Central Process CatalogPDF download from SAP Help Portal:http://help.sap.com/saphelp_mic10/helpdata/en/b1/89005e27044008af62887572f9260e/content.htm

Created on August 28, 2015

The documentation may have changed since you downloaded the PDF. You can always find the latest information on SAP HelpPortal.

Note

This PDF document contains the selected topic and its subtopics (max. 150) in the selected structure. Subtopics from other structures are not included.

© 2015 SAP SE or an SAP affiliate company. All rights reserved. No part of this publication may be reproduced or transmitted in any form or for any purposewithout the express permission of SAP SE. The information contained herein may be changed without prior notice. Some software products marketed by SAPSE and its distributors contain proprietary software components of other software vendors. National product specifications may vary. These materials areprovided by SAP SE and its affiliated companies ("SAP Group") for informational purposes only, without representation or warranty of any kind, and SAPGroup shall not be liable for errors or omissions with respect to the materials. The only warranties for SAP Group products and services are those that are setforth in the express warranty statements accompanying such products and services, if any. Nothing herein should be construed as constituting an additionalwarranty. SAP and other SAP products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of SAP SE inGermany and other countries. Please see www.sap.com/corporate-en/legal/copyright/index.epx#trademark for additional trademark information and notices.

Table of content

PUBLIC© 2014 SAP SE or an SAP affiliate company. All rights reserved.

Page 1 of 4

Table of content1 Central Process Catalog1.1 P-CO-R Assignment1.2 Documenting Controls Centrally

PUBLIC© 2014 SAP SE or an SAP affiliate company. All rights reserved.

Page 2 of 4

!--a11y-->

1 Central Process Catalog

DefinitionThe central process catalog contains processes and process steps that are created centrally in the corporate group, and are directly or indirectly related eitherto financial reporting (to satisfy the requirements of section 404 of the Sarbanes-Oxley Act) or to disclosure controls and procedures (to satisfy therequirements of section 302).

UseThe central process catalog simplifies the tasks of the individual organizational units and in so doing reduces the costs of an SOA project. The individualorganizational units of the organizational hierarchy can accept the processes and their respective process steps unchanged by referencing them as they are inthe central process catalog, or they can copy them and adjust them to suit that particular organizational unit. If the organizational unit references the processsteps of a process, any changes made centrally to those process steps automatically apply to the organizational unit.

The central process catalog is compiled by the power user or by the person assigned to the role containing the task Edit Central Process Catalog (EDIT-CPCAT) .

StructureThe central process catalog contains processes that are arranged in a process group hierarchy. Each process consists of process steps that are organizedin a specific sequence.

Processes are located at the lowest level of the process group hierarchy. A process can be a subnode of any number of different process groups. Experienceat corporate groups has so far shown that, to represent the processes necessary for section 404, approx. 10 process groups each with 5 to 10 processes arerequired.

In the central process catalog, central attributes are made for a process as well as for the process steps (such as the transaction type for a process orwhether the process is industry-specific). Any additional attributes that are required need to be added subsequently by the individual organizational unitcopying that process.

Besides the attributes, you specify the following assignments for a process:· Assignment of control objectives and risks (P-CO-R assignment)

With the P-CO-R assignment, you enter the objectives of the controls contained in the process and the risks that could prevent the control objectives frombeing achieved.

· Assignment of account groupsThe SOA requires companies to document processes that have a significant impact on financial statements. For this reason, you assign account groupsto any process that influences them. You can choose from all account groups that were defined as significant for the corporate group in the account grouphierarchy.

A process step can be defined in the central process catalog as a control. In such cases, you specify general control attributes as well as the centralattributes for the process step (see Documenting Controls Centrally).

All objects defined in the central process catalog and all assignments are time-dependent.

IntegrationYou can define values for the transaction type in Customizing for MIC under Edit Attribute Values .

!--a11y-->

1.1 P-CO-R Assignment

UseIn the central process catalog, you assign one or more control objectives (CO) to a process (P). By doing so, you define the objectives of the process stepsdefined as controls in that process. You then assign one or more risks (R) to the combination of process and control objective. A risk is a potential event thatadversely impacts the desired outcome of a control objective.

PrerequisitesIn Customizing for MIC under Edit Attributes ® Attributes with Dependent Attributes , the power user has created control objective categories and one ormore control types for each control object category.

FeaturesFor each control objective, you select a control objective category that has been created in Customizing for MIC. The control objective category determines

PUBLIC© 2014 SAP SE or an SAP affiliate company. All rights reserved.

Page 3 of 4

which control types an organizational unit can later enter as an attribute for a control when accepting processes and documenting controls.

For each risk, you specify which condition could cause the risk to come into play and which consequence this could have. Furthermore, you can specifywhat would be the qualitative impact of the risk (such as negligible, minimal, immense). You can define the possible values in Customizing under EditAttribute Values .

The validity periods of the process, control objective, and risk must be compatible. This means that the validity period of a control objective must fall withinthat of the process, and the validity period of the risk must fall within that of the control objective.

ExampleProcess: Order processing

Control objective: Only authorized transactions are posted

Risk: The transaction is not reviewed conscientiously

!--a11y-->

1.2 Documenting Controls Centrally

UseWhen a process step has been defined as a control in the central process catalog, this control then has to be documented centrally using control attributes ina different Web application. These central control attributes can be changed by organizational units that have copied the process with the control. In this case,the central attributes serve as default settings that simplify work for the organizational units.

Prerequisites· The values that the control attributes can take have been defined in Customizing for MIC under Edit Attribute Values .· All settings for the process to which the control belongs have been made in the central process catalog (for example, the assignment to a control objective

and to a risk).· All attributes for the process step to which the control corresponds have been defined in the central process catalog.· You have authorization for the task Edit General Control Attributes in Central Process Catalog .· The task is scheduled (see Scheduling Tasks).

FeaturesDocumenting a control involves defining various attributes and assignments.

The following are examples of general control attributes:· Control Significance· Nature of Control· Control Purpose· Control Automation· Control Trigger· Assessment Attributes· Test Attributes· Control Relevance

In the Control - P-CO-R tab page, you assign one or more risks to the control. For the assignment, you have access to all risks that are assigned in the P-CO-R (Process – Control Objective – Risk) structure to the relevant process in the central process catalog (see P-CO-R Assignment ). Moreover, once the P-CO-R-C assignment has been made, you select the appropriate control type.

In the Control - Accounts tab page, you assign FS assertions from account groups to the control. For the assignment, you have access to the accountgroups and FS assertions that were assigned to the corresponding process in the central process catalog. From these, you select the assertions that arerelevant for the control.

PUBLIC© 2014 SAP SE or an SAP affiliate company. All rights reserved.

Page 4 of 4