who is the target audience for this book?4 ICS owners, internal audit employees, external auditors, IT auditors, compli-

ance expertsThis is the book for you – from the first to the last chapter!

4 Managers of SAP competence centers, project managers, data governance ex-perts, business analysts, and consultants for SAP ERP implementationsIt is not easy to consider the compliance requirements when implementing SAPERP. Therefore, Part I and Part II in particular provide you with important infor-mation for designing your implementation projects so that they are audit-compliantand ICS-compliant, and for daily operation of the SAP ERP applications.

4 SAP consultants for SAP GRC ProductsPart III should be mandatory reading for you. In your implementation projects,where the focus is on the process view of the ICS, you should never lose the refer-ence to the ICS content: therefore, Part II is also important for you. And last butnot least: it is essential that you understand the complex connections between legalrequirements and the implementation of these requirements in the IT environmentin order to find a common compliance language with customers. Therefore, Part Iwould also be relevant for you.

4 MBA, business, and information management studentsPart I and Part II of this book are particularly interesting for you: Part I looks in de-tail at the legal requirements in an international comparison, as well as the business

Trust Is Good, Control Is Cheaper: Introductionxiii

design of the ICS in the IT environment. The overview of internationally recognizedGRC reference models could also be interesting for you. Part III explains what theautomation of an ICS means from a concept perspective.

4 Senior managementRegardless of whether you are the CFO, CEO, or CIO in your organization, or arefulfilling your duties in the executive board or audit committee, you will not havebeen able to escape compliance issues. Even if you do not use SAP for processesin your organization, and a correct definition of the SAP-specific content of yourICS is irrelevant for you, you will certainly have thought about designing the ICSefficiently: the experiences of other organizations in handling ICS and compliancetopics as described inPart IIwill provide youwith goodpoints of reference. Further-more, the legal and other compliance requirements, recommendations for dealingwith the external audit, and the overview of the GRC framework concepts fromPart I of this book will be of interest to you. You should also not miss out on thevisionary and conceptual explanations on the topic of “compliance at the push ofa button” in Part III.

Notes for Reading this Book

This book contains various orientation aids that will help you to read it.Information boxesGray information boxes provide information that is helpful and good to know, but

that stands apart somewhat from the actual explanation text. To enable you to categorizethe information in the boxes immediately, we have assigned symbols to the boxes:

Tip Start !

4 The Tips and Notes identified by this symbol provide recommendations that willmake your work easier. These boxes also contain information on further topics orimportant content that you should note.

> Important Start4 The Caution symbol draws your attention to topics or areas where you should exercise

particular caution.

Example Start [e.g.]

4 Examples, indicated by this symbol, indicate scenarios from practice and illustratethe functions presented.

Marginal notesMarginal notes enable you to search the book for topics you are particularly inter-ested in or to find parts that you have already read. The marginal notes are adjacent tothe respective section that contains the corresponding information.

xiv Trust Is Good, Control Is Cheaper: Introduction

The audit procedures that are integrated in the presentation, for example, are indi-cated throughout the book with the marginal note “Check:” (followed in each case bykey words reflecting the content).

Acknowledgments

Now it is time to thank everyone without whose support I would not have been able tocomplete this book project.

The English edition of the book, which you are currently holding, would not havebeen possible without the highly professional translation by Tracey Duffy (TSD Trans-lations). In addition to, in my opinion, a very successful translation, Tracey Duffy alsocontributed to the quality of this book with her comments regarding content and withher great attention to detail. Many thanks also to Ralf Gerstner (Springer) for his expertadvice and support in this project.

During the time in which I wrote this book, in addition tomymain task asmanagingdirector and consultant at Riscomp GmbH, and parallel to many exciting projects, myfriends and family often had to do without me. I would firstly like to thank them fortheir understanding and support.

Many people gave me comments, ideas, and information on various questions:many thanks to the SAP experts Jürgen Möller, Dominik Yow-Sin-Cheung, DanielWelzbacher, Jan Gardiner, David Ramsay, and Atul Sudhalkar – for support in trickyquestions surrounding the SAP GRC suite. Heartfelt thanks also to Dr. Karol Bliznak(SAP AG) for input regarding mapping the “risk-intelligent strategic execution” ap-proach with SAP products. I would also like to thank Jürg Kasper (Canton Zürich) forhis creative input regarding the automation of test and monitoring scenarios.

