Segregation of duties where one application feeds SAP
A distributor system and a cloud procurement platform both feed SAP, and neither had a segregation-of-duties rule set. We defined 293 functions, found 41 conflicts and rated each by whether one person alone could cause a loss.
From our own project and product work. Client names and identifying details are removed, and some figures are rounded.
The situation
At the same consumer-goods company, two applications needed a closer look. The first is a distributor management system with a salesman ordering app, which handles secondary sales, trade schemes and claims. The second is a cloud procurement platform for supplier onboarding, sourcing events and contracts.
Both feed SAP. A claim approved in the distributor system is posted in SAP. A supplier onboarded in the procurement platform is paid from SAP. Neither application had a segregation-of-duties rule set, so nobody had checked whether one person could do both ends.
How we built the registers
- Read the evidence. Role and group extracts, permission screens, the vendor's published permission descriptions, the user manual, walkthroughs, questionnaires, user lists, and the company's SAP risk rules and function list.
- One function per action. Creating a master and changing it are two functions. A view permission is never merged with a create or approve permission.
- Find the pairs. Conflicts within each application, and between the application and SAP where one feeds the other.
- Rate by money. High only if one user alone can cause a loss or an unauthorised commitment, with no independent control in between. Medium if an independent approval remains, or the conflict weakens a key control. Low if there is no credible path to loss.
- Map users to roles. Official user lists were matched to role assignments across applications, and IDs not on the official list were set aside to confirm.
- Read the screens. Where permissions existed only as screenshots, we read them with text recognition and checked a sample by eye.
Results
| Measure | Distributor system and sales app | Procurement platform |
|---|---|---|
| Functions defined | 27 | 266 |
| Conflicts found | 13 (5 High, 8 Medium) | 28 |
| Mapped to the SAP rule set | 5 | 13 |
Of the 13 distributor conflicts, 6 sit within or across the distributor system and the sales app, and 7 run from the distributor system into SAP along the scheme and claim flow.
What changed
- Rated by money, not by count. A conflict is High because one person can cause a loss, not because a rule says so.
- Evidence over assertion. Documented access was tested against permission screens, audit trails and user lists.
- Theirs to run. Each register has the same layout, a written rating method and a user mapping built on the company's own data, so its team can maintain it without us.
Products and services
CompliBear can monitor these conflicts every day. See continuous controls monitoring, digital, cyber and IT risk and one control framework for six applications.