sap training - isaca denver chapterisaca-denver.org/students/isacasapintro… · ppt file · web...
TRANSCRIPT
![Page 1: SAP training - ISACA Denver Chapterisaca-denver.org/Students/ISACASAPIntro… · PPT file · Web view · 2013-05-02SAP comprises of 18-20 modules in finance, ... The SAP Basis module](https://reader034.vdocument.in/reader034/viewer/2022051600/5aa8aec77f8b9a86188bceeb/html5/thumbnails/1.jpg)
SAPAn Introduction
October 2012
![Page 2: SAP training - ISACA Denver Chapterisaca-denver.org/Students/ISACASAPIntro… · PPT file · Web view · 2013-05-02SAP comprises of 18-20 modules in finance, ... The SAP Basis module](https://reader034.vdocument.in/reader034/viewer/2022051600/5aa8aec77f8b9a86188bceeb/html5/thumbnails/2.jpg)
PwC
Personal Introductions
Marc Trevino, PwC Senior Associate– 6 years with PwC
• 6 years working with SAP clients– 6 years of ISACA membership– CISA, CPA, CIA
Michael Baker, PwC Senior Associate– 2 years with PwC
• 2 years working with SAP clients– CPA– Currently pursuing CISA
![Page 3: SAP training - ISACA Denver Chapterisaca-denver.org/Students/ISACASAPIntro… · PPT file · Web view · 2013-05-02SAP comprises of 18-20 modules in finance, ... The SAP Basis module](https://reader034.vdocument.in/reader034/viewer/2022051600/5aa8aec77f8b9a86188bceeb/html5/thumbnails/3.jpg)
PwC
Agenda
What We Will Do…• Provide a high level overview of what SAP is• SAP Authorization Concept• Provide an introduction to Auditing ITGC’s in SAP• Segregation of Duties in SAP
![Page 4: SAP training - ISACA Denver Chapterisaca-denver.org/Students/ISACASAPIntro… · PPT file · Web view · 2013-05-02SAP comprises of 18-20 modules in finance, ... The SAP Basis module](https://reader034.vdocument.in/reader034/viewer/2022051600/5aa8aec77f8b9a86188bceeb/html5/thumbnails/4.jpg)
4 © 2012 PwC
What is SAP?
![Page 5: SAP training - ISACA Denver Chapterisaca-denver.org/Students/ISACASAPIntro… · PPT file · Web view · 2013-05-02SAP comprises of 18-20 modules in finance, ... The SAP Basis module](https://reader034.vdocument.in/reader034/viewer/2022051600/5aa8aec77f8b9a86188bceeb/html5/thumbnails/5.jpg)
PwC
What does SAP stand for?
• Systeme, Anwendungen, Produkte in der Datenverarbeitung
Systems, Applications and Products in Data Processing
![Page 6: SAP training - ISACA Denver Chapterisaca-denver.org/Students/ISACASAPIntro… · PPT file · Web view · 2013-05-02SAP comprises of 18-20 modules in finance, ... The SAP Basis module](https://reader034.vdocument.in/reader034/viewer/2022051600/5aa8aec77f8b9a86188bceeb/html5/thumbnails/6.jpg)
PwC
What is SAP?
An order in SAP can automatically generate an inventory movement and a posting in the GL without any “human” intervention.
SAP can track financial results, procurement, sales, manufacturing, human resources and payroll.
SAP integrates all business processing through one application.Links operational results and the financial aspects of those results.
SAP comprises of 18-20 modules in finance, logistics and HR.One or more SAP modules can be implemented.
SAP is typically accessible by the entire business organisation.Most company information and transactions originate from SAP.
Integrated
Multifunctional
Modular
Enterprise Wide
“Real Time”
![Page 7: SAP training - ISACA Denver Chapterisaca-denver.org/Students/ISACASAPIntro… · PPT file · Web view · 2013-05-02SAP comprises of 18-20 modules in finance, ... The SAP Basis module](https://reader034.vdocument.in/reader034/viewer/2022051600/5aa8aec77f8b9a86188bceeb/html5/thumbnails/7.jpg)
PwC
Overview of an SAP Environment
Business process Controls(incl. automated,manual, BPR)
IT General Controls
Management reporting
and end-user controls
SAP configurable controls
SAP Authorisations/User profiles
SAP Basis Module
Database
Operating System and other Infrastructure controls
Database InfrastructureLayer
Application Layer
Presentation Layer
![Page 8: SAP training - ISACA Denver Chapterisaca-denver.org/Students/ISACASAPIntro… · PPT file · Web view · 2013-05-02SAP comprises of 18-20 modules in finance, ... The SAP Basis module](https://reader034.vdocument.in/reader034/viewer/2022051600/5aa8aec77f8b9a86188bceeb/html5/thumbnails/8.jpg)
PwC
SAP InstancesPR1
PH1
PC3
PE1
PA1
SAP R/3 or ECC 6.0
APO Planning
SAP Human Resources
SAP Customer Relationship Management
SAP Procurement
PS1 Solution Manager
PB1 Business Warehouse
![Page 9: SAP training - ISACA Denver Chapterisaca-denver.org/Students/ISACASAPIntro… · PPT file · Web view · 2013-05-02SAP comprises of 18-20 modules in finance, ... The SAP Basis module](https://reader034.vdocument.in/reader034/viewer/2022051600/5aa8aec77f8b9a86188bceeb/html5/thumbnails/9.jpg)
9 © 2012 PwC
SAP Authorization Concept
![Page 10: SAP training - ISACA Denver Chapterisaca-denver.org/Students/ISACASAPIntro… · PPT file · Web view · 2013-05-02SAP comprises of 18-20 modules in finance, ... The SAP Basis module](https://reader034.vdocument.in/reader034/viewer/2022051600/5aa8aec77f8b9a86188bceeb/html5/thumbnails/10.jpg)
PwC
OverviewWhat is the SAP authorization concept?