Esteemed colleagues have also written contributions to this book: with his highlycompetent and proven in practice description of the control mechanisms in the SAPERP-supported Procure to Pay and Order to Cash processes, GerhardWasnick relievedme of a great deal of work. Günther Emmenegger (SAP Schweiz AG) wrote the chap-ter on mapping FDA-requirements in the SAP environment. Volker Lehnert wrote themajority of the chapter on data-protection relevant controls in SAP ERP HCM. MarcMichely (PricewaterhouseCoopers) contributed the section on fraud scenarios in SAP.The practical reports on mapping compliance requirements arose in close cooperationwith Jan Laurisjen (Ericsson) and Michele Poffo (Tecan). Reto Bachmann providedinput for the contribution on efficiency-oriented scenarios. AndreasWiegenstein (Vir-tualforge) has contributed to the Sect. 6.4.2 describing key elements of the ABAP codesecurity.

For various support, information, and help, I would also like to thank Dr. MichaelAdam (SAP AG), Dr. Gero Mäder, Thomas Schmale (SAP AG), Evelyn Salie (SAPSchweiz AG), Arnold Babel (SAP Schweiz AG), Peter Heidkamp (KPMG), FlorianKöller (SAP AG), Walter Harrer (SAP Schweiz AG), and Christian Brunner (SAPSchweiz AG).

Two, three, or four heads are better than one: Annett Nowatzki (DSJ Revision undTreuhand AG) and Patricia Sprenger at Galileo Press read first drafts, preliminary ver-sions, and raw versions, as well as the finished text of the German edition of the bookand improved it with their comments.

Trust Is Good, Control Is Cheaper: Introductionxv

Despite the support that I have received frommany quarters, I alone am responsiblefor any errors that remain.

I hope that this book will help you to solve your tasks concerning compliance, audit,and ICS automation with SAP, and wish you every success and enjoyment with yourreading.

Maxim Chuprunov

xvii

Contents

List of Abbreviations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxix

I From Legislation to Concept:ICS and Compliance in the ERP Environment

1 Legal Requirements in ICS Compliance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3

1.1 Definition of Terms and Differentiation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3

1.1.1 Compliance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3

1.1.2 Internal Control System (ICS) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4

1.2 Legal ICS Requirements Around theWorld – theMany Faces of SOX . . . . . . . . . . 5

1.2.1 SOX in the USA . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

1.2.2 SOX in Canada (NI 52-109) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

1.2.3 SOX in Japan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

1.2.4 SOX in China . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8

1.3 ICS Requirements in Europe . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8

1.3.1 Eighth EU Directive . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8

1.3.2 Germany . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

1.3.3 Switzerland . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

1.3.4 Austria . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

1.3.5 United Kingdom of Great Britain and Northern Ireland . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

1.3.6 France . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

1.3.7 Denmark . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

1.3.8 Italy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

1.3.9 Spain . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

1.4 ICS Requirements in the Financial Sector . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

1.4.1 Solvency II in the Insurance Industry . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

1.4.2 Basel II and III in Banking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

1.5 ICS as Contributing Factor to Business Success? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16

1.6 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

2 The Auditor Is Coming: When,Why, and How to Cope . . . . . . . . . . . . . . . . . . . 19

2.1 ICS in the IT Environment from the View of Auditing . . . . . . . . . . . . . . . . . . . . . . . . . . 19

2.1.1 The Challenge Presented by Information Technology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

2.1.2 Transaction Audit as Audit Approach in the IT Environment . . . . . . . . . . . . . . . . . . . . . . . . 21

xviii Contents

2.1.3 Approaches for a Transaction Audit: Focus on ICS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

2.1.4 ICS and Mandatory Transaction Audit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23

2.2 ICS Assurance in Practice . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

2.2.1 The Auditor’s Focus . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

2.2.2 Selected Auditing Principles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

2.2.3 Types of External Audit in the ERP Environment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

2.2.4 Recommendations for Working with the Auditor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

2.3 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34

3 ICS Requirements and ERP Systems:Basic Principles, Frameworks, Structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

3.1 Defining ICS Content in the SAP ERP Environment . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

3.1.1 ICS Basic Principles in the ERP Environment: From GAAP to GAPCAS . . . . . . . . . . . . . . . 35

3.1.2 Who Defines the Rules in the SAP Environment? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

3.1.3 Control Identification Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38

3.1.4 Structure of a Classic ICS Framework in the ERP Environment . . . . . . . . . . . . . . . . . . . . . . 40

3.1.5 Structure of Efficiency-Oriented and Profitability-Oriented Controlsin the ERP Environment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45

