GRC Nordic SAP User Management · 2020. 9. 16. · SAP User Management Personal experience in audit...
Transcript of GRC Nordic SAP User Management · 2020. 9. 16. · SAP User Management Personal experience in audit...
GRC Nordic SAP User Management webinar
SAP Authorisationmanagement
Security and Risk Managenemt
SAP AuthorisationSupport and Access
Management
Licence Management
SAP User Management
Team today
Matti Halonen Mikko Syrjänen
SAP User Management audit – how to prepare ?
How to prepare for an SAP User Management Audit
We have divided the presentation into six blocks
Focus will be on SAP User Management
Personal experience in auditengagements
Customer auditexperiences
Several areas of expertise not discussed today but we hope to get your feedback !
Take home from this presentation a positive attidudetowards audit !
Understanding the Audit
Governance
Processes
Technical reality
ITGC
To Do List
Covid-19
Understand different objectives
• Financial audit
• Internal audit
• Tax audit
• Industry / quality
• Special audit
Audit
Types
Audit
Objectives
Efficiency
Effectiveness
Audit
Plan
• Financial reportingreliability
• Internal controlenvironment / risks
• Compliance withindustry standard
• Complexity
• Risk basedapproach
Vs.
• Time
• Skills / Resources
• Framework
• Plan
• Findings
• Report
Understanding the Audit
Governance
Processes
Technical reality
ITGC
To Do List
How auditors see SAP User
management? Governance
Processes
Technical reality
ITGC
Top-down risk view
SAP Authorisation concept
Role change process
Object values
System parameters
Description of how everything should work
• Organisation/ownership
• Access risk approach
• Process descriptions
• Access risk tools, details, procedures
• Technical approach
SAP Authorisationconcept
Auditors
view
Recommendation
• Basis for the audit
• Compares contentagainst ”standard”
• Completeness
• Up to date ?
• Invest in this !!!
• Update
• Provide to auditorfor commentingand review
Understanding the Audit
Governance
Processes
Technical reality
ITGC
To Do List
Real life comments…
Earlier we prepared days for coming audit with mixed feelings…
Now we have everything relevantdocumented and we simply share theupdated authorisation conceptdocument with our audit !
Defined processes, approvals and audit trails
• Roles & responsibilities
• Reporting
• Concept management
• Regular meetings to govern and improve
AuthorisationManagement Processes
User Management Processes
Access riskmanagement Processes
• Tickets, CR, Incidents
• User add, move, remove, leave etc.
• Role assignment
• Role change
• Projects
• Approach /methods
• Monitoring / Reporting
• User Access Review
• Risk reduction
• Risk prevention simulation
Understanding the Audit
Governance
Processes
Technical reality
ITGC
To Do List
Snap shot of technical reality…
• Job descriptions vs rights
• Access risk levels
• Mitigation of remainingrisks
• Correctly maintained
• Technical feasibility ?!
Business roles
IT roles
Externals
Power/key usermanagement
Special
Topics
• User with widerights without ”jobdescription”
• Method and toolsto control
• Review processfor logs
• Tables
• Program / Executionrights
• Z Codes
• Batch input sessions
Understanding the Audit
Governance
Processes
Technical reality
ITGC
To Do List
Typical audit requests
• Information securitypolicy
• Authorisation conceptdocument
• Landscape
• Approval policies
Documentation Data requests
• RSPARAM/PAHI
• USR02 table
• RSUSR100 reports
• Tickets / approvals
• PA HR Tables
• Tcode /Object values
• DEVAccess table
Understanding the Audit
Governance
Processes
Technical reality
ITGC
To Do List
Authentication/pswdsLogon etc
Typical audit requests
• Information securitypolicy
• Authorisation conceptdocument
• Landscape
• Approval policies
Documentation Data requests
• RSPARAM/PAHI
• USR02 table
• RSUSR100 reports
• Tickets / approvals
• PA HR Tables
• Tcode /Object values
• DEVAccess table
Understanding the Audit
Governance
Processes
Technical reality
ITGC
To Do List
Official processbypassed / Approvals
Typical audit requests
• Information securitypolicy
• Authorisation conceptdocument
• Landscape
• Approval policies
Documentation Data requests
• RSPARAM/PAHI
• USR02 table
• RSUSR100 reports
• Tickets / approvals
• PA HR Tables
• Tcode /Object values
• DEVAccess table
Tables
Program / Executionrights
Z Codes
Batch input sessions
Transport system
Understanding the Audit
Governance
Processes
Technical reality
ITGC
To Do List
Who has the responsibility of this area ?
• Standard users
• Password parameters
• Logon settings
System Parameters
Change
Management
Other layers of security
• Transports
• Production clientcontrol history
• Change logging
• Test / qualitysystem security
• Developmentsystem security
• RFC Connections
• Firewalls, networks
• Database
• Operating System
Understanding the Audit
Governance
Processes
Technical reality
ITGC
To Do List
SAVE TIME
• Documentation
• Agree timetable / slack in calendar
• Auditor access / data requests
UNDERSTAND•Audit objective
•Audit thinking
How to make audit less painfull / get the value
CO-OPERATE
•Be open about the situation
•Explain your plan and efforts
•Ask for advice and explanations
SELF AUDIT
• Fix obvious things during the year
• Explain this approach to your auditor
• Explain this to your management / user community
Agree the audit findings before the final report
Top 4 Audit issues
Understanding the Audit
Governance
Processes
Technical reality
ITGC
To Do List
• No approach to security
• No documentation
Lack of policy
Lack of plan
Power usermonitoring
Access risklevel
Approvals
• Solution missing
• Review processfailing
• Risk levels high
• Several areasunsecure
• Official processbypassed
• Projects
Create plan and improve every year
SAP Documentation and guidelines
S/4 not started….or exit plan
Impact to audit
Understanding the Audit
Governance
Processes
Technical reality
ITGC
To Do List
• Access risks / SoD
• Reduced physicalobservation
Fraud risks higherdue to theuncertainty/ layoffs
Personnelpartly/fullyremote
Audit remotely
• Authentication
• Multifactor to SAP
• Access risks
• No major issueswhen processesin place
Audit focus is in valuations, goingconcern issues currently
Will shift later to remote work questionsCovid-19
GRC Nordic tapahtumat 2020
Tapahtuma Ajankohta
› Lokakuu › Webinaari: Deep dive to SAP Security around authorisations,
› Marraskuu › Webinaari: SAP autorisointikonsepti
› Joulukuu › Webinaari: SAP S/4 analyysi