Security within SAP is achieved through the authorization concept The authorization is designed to ensure :• Maximum security• Sufficient privileges for end users to fulfil their job duties• Powerful user maintenance
![Page 11: SAP training - ISACA Denver Chapterisaca-denver.org/Students/ISACASAPIntro… · PPT file · Web view · 2013-05-02SAP comprises of 18-20 modules in finance, ... The SAP Basis module](https://reader034.vdocument.in/reader034/viewer/2022051600/5aa8aec77f8b9a86188bceeb/html5/thumbnails/11.jpg)
PwC
User master recordUser requires valid user-ID and password
T-code check
User requires an authorization for transactions
Authority checkUser requires an authorization for underlying authorization objects and field values
1
2
3
OverviewThree levels of security in SAP
![Page 12: SAP training - ISACA Denver Chapterisaca-denver.org/Students/ISACASAPIntro… · PPT file · Web view · 2013-05-02SAP comprises of 18-20 modules in finance, ... The SAP Basis module](https://reader034.vdocument.in/reader034/viewer/2022051600/5aa8aec77f8b9a86188bceeb/html5/thumbnails/12.jpg)
PwC
Transaction Code (t-code)Provides access to specific functions within SAP
Authorization Object:Template for security that contains fields with blank values (uncut key)
SAP User Master Record (UMR)Master data for SAP users
Authorization (Field Values):Authorization object with completed fields (cut key)
ME21 – Create Purchase Order
SAP Authorization ConceptThe components
![Page 13: SAP training - ISACA Denver Chapterisaca-denver.org/Students/ISACASAPIntro… · PPT file · Web view · 2013-05-02SAP comprises of 18-20 modules in finance, ... The SAP Basis module](https://reader034.vdocument.in/reader034/viewer/2022051600/5aa8aec77f8b9a86188bceeb/html5/thumbnails/13.jpg)
PwC
Profiles “Key ring” that contains authorizations (cut keys)
Authority CheckPerformed by SAP to ensure that a user ID has the correct authorization object and field value combination (cut key) to execute a particular task
RolesCollection of transaction codes, authorizations and user assignments
R: Display PO
R: Create PO
Buyer
SAP Authorization ConceptThe components
![Page 14: SAP training - ISACA Denver Chapterisaca-denver.org/Students/ISACASAPIntro… · PPT file · Web view · 2013-05-02SAP comprises of 18-20 modules in finance, ... The SAP Basis module](https://reader034.vdocument.in/reader034/viewer/2022051600/5aa8aec77f8b9a86188bceeb/html5/thumbnails/14.jpg)
PwC
SAP Authorization Concept Bringing it all together
• Let’s make an analogy… • … the Lock and the Key
To open the lock, you need the right key!