3.2 ICS-Relevant Reference Models and Standards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47

3.2.1 COSO . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47

3.2.2 CobiT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48

3.2.3 ITIL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48

3.2.4 GAIT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49

3.2.5 ITAF . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50

3.2.6 Risk IT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51

3.2.7 Val IT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51

3.2.8 CMMI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52

3.2.9 MOF . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53

3.2.10 ISO 27k . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54

3.2.11 PCI-DSS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54

3.2.12 Summary View of Reference Models . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54

3.3 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56

4 HowDoes SAP Deal with Risk- and Compliance-Related Topics? . . . . . . . 57

4.1 Software Certification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57

4.1.1 SAP Note 671016 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58

4.1.2 Certification Reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58

4.2 Compliance-RelevantGuides . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61

4.2.1 SAP Online Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61

Contentsxix

4.2.2 Security Guides . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63

4.2.3 DSAG Guides: Audit Guides, Data Protection Guides . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68

4.3 Integrated Approach in SAP GRC 10.0and Further Compliance-Relevant Solutions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68

4.3.1 SAP Governance, Risk, and Compliance Suite 10.0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69

4.3.2 SAP Process Control 10.0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70

4.3.3 SAP Access Control 10.0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72

4.3.4 Policy Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77

4.3.5 SAP Risk Management 10.0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77

4.3.6 Summary Overview of Integration Scenarios in SAP GRC 10.0 . . . . . . . . . . . . . . . . . . . . . . 79

4.3.7 SAP Audit Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79

4.3.8 SAP Audit Information System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81

4.3.9 SAP Security Optimization Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82

4.3.10 RSECNOTE Tool . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82

4.4 Compliance-Relevant Content . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82

4.4.1 Direct ICS Content: What Controls Are Available in SAP? . . . . . . . . . . . . . . . . . . . . . . . . . . . 83

4.4.2 Content with ICS Relevance: Standard Business Processes and Controls in SAP . . . . . 89

4.5 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92

II From Concept to Content: Audit Guide for SAP ERP

5 Audit-Relevant SAP Basics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95

5.1 In the BeginningWas the Table: SAP as Table-Controlled Application . . . . . . . . 96

5.1.1 Data in an SAP System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97

5.1.2 Controls in the SAP System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102

5.1.3 Table-Specific Search . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103

5.1.4 Transaction-Specific Search . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109

5.1.5 Program-Specific Search . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111

5.1.6 The Relationship Between Programs and Transactions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111

5.1.7 The Relationship Between Programs and Tables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113

5.1.8 Summary of the Search Options in SAP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116

5.1.9 Organizational Structures in the SAP System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117

5.2 Authorizations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118

5.2.1 Flow and Hierarchy of Authorization Controls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119

5.2.2 Authorization Objects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119

5.2.3 Determining Authorization Objects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122

5.2.4 Roles in the SAP System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125

5.2.5 Users in the SAP System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127

5.2.6 User Types in SAP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128

xx Contents

5.2.7 Example of an Authorization Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129

5.3 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130

6 IT General Controls in SAP ERP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131

6.1 Organizational Controls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131

6.1.1 IT Organization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131

6.1.2 IT Outsourcing: Who Is Responsible for the Controls? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132

6.1.3 Guidelines and Documentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135

6.2 Controls in the Area of ChangeManagement and Development . . . . . . . . . . . . . . 136

6.2.1 SAP System Landscape . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136

6.2.2 Change and Transport Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137

6.2.3 Client Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140

6.2.4 Maintenance and Updates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142

6.2.5 SAP Solution Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143

6.3 Security Controls for Access to the SAP System and for Authentication . . . . . . 145

6.3.1 Identity and Life Cycle of the User . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145

6.3.2 Password Protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 146

6.3.3 Handling Standard Users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148

6.3.4 Emergency User Concept . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150

6.4 Security and Authorization Controls within SAP ERP . . . . . . . . . . . . . . . . . . . . . . . . . . 150

6.4.1 Protecting Programs and Transactions – Basic Level . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 151

6.4.2 Protecting Programs and Transactions – Advanced Level . . . . . . . . . . . . . . . . . . . . . . . . . . 154

6.4.3 Protecting Tables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 158

6.4.4 Controlling Authorization Checks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159

6.4.5 Critical Administration Transactions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 161

6.4.6 Consideration of the Principle of Segregation of Duties . . . . . . . . . . . . . . . . . . . . . . . . . . . . 161

