Separation of Duties in SAP: Conflicts and Fixes

Why SoD conflicts produce the most cited audit findings

Segregation of duties conflicts produce the most cited findings in SOX audits, internal audit reviews, and external financial statement audits at Fortune 500 SAP customers. The reason is that SoD enforcement is the single most testable IT general control in the financial reporting environment. The auditor reviews the SoD conflict report, selects a sample of users with conflicts, and traces the conflict through to actual transactions executed. The finding is binary. Either the conflict is present and the customer can explain it, or the conflict is present and the customer cannot.

This article documents the conflict definitions, the classification framework, the remediation choices, and the residual risk acceptance methodology that produces audit defensible SoD posture. Reference the SAP security audit pillar, the compliance framework pillar, and the GRC and security expertise.

The conflict definition and the ruleset that captures it

An SoD conflict is the combination of two transactional capabilities that, when held by the same user, allow the user to both initiate and conceal a fraudulent transaction. The classic conflict is the ability to create a vendor master record combined with the ability to post a payment to that vendor. The ruleset that captures the conflict is the codified table of combinations the customer treats as conflicts. The SAP delivered ruleset is the starting point. The customer calibrated ruleset is the operating reference.

The customer position is to maintain a calibrated ruleset rather than rely on the delivered ruleset. Reference the GRC Access Control implementation analysis, the SoD risk quantification paper, and the authorization concepts analysis.

The three classification levels for each conflict

Each detected conflict is classified into one of three levels. Critical conflicts are those that allow direct financial impact without compensating control. High conflicts are those that allow indirect financial impact or that require a second user collusion. Medium conflicts are those that produce audit logging trail and that require compensating control to be acceptable. The classification drives the remediation decision. Critical conflicts must be remediated. High conflicts must be remediated or compensated. Medium conflicts can be accepted with documented compensating control.

The customer position is to classify each conflict with a documented classification rationale rather than treat all conflicts as equivalent. Reference our SOX ITGC analysis, the firefighter ID analysis, and the SOX compliance expertise.

Classification rationale documented at the conflict level reduces external auditor follow up effort by 40 to 60 percent because the auditor can verify the customer reasoning without independently reconstructing it.

Remediation choices for confirmed conflicts

Three remediation choices are available for each confirmed conflict. First, role redesign that splits the conflicting capabilities into separate roles assigned to separate users. Second, organizational redesign that separates the responsibilities at the position level. Third, compensating control that retains the conflict but adds a documented detective control that surfaces fraudulent transactions before they materialize. The choice depends on operational feasibility, organizational size, and the classification level of the conflict.

The detail is in our role design analysis, the GRC implementation analysis, and the user access review analysis. The authorization audit guide paper documents the full remediation methodology.

Residual risk acceptance methodology

Residual risk acceptance is the formal process by which the customer documents that a remaining conflict is acceptable given the operating compensating controls. The methodology requires three elements. First, the documented compensating control that mitigates the residual risk. Second, the documented business justification that explains why the operational arrangement requires the residual conflict. Third, the documented accountability that names the executive accepting the residual risk. The three elements together produce an audit defensible residual position.

The implementation detail is in our license audit pillar (cross cluster reference), the compliance framework pillar, the critical authorizations analysis, and the security notes patch analysis. The GRC and security expertise documents the full senior advisor methodology.