What Is Segregation of Duties (SoD) in SAP GRC?

Business systems and information must be available for your staff to do their day-to-day job. Yet, providing one person with access to information and systems that is excessive and allows them to complete multiple related processes without an independent check opens up the possibility of the person exploiting company resources. For instance, a staff member able to create a supplier and authorise payments for that supplier.

That's where Segregation of Duties (SoD) comes into play. Segregation of Duties is a principle of internal control designed to prevent excessive errors and opportunities for fraud by ensuring that no single individual has control over all aspects of any critical financial transaction. SAP GRC's SoD analysis identifies and monitors conflicting permissions and risks in the SAP landscape.

Know how SoD is relevant to SAP security staff, auditors, and risk and finance personnel who have to analyze the processing of financial transactions, as well as user access rights.

What Is Segregation of Duties (SoD)?

Segregation of Duties (SoD) is the practice of dividing a set of related business processes (or some, but not all processes) between different people.

The objective is to reduce the risk of fraud, error or unauthorised transactions by encouraging the use of reasonable procedures and independent checks.

For example, if the process of making a supplier payment involves one person creating the supplier information, someone else reviewing the supplier's invoice and someone else authorising the payment, then it becomes more challenging for any one individual to create a fictitious supplier and transfer the company's money.

SoD helps in managing finance, procurement, inventory, and other activities where users access sensitive data or financial information.

Why Is SoD Important in SAP?

Segregation of Duties (SoD) is the practice of dividing a set of related business processes (or some, but not all processes) between different people.

The objective is to reduce the risk of fraud, error or unauthorised transactions by encouraging the use of reasonable procedures and independent checks.

For example, if the process of making a supplier payment involves one person creating the supplier information, someone else reviewing the supplier's invoice and someone else authorising the payment, then it becomes more challenging for any one individual to create a fictitious supplier and transfer the company's money.

SoD helps in managing finance, procurement, inventory, and other activities where users access sensitive data or financial information.

What Is the Role of SAP GRC in SoD Management?

SAP GRC (Governance, Risk and Compliance) provides solutions that help organisations manage governance requirements, business risks and compliance activities. One important Area is access risk management via SAP Access Control.

SAP Access Risk Analysis (ARA) allows organisations to determine any risk associated with access to objects, for example, users, roles, profiles, and so on. Based on defined rulesets, ARA assesses whether or not any assigned actions and permissions could cause conflicting access.

The analysis can identify different types of access risks, including:

• Segregation of Duties Risk: Exists when a user has access to more than one conflicting business function.
• Critical Action Risk: When a user has access to a single action that is deemed critical or high risk.
• Critical Permission Risk: When the user has an authorisation or permission that is critical.

Organisations can define actions, permissions, business functions and risk rules for SoD analysis. These are used by SAP Access Control to identify combinations of access that could lead to a conflict.

Using the results, security admins, risk owners, and compliance team members can trace access assignments and determine next steps.

Typical Instances of SoD Conflicts in SAP

SoD conflicts can be encountered within the business processes themselves. Typical examples are:

1. Vendor Setup and Processing of Payments

An employee who has the ability to create vendor master records and process payments may, where control is inadequate, create an unauthorised supplier and then make payments to that supplier. Separating the abilities would mitigate this risk.

2. Purchase Order Creation and Approval

Purchase order if the same person can both create and approve the purchase order there could be a lack of an independent review of the purchase decision. Organisations can split purchasing and approval processes.

3. Invoice Entry and Payment Authorization

A lone employee who can both enter supplier invoices and approve payments can either originate or process unauthorised transactions. Separating these duties can provide added strength to accounts payable controls.

4. Customer Master Data and Sales Transactions

When a customer is able to keep customer details and carry out sales or billing activities, the organisation could be at risk from inaccurate customer data or unauthorised transactions.

5. Journal Entry and Financial Approval

A user who is authorized to generate journal entries and authorise the journal entries could have too much control of accounting entries. It is good practice to have one user generating journal entries and a separate user to authorise them.

The true risk is a function of the business processes of the organisation, the access policies and internal control needs.

How Does SAP GRC Identify and Manage SoD Risks?

SAP Access Control enables a structured approach to the identification, assessment and resolution of access risks.

1. Define Risk Rules

Conflicting business functions are identified and corresponding rules are configured within the ruleset. The rules specify which sets of actions and permissions generate an access risk.

2. Assess Access Risk

Access Risk Analysis compares assigned access for users, roles and other supported objects to the rules you've established. It then pinpoints areas where SoD violations or other key access risks are likely.

3. Review and Prioritise Conflicts

The Risk owner and security teams analyze the results to see what each conflict is and what is likely to happen. They also check to see if the conflict reported could be a real business risk.

4. Remediate Access

Where possible, remove the superfluous permissions or change the role assignments to remove the conflict. Restrict access to just what the user needs to perform their role.

5. Apply Mitigating Controls

In some cases, when responsibilities cannot be separated due to business requirements or resources, a control framework may be established in the organisation for certain controls to be defined and allocated to individuals. These controls, for example, independent transaction screening/authorisation, will also require well-defined ownership and monitoring.

6. Perform Periodic Reviews

Access needs evolve as individuals transfer to a new department, change jobs or leave an organisation. Scheduled SoD and user access reviews can verify that current access rights are still fit for purpose.

What Are the Benefits of SoD in SAP GRC?

SAP GRC may help organisations with SoD management.

• Enhanced access control for users with conflicting rights.
• Low business risk: Aids in the prevention and handling of unauthorized transactions.
• Better financial controls: Promotes the separation of duties when dealing with invoices, payments, and accounting.
• Enhanced audit preparation: Assists with the preservation of access risks, reviews, and control activities information.
• More accountability: Easier to identify who granted approval and who monitored.
• Ongoing risk tracking: Enables consistent monitoring and evaluation as the access needs evolve.

All these advantages hinge on proper rules, proper role design, proper remediation, and ongoing monitoring. SAP GRC is an enabler of the control process, but it is the responsibility of organisations to identify and operate appropriate controls.

Who Should Understand SoD in SAP GRC?

Depending on your role, awareness of SoD may be helpful to SAP GRC consultants, SAP security and authorisation employees, internal auditors, risk and compliance specialists, as well as information technology (IT) governance personnel.

Those working in finance and finance-related fields may find it useful to learn about SoD because of how many finance processes involve sensitive activities like managing vendors, processing invoices, posting journal entries and approving payments. If you are taking SAP Finance Training, you might learn how financial processes, user roles and internal controls can all be tied together.

Conclusion

Segregation of Duties is an internal control principle used to mitigate the risks created by excess user access within an organisation. By segregating conflicting responsibilities, companies can increase control over sensitive processes and enhance accountability.

SAP GRC and SAP Access Control allow organisations to set access risk rules, analyse user authorizations, search for SoD conflicts, rectify unwanted access and observe mitigating controls. Learning about this information will enable SAP professionals and finance teams to be a part of a more protected and well-controlled business process.

Learn More About SAP with Prompt Edify

Prompt Edify offers SAP training and corporate learning programmes to help professionals develop knowledge of SAP functional and technical areas. Whether you are exploring SAP GRC, SAP security or SAP Finance Training, understanding access controls and business processes can support your professional learning journey.

‍