6.5 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163

7 General Application Controls in SAP ERP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 165

7.1 The Principle of Unalterability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 165

7.1.1 Protecting Data in Tables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 166

7.1.2 Debugging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 166

7.1.3 Modifiability of Documents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 168

7.2 Controls for Data-Related Traceability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 169

7.2.1 Change Documents in SAP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 169

7.2.2 Table Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 171

7.2.3 Document Number Assignment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 173

7.3 Traceability of User Activities in SAP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 174

7.3.1 System Log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 174

Contentsxxi

7.3.2 Security Audit Log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 176

7.3.3 History of Transaction Calls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 177

7.3.4 Traceability of System Changes in the Changeand Transport Management System (CTS) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 178

7.4 Cross-Process Processing Controls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 179

7.4.1 Monitoring Update Terminations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 180

7.4.2 Completeness of the ALE Interface Processing. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 182

7.4.3 Remote Function Call Connections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 184

7.4.4 Completeness of Batch Input Processing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 185

7.5 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 187

8 Controls in FinancialAccounting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 189

8.1 Underlying Control Mechanisms in General Ledger Accounting (FI-GL) . . . . . . 189

8.1.1 Principle: Real-Time Postings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 190

8.1.2 Financial Statements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 192

8.1.3 G/L AccountMaster Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193

8.1.4 Checking that Transaction Figures Are Consistentwith the Accounting Reconciliation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 195

8.1.5 Selected Controls for Closing Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 195

8.1.6 ReconciliationWork in FI-GL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 197

8.2 Controls over the Accuracy and Quality of Datain General Ledger Accounting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 198

8.2.1 Accurate Account Determination . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 198

8.2.2 Field Status Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 199

8.2.3 Calculating Taxes for Manual Postings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 200

8.2.4 Validations in SAP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 202

8.2.5 Foreign Currencies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 203

8.3 Completeness of Processing in General Ledger Accounting . . . . . . . . . . . . . . . . . . . 205

8.3.1 Document Parking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 205

8.3.2 Recurring Entries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 207

8.3.3 Reconciliation Ledger . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 208

8.4 Data Security and Protection in General Ledger Accounting . . . . . . . . . . . . . . . . . . 209

8.4.1 Protecting Company Codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 209

8.4.2 Tolerance Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 212

8.4.3 Protecting Master Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 212

8.4.4 Critical Transactions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 215

8.4.5 Segregation of Duties in General Ledger Accounting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 217

8.5 Controls in Asset Accounting (FI-AA) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 218

8.5.1 Basics of Asset Accounting in SAP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 218

xxii Contents

8.5.2 Default Values for Asset Classes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 219

8.5.3 Account Determination in Asset Accounting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 220

8.5.4 Consistency Check for Account Determination and Configuration . . . . . . . . . . . . . . . . . 221

8.5.5 Depreciation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 221

8.5.6 Asset History Sheet . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 225

8.5.7 Low Value Assets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 226

8.5.8 Authorization Control in Asset Accounting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 227

8.5.9 Critical Authorizations in Asset Accounting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 228

8.6 Controls in Accounts Payable (FI-AP) and Accounts Receivable (FI-AR) . . . . . . . 229

8.6.1 Accuracy of the ReconciliationAccounts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 229

8.6.2 Payment Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 230

8.6.3 One-Time Customers and Vendors – Caution! . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 232

8.6.4 Ageing Structure and Value Adjustments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 234

8.6.5 Segregation of Duties for Master Data Maintenance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 234

8.7 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 235

9 Control Mechanisms in the SAP ERP-Supported Procureto Pay Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 237

9.1 Ordering . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 238

9.1.1 Maintenance of the Organizational Structures Consistent with Authorizations . . . . . 238

9.1.2 Segregation of Duties in Ordering . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 239

9.2 Goods Receipts and Invoice Verification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 242

9.2.1 Goods Receipts: Critical Movement Types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 242

9.2.2 3-Way Match and Payment Blocks in Logistics Invoice Verification . . . . . . . . . . . . . . . . . . 243