![Page 15: SAP training - ISACA Denver Chapterisaca-denver.org/Students/ISACASAPIntro… · PPT file · Web view · 2013-05-02SAP comprises of 18-20 modules in finance, ... The SAP Basis module](https://reader034.vdocument.in/reader034/viewer/2022051600/5aa8aec77f8b9a86188bceeb/html5/thumbnails/15.jpg)
PwC
Profile SAP Security Check
Authorizations
User Master Record
R: Display Purchasing document
R: Create Purchase Order (e.g., ME21)
Buyer
SAP Authorization Concept Bringing it all together
![Page 16: SAP training - ISACA Denver Chapterisaca-denver.org/Students/ISACASAPIntro… · PPT file · Web view · 2013-05-02SAP comprises of 18-20 modules in finance, ... The SAP Basis module](https://reader034.vdocument.in/reader034/viewer/2022051600/5aa8aec77f8b9a86188bceeb/html5/thumbnails/16.jpg)
16 © 2012 PwC
Auditing ITGC’s in SAP
![Page 17: SAP training - ISACA Denver Chapterisaca-denver.org/Students/ISACASAPIntro… · PPT file · Web view · 2013-05-02SAP comprises of 18-20 modules in finance, ... The SAP Basis module](https://reader034.vdocument.in/reader034/viewer/2022051600/5aa8aec77f8b9a86188bceeb/html5/thumbnails/17.jpg)
PwC
SAP is not a typical application / environment split
Many traditional environment functions are provided within the application including:
» development environment» change control» system administration and job scheduling
These functions are collectively known as SAP Basis
Combined with SAP integration, this serves to complicate access security
Risk based approach in a SAP environment
![Page 18: SAP training - ISACA Denver Chapterisaca-denver.org/Students/ISACASAPIntro… · PPT file · Web view · 2013-05-02SAP comprises of 18-20 modules in finance, ... The SAP Basis module](https://reader034.vdocument.in/reader034/viewer/2022051600/5aa8aec77f8b9a86188bceeb/html5/thumbnails/18.jpg)
PwC
SAP allows more comprehensive functionality and control, however, the following needs to be considered:− Financial transactions are executed throughout the
business making segregation of duties control key− The SAP access mechanism is complex making security
and segregation of duties a key risk− Configuration has a large impact to the overall business
process and controls
Risk based approach in a SAP environment
![Page 19: SAP training - ISACA Denver Chapterisaca-denver.org/Students/ISACASAPIntro… · PPT file · Web view · 2013-05-02SAP comprises of 18-20 modules in finance, ... The SAP Basis module](https://reader034.vdocument.in/reader034/viewer/2022051600/5aa8aec77f8b9a86188bceeb/html5/thumbnails/19.jpg)
PwC
Key IT General Control Domains
• Consider tests for controls around:• Access to programs and data• Changes made to the system (Change management)• Computer operations
• Weaknesses identified within the IT general controls can potentially undermine confirmed and tested automated controls and access controls at the business process level
![Page 20: SAP training - ISACA Denver Chapterisaca-denver.org/Students/ISACASAPIntro… · PPT file · Web view · 2013-05-02SAP comprises of 18-20 modules in finance, ... The SAP Basis module](https://reader034.vdocument.in/reader034/viewer/2022051600/5aa8aec77f8b9a86188bceeb/html5/thumbnails/20.jpg)
PwC
Key Areas within the SAP environmentAccess to Programs and Data
• Key areas to consider include:• SAP system settings including password parameters• Access to user administration functions including
defining and assigning profiles to users (Profile Generator)
• Access to run programs/ transaction codes• Assignment of SAP_ALL, SAP_NEW, other sensitive
profiles• Default passwords of SAP supplied accounts (SAP*,
DDIC, Earlywatch, SAPCPIC etc.)• Management and review of User IDs and generic User
IDs• Use of audit logs (SAP Table Logging)
![Page 21: SAP training - ISACA Denver Chapterisaca-denver.org/Students/ISACASAPIntro… · PPT file · Web view · 2013-05-02SAP comprises of 18-20 modules in finance, ... The SAP Basis module](https://reader034.vdocument.in/reader034/viewer/2022051600/5aa8aec77f8b9a86188bceeb/html5/thumbnails/21.jpg)
PwC
• Key areas to consider include: • Customised programs and tables should be assigned to
appropriate authorisation groups.• Ability to unlock production environment to make direct
changes to production is restricted and monitored• Segregation of duties within the change management
process including developer, customizer and approver of the program change/transport
• Changes to SAP tables and data dictionary in the production environment is minimized
Key Areas within the SAP environmentChange Management
![Page 22: SAP training - ISACA Denver Chapterisaca-denver.org/Students/ISACASAPIntro… · PPT file · Web view · 2013-05-02SAP comprises of 18-20 modules in finance, ... The SAP Basis module](https://reader034.vdocument.in/reader034/viewer/2022051600/5aa8aec77f8b9a86188bceeb/html5/thumbnails/22.jpg)