9.2.3 Check for Duplicate Invoice Entry . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 245

9.3 GR/IR Account . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 245

9.3.1 Clearing the GR/IR Account . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 245

9.3.2 Closing Operations and Reporting of the GR/IR Account in the Balance Sheet . . . . . . 247

9.4 Controls for Stocks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249

9.4.1 Maintenance of Material Master Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249

9.4.2 Non-Valuated Stock Value and Split Valuation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 250

9.4.3 Account Determination for Material Movements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 251

9.4.4 Correction of Stock Values: Inventory and Material Devaluations . . . . . . . . . . . . . . . . . . . 253

9.4.5 Release of Scrapping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 254

9.4.6 Product Cost Accounting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 255

9.4.7 Goods Issues from Non-Valuated Stock . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 257

9.5 Corporate Governance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 257

9.6 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 258

Contentsxxiii

10 Control Mechanisms in the SAP ERP-Supported Orderto Cash Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 259

10.1 Controls in the Preparatory Sales and Distribution Phase . . . . . . . . . . . . . . . . . . . . . 260

10.1.1 Controls during Order Entry . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 260

10.1.2 Quality of Customer Master Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 261

10.1.3 Segregation of Duties for Master Data Maintenance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 262

10.1.4 Credit Limit Assignment and Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 263

10.2 Controls in Order Fulfillment and Revenue Recognition . . . . . . . . . . . . . . . . . . . . . . 264

10.2.1 Controls for Delivery of Goods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 265

10.2.2 Pricing and Determination of Sales Tax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 266

10.2.3 Return Deliveries and Credit Memos . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 269

10.2.4 Billing Due List . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 269

10.2.5 Completeness of Accounting Entry of Billing Documents . . . . . . . . . . . . . . . . . . . . . . . . . . 270

10.2.6 Dunning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 271

10.3 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 274

11 Data Protection Compliance in SAP ERP Human CapitalManagement 275

11.1 Legal Data Protection Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 275

11.1.1 Data Protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 276

11.1.2 Basic Principles: European Union Directive . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 277

11.1.3 Co-Determination and Employee Data Protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 283

11.1.4 Excursion: Protection of Patient Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 285

11.2 General Data Protection-Relevant Control Mechanisms in SAP . . . . . . . . . . . . . . . 286

11.2.1 Tracing Changes to Personal Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 287

11.2.2 Logging Report Calls in SAP ERP HCM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 288

11.2.3 Deleting Data and Making it Unrecognizable . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 288

11.2.4 Personal Data Outside SAP ERP HCM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 289

11.3 Special Requirements of SAP ERP HCM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 290

11.4 Authorizations and Roles in SAP ERP HCM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 290

11.4.1 Differentiating Attributes in SAP ERP HCM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 291

11.4.2 Personnel Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 293

11.4.3 Structural Authorizations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 296

11.4.4 AuthorizationMain Switches . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 299

11.5 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 301

12 Fraud in an SAP System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 303

12.1 Introduction to “Fraud” . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 303

12.1.1 Types of Fraud . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 303

12.1.2 Fraud and the SAP System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 305

xxiv Contents

12.2 Fraud Scenarios in SAP Basis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 306

12.2.1 “Write-Debugging” Authorizations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 306

12.2.2 Processing a Batch Input Session under a Different User ID . . . . . . . . . . . . . . . . . . . . . . . . 307

12.3 Fraud Scenarios in the General Ledger . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 308

12.3.1 Fraudulent Manual Document Postings in the General Ledger . . . . . . . . . . . . . . . . . . . . . 308

12.3.2 Identification and Analysis of Manual Journal Entries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 309

12.4 Fraud Scenarios in the Sales Area . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 311

12.4.1 Issuing Fictitious Invoices to Fictitious Customers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 311

12.4.2 Granting Improper Credit Memos or Discounts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 312

12.4.3 Excessive Use of Free Goods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 313

12.4.4 Improper Write-Off of Open Customer Receivables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 314

12.5 Fraud Scenarios in Personnel Accounting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 315

12.5.1 Fictitious Employees . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 315

12.5.2 Limited Access to Own HR Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 316

12.5.3 Segregation of Duties for Confidential Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 316

12.6 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 317

13 Excursion: FDA Compliance and Controls in SAP . . . . . . . . . . . . . . . . . . . . . . . . 319

13.1 Legal Requirements in theManufacture of Food andMedicinal Products . . . . 319

13.1.1 FDA-Relevant Legal Requirements in an International Comparison . . . . . . . . . . . . . . . . . 320

13.1.2 GxP – The FDA Basic Principles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 321

13.1.3 IT from the View of FDA Compliance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 322

13.2 Validation of IT Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 322

13.2.1 Validation Procedure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 323

13.2.2 Controls in Implementation Processes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 324

13.3 FDA Compliance in IT-Supported Business Processes . . . . . . . . . . . . . . . . . . . . . . . . . 325

13.3.1 Examples: Controls in Procurement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 325

13.3.2 Examples: Controls in Production Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 325

13.3.3 Examples: Controls in Quality Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 326

13.3.4 Examples: Controls in Asset Maintenance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 326

13.3.5 Examples: Controls for Batch Traceability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 327

13.3.6 Examples: Controls in Warehouse Management Processes . . . . . . . . . . . . . . . . . . . . . . . . . 327

13.4 Observing FDA Compliance for SystemMaintenance, SystemUpdates,and System Changes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 328

13.5 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 329

14 Examples of Efficiency-Oriented and Profitability-OrientedAnalysis Scenarios in SAP ERP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 331

14.1 Process-Related Data Analyses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 331

Contentsxxv

14.1.1 Comparison of the Purchase Order Date with the Goods Receipt Date . . . . . . . . . . . . . 332

14.1.2 Timely Release or Creation of Purchase Requisitions and Purchase Orders . . . . . . . . . . 336

14.1.3 Time between Incoming Purchase Order and Confirmation of the Customer Order . 343

14.1.4 Ten Further Examples of Possible Data-Based Process Analyses . . . . . . . . . . . . . . . . . . . . 344

14.2 Analysis of Master Data Quality . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 344

14.2.1 Quality of Customer Master Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 345

14.2.2 Produced Materials with No Bill of Materials . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 346

14.2.3 Reconciliation of Material Costs within a Company Code . . . . . . . . . . . . . . . . . . . . . . . . . . 347

14.2.4 Ten Further Examples of Possible Master Data Analyses . . . . . . . . . . . . . . . . . . . . . . . . . . . . 349

14.3 Manual Data Changes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 349

14.3.1 Changes to Purchase Requisitions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 350

14.3.2 Changes to Purchasing Documents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 351

14.3.3 Changes to Sales Documents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 355

14.3.4 Manual Data Changes – Ten Further Examples . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 357

14.4 Supplementing SAP ERP Standard Reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 358

14.4.1 Planning Parameters Added to Stock Analyses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 358

14.4.2 Customer Master Data Added to Credit Management Analysis . . . . . . . . . . . . . . . . . . . . . 359

14.5 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 360

III From Concept and Content to Implementation:Automation of an Internal Control System

15 ICS Automation: How to Set the COSO Cube inMotion . . . . . . . . . . . . . . . . . . 363

15.1 Basic Concept of ICS Automation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 363

15.1.1 COSO Cube in Action . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 364

15.1.2 Concept of ICS Automation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 365

15.2 ICS-Relevant Objects and Documentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 367

15.2.1 Organizational Units . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 367

15.2.2 Processes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 368

15.2.3 Controls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 369

15.2.4 Control Objectives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 370

15.2.5 Risks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 371

15.2.6 Account Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 371

15.2.7 Example of an ICS Data Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 372

15.3 Basic Scenarios of ICS Activities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 373

15.3.1 Documentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 374

15.3.2 Selection and Prioritization of Control Activities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 374

15.3.3 Control Execution . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 375

15.3.4 Design Test . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 376

xxvi Contents

15.3.5 Effectiveness Test . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 376

15.3.6 Survey . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 377

15.3.7 Risk Assessment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 377

15.3.8 Remediation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 378

15.3.9 Sign-Off . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 378

15.3.10 Report Evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 379

15.3.11 Persons as Links Between ICS Objects and Activities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 379

15.4 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 380

16 ICS Automation Using SAP Process Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 381

16.1 Introduction: ICS Implementation with SAP Process Control . . . . . . . . . . . . . . . . . . 381

16.2 Technical Implementation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 383

16.2.1 Technical Architecture and Installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 383

16.2.2 Initial Configuration of the Standard Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 385

16.2.3 Information Sources on Implementing, Operating,and Upgrading SAP Process Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 386

16.3 Data Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 388

16.3.1 ICS Master Data in SAP Process Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 388

16.3.2 ICS Data Model in SAP Process Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 391

16.3.3 Central vs. Local ICS Master Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 392

16.3.4 Time Dependency of ICS Master Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 393

16.3.5 Traceability of Changes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 395

16.3.6 Concept of Object-Related Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 395

16.3.7 Customer-Specific Fields . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 396

16.3.8 Multiple Compliance Framework Concept . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 399

16.4 Implementation of the ICS Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 400

16.4.1 ICS Documentation Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 401

16.4.2 Scoping Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 405

16.4.3 Planning Process, Tests, and Assessments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 409

16.4.4 Issue Remediation Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 416

16.4.5 Reporting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 424

16.5 ICS and Compliance Implementation: Roles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 427

16.5.1 AuthorizationModel in SAP Process Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 427

16.5.2 Object-Related Security in Action . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 428

16.5.3 First Level vs. Second Level Authorizations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 429

16.5.4 Predefined Best Practice Role Concept in SAP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 431

16.5.5 Adjusting the Roles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 431

16.6 SAP Process Control as GRC Component – New Features and Developments . 433

16.6.1 Policy Management and Other New Features in Release 10.0 . . . . . . . . . . . . . . . . . . . . . . . 433

Contentsxxvii

16.6.2 Integrationwith SAP Access Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 434

16.6.3 Integrationwith SAP Risk Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 435

16.6.4 Merging GRC, Strategy, and Performance Topics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 437

16.7 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 439

17 Implementation of Automated Test andMonitoring Scenariosin the SAP ERP Environment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 441