PwC
Key Areas within the SAP environmentComputer Operations
• Key areas to consider include:• Batch jobs and interface processing should be regularly
monitored, with access to amend them restricted• Batch jobs run under ANOTHER user should be
restricted to appropriate personnel• Batch jobs run under ANY user should be completely
restricted• Operating and database system administrator access
should be restricted
![Page 23: SAP training - ISACA Denver Chapterisaca-denver.org/Students/ISACASAPIntro… · PPT file · Web view · 2013-05-02SAP comprises of 18-20 modules in finance, ... The SAP Basis module](https://reader034.vdocument.in/reader034/viewer/2022051600/5aa8aec77f8b9a86188bceeb/html5/thumbnails/23.jpg)
23 © 2012 PwC
Auditing SAP
Segregation of Duties Example
![Page 24: SAP training - ISACA Denver Chapterisaca-denver.org/Students/ISACASAPIntro… · PPT file · Web view · 2013-05-02SAP comprises of 18-20 modules in finance, ... The SAP Basis module](https://reader034.vdocument.in/reader034/viewer/2022051600/5aa8aec77f8b9a86188bceeb/html5/thumbnails/24.jpg)
24'Confidential Information for the sole benefit and use of [Global, beverages company]. © 2012 PwC
SOD – Framework – Overview
![Page 25: SAP training - ISACA Denver Chapterisaca-denver.org/Students/ISACASAPIntro… · PPT file · Web view · 2013-05-02SAP comprises of 18-20 modules in finance, ... The SAP Basis module](https://reader034.vdocument.in/reader034/viewer/2022051600/5aa8aec77f8b9a86188bceeb/html5/thumbnails/25.jpg)
25'Confidential Information for the sole benefit and use of [Global, beverages company]. © 2012 PwC
SOD – Framework – SOD/SA Rule
![Page 26: SAP training - ISACA Denver Chapterisaca-denver.org/Students/ISACASAPIntro… · PPT file · Web view · 2013-05-02SAP comprises of 18-20 modules in finance, ... The SAP Basis module](https://reader034.vdocument.in/reader034/viewer/2022051600/5aa8aec77f8b9a86188bceeb/html5/thumbnails/26.jpg)
26'Confidential Information for the sole benefit and use of [Global, beverages company]. © 2012 PwC
SOD – Framework – SOD Rule
![Page 27: SAP training - ISACA Denver Chapterisaca-denver.org/Students/ISACASAPIntro… · PPT file · Web view · 2013-05-02SAP comprises of 18-20 modules in finance, ... The SAP Basis module](https://reader034.vdocument.in/reader034/viewer/2022051600/5aa8aec77f8b9a86188bceeb/html5/thumbnails/27.jpg)
27'Confidential Information for the sole benefit and use of [Global, beverages company]. © 2012 PwC
SOD – Framework – SOD Rule
![Page 28: SAP training - ISACA Denver Chapterisaca-denver.org/Students/ISACASAPIntro… · PPT file · Web view · 2013-05-02SAP comprises of 18-20 modules in finance, ... The SAP Basis module](https://reader034.vdocument.in/reader034/viewer/2022051600/5aa8aec77f8b9a86188bceeb/html5/thumbnails/28.jpg)
28'Confidential Information for the sole benefit and use of [Global, beverages company]. © 2012 PwC
SOD – Framework – Object Level
![Page 29: SAP training - ISACA Denver Chapterisaca-denver.org/Students/ISACASAPIntro… · PPT file · Web view · 2013-05-02SAP comprises of 18-20 modules in finance, ... The SAP Basis module](https://reader034.vdocument.in/reader034/viewer/2022051600/5aa8aec77f8b9a86188bceeb/html5/thumbnails/29.jpg)
29'Confidential Information for the sole benefit and use of [Global, beverages company]. © 2012 PwC
SOD – Framework – Object Level
![Page 30: SAP training - ISACA Denver Chapterisaca-denver.org/Students/ISACASAPIntro… · PPT file · Web view · 2013-05-02SAP comprises of 18-20 modules in finance, ... The SAP Basis module](https://reader034.vdocument.in/reader034/viewer/2022051600/5aa8aec77f8b9a86188bceeb/html5/thumbnails/30.jpg)
30'Confidential Information for the sole benefit and use of [Global, beverages company]. © 2012 PwC
Relationships Between Layers
![Page 31: SAP training - ISACA Denver Chapterisaca-denver.org/Students/ISACASAPIntro… · PPT file · Web view · 2013-05-02SAP comprises of 18-20 modules in finance, ... The SAP Basis module](https://reader034.vdocument.in/reader034/viewer/2022051600/5aa8aec77f8b9a86188bceeb/html5/thumbnails/31.jpg)
PwC
Ability A
Create Maintain Purchase Ordert-code: ME21Auth Object: M_BEST_BSAACTVT: 01
Create Maintain Vendor Master Recordst-code: FK01Auth Object: F_LFA1_APPACTVT: 01
SAP SOD Example
Ability B
![Page 32: SAP training - ISACA Denver Chapterisaca-denver.org/Students/ISACASAPIntro… · PPT file · Web view · 2013-05-02SAP comprises of 18-20 modules in finance, ... The SAP Basis module](https://reader034.vdocument.in/reader034/viewer/2022051600/5aa8aec77f8b9a86188bceeb/html5/thumbnails/32.jpg)
PwC
Questions?
© 2012 PricewaterhouseCoopers LLP. All rights reserved. In this document, “PwC” refers to PricewaterhouseCoopers LLP, which is a member firm of PricewaterhouseCoopers International Limited, each member firm of which is a separate legal entity.