17.1 Automated Test andMonitoring Scenarios in the SAP Environment . . . . . . . . . . 441

17.1.1 Offline CAAT Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 442

17.1.2 Online CAAT Reports and Evaluations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 445

17.1.3 ComplianceManagement Software . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 446

17.2 Automated Tests andMonitoring in SAP Solutionsfor GRC Release 10.0 – Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 448

17.2.1 ContinuousMonitoring Framework . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 448

17.2.2 ContinuousMonitoring Framework – Potential and Expectations . . . . . . . . . . . . . . . . . . 450

17.3 Setting up CMF Scenarios in SAP Process Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 453

17.3.1 Connecting SAP Solutions for GRC with Business Applications . . . . . . . . . . . . . . . . . . . . . 453

17.3.2 Data Sources in SAP Process Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 456

17.3.3 Creating Business Rules in CMF . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 460

17.3.4 Monitoring Data Changes in CMF . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 462

17.3.5 Automation Using Predefined Best Practice Scenarios . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 465

17.3.6 Connecting Controls with Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 467

17.3.7 And off You Go! . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 468

17.4 Potential of CMF Scenarios in SAP Process Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . 469

17.4.1 Use of SAP NetWeaver Business Warehouse for ContinuousMonitoring . . . . . . . . . . . . 470

17.4.2 Thoughts About SAP BusinessObjects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 471

17.5 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 472

18 Experiences from Practice and Projects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 473

18.1 Practical Experiences: Projects for ICS and Compliance Automation . . . . . . . . . 473

18.1.1 Tools for Implementation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 473

18.1.2 Best Practice Project Structure for ICS Implementation . . . . . . . . . . . . . . . . . . . . . . . . . . . . 475

18.1.3 Business Blueprint . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 475

18.1.4 ICS Content . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 477

18.1.5 Factors that Influence the Project Expense . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 479

18.1.6 Success Factors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 480

18.2 Project Examples for ICS and Compliance Automation . . . . . . . . . . . . . . . . . . . . . . . . 482

18.2.1 Coverage of Swiss Compliance Requirements at KUONI . . . . . . . . . . . . . . . . . . . . . . . . . . . . 482

18.2.2 Integrated GRC Approach at Tecan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 485

xxviii Contents

18.3 SOX at Ericsson . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 488

18.3.1 ICS Framework at Ericsson . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 489

18.3.2 SOX Compliance Process at Ericsson . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 491

18.3.3 Experiences from Previous Projects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 494

18.3.4 Optimization Potential . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 495

18.3.5 Steps Towards Optimization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 495

18.4 Reviewof the Stages of Evolution of the ICS and Conclusion . . . . . . . . . . . . . . . . . 496

References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 501

The Author of this Book . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 503

Contributors to this Book . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 505

Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 509

xxix

List of Abbreviations

AAF Audit and Assurance Faculty StandardAASB Auditing and Assurance Standards BoardACF Automated Controls FrameworkACP Acquisition and production costsADA Asset databaseAICPA American Institute of Certified Public AccountantsAIS Audit Information SystemAktG Aktiengesetz [Stock Corporation Act] (Germany)AM SAP Audit ManagementAMF Autorité des marchés financiers (France)AMF Automated Monitoring FrameworkAMS Application Management ServicesARF Automated Rules FrameworkARM Access Risk ManagementAS SAP NetWeaver Application ServerASAP Accelerated SAPBaFin Bundesanstalt für Finanzdienstleistungsaufsicht [Federal Financial Su-

pervisory Authority] (Germany)BC Set Business Configuration SetBDSG Bundesdatenschutzgesetz [Data Protection Act] (Germany)BetrVG Betriebsverfassungsgesetz [WorksCouncil ConstitutionAct] (Germany)BMGS Bundesministerium für Gesundheit und soziale Sicherung [Federal Min-

istry for Health and Social Affairs] (Germany)BPP Business Process ProcedureBRF Business Rules FrameworkBRG Business Role GovernanceBS British StandardBSI Bundesamt für Sicherheit in der Informationstechnik [Federal Office for

Information Security] (Germany)CAAT Computer Assisted Auditing TechniquesCAPA Corrective And Preventive ActionsCATT Computer Aided Test ToolCCM Continuous Control MonitoringCCMS Computer Center Management SystemCEA Centralized Emergency AccessCFR Code of Federal Regulations (USA)CHMP Committee for Medicinal Products for Human UseCICA Canadian Institute of Chartered AccountantsCMF Continuous Monitoring FrameworkCMS Compliance management softwareCobiT Control Objectives for Information and Related TechnologiesCOE Council of EuropeCOSO Committee of Sponsoring Organizations of the Treadway Commission

xxx List of Abbreviations

CTS Change and Transport Management SystemCUP Compliant User ProvisioningDART Tool Data Retention ToolDCGK Deutscher Corporate Governance Kodex [Corporate Governance Code]

(Germany)DI SAP NetWeaver Development InfrastructureDMS Documentation management systemeCATT Extended CATTECN Ericsson Corporate NetworkELC Entity level controlsEMA European Medicines AgencyEMEA Economic zone Europe, Middle East, and Africa (Europe, Middle East,

and Africa)ERM Enterprise Role ManagementFDA Food and Drug Administration (USA)FEFO First expired, first outFIFO First in, first outFM SAP Fraud ManagementFOEN Federal Office of the Environment (Switzerland)FOPH Federal Office of Public Health (Switzerland)FPM Financial Performance ManagementFSA Financial Services AgencyGAAP Generally Accepted Accounting PrinciplesGAIT Guide to the Assessment of IT RiskGAMP Good Automated Manufacturing PracticeGDPdU Grundsätze zum Datenzugriff und zur Prüfbarkeit digitaler Unterlagen

[Principles for data access and verifiability of digital documents] (Ger-many)

GLP Good Laboratory PracticeGMP Good Manufacturing PracticeGRC Governance, risk, and complianceGS Guidance StatementHCM SAP ERP Human Capital ManagementHIPAA Health Insurance Portability and Accountability Act (USA)HPFB Health Products and Food Branch (Canada)ICH International Conference on HarmonizationIdM SAP NetWeaver Identity ManagementIDoc Intermediate documentIDW Institut der Wirtschaftsprüfer [Institute of Public Auditors] (Germany)IFAC International Federation of AccountantsIFRS International Financial Reporting StandardsIIA Institute of Internal AuditorsIMG Implementation GuideISA International Standards on AuditingISAE International Standard on Assurance EngagementsISPE International Society for Pharmaceutical EngineeringISS IssueITAF Information Technology Assurance Framework

List of Abbreviationsxxxi

ITIL Information Technology Infrastructure LibraryITSEC Information Technology Security Evaluation CriteriaITSEM IT Security Evaluation ManualJ-SOX Japanese SOXKDF Vendor databaseKonTraG Gesetz zur Kontrolle und Transparenz im Unternehmensbereich [Con-

trol and Transparency in Business Act] (Germany)KRI Key Risk IndicatorLIFO Last in, first outLVA Low value assetsMaRisk (VA) Minimum Requirements for Risk Management (Germany, binding

guideline)MCF Multiple Compliance FrameworkMDEC Medical Device Evaluation Committee (Australia)MHLW Ministry for Health, Labour and Welfare (Japan)MOF Microsoft Operations FrameworkMQT Multi Application Query ToolMRC Management Risk ControllingNI National InstrumentNPCB National Pharmaceutical Control Bureau (Malaysia)NWBC SAP NetWeaver Business ClientOR Correct reportingP&L Profit and loss statementPC SAP Process ControlPCI-DSS Payment Card Industry Data Security StandardPIC/S Pharmaceutical Inspection Cooperation SchemePKI Public Key InfrastructurePMSB Pharmaceutical and Medical Safety Bureau (Japan)PublG Publizitätsgesetz [Public Disclosure Act] (Germany)RAR Risk Analysis & RemediationRBE Reversed Business EngineeringREV ReviewRFC Remote function callRM SAP Risk ManagementRPL Remediation planRTA Real Time AgentsSAL Security Audit LogSAS Self-assessmentSDF G/L account databaseSDM Software Deployment ManagerSEC Securities and Exchange Commission (USA)SGB Sozialgesetzbücher [Social Welfare Code] (Germany)SHI Swiss Agency for Therapeutic ProductsSLA Service Level AgreementSoD Segregation of dutiesSOP Standard Operation ProcedureSOS Security Optimization ServiceSOX Sarbanes-Oxley Act

xxxii List of Abbreviations

SPM Superuser Privilege ManagementSSO Single sign-onTGA Therapeutic Goods Administration (Australia)TMS Transport Management SystemUAM User Access ManagementUAR User Access ReviewUME User Management EngineVMP Validation Master PlanVRV Invoice verification database: invoicesWIP Work in progress