Authorizations in SAP systems: what admins should look out for
Authorization tools - advantages and limitations
I show how SAP authorizations can be assessed and monitored by using the Three Lines of Defense model. This method can be applied even if the model is not used for all enterprise risks. You will learn how to integrate the different stakeholders into the lines of defense and harmonize the knowledge for the process. Also, what tools can be used for controls and cleanups in each case. This ensures, for example, that managers are able to assess the risks and derive measures, and that administrators can technically clean up the risks.
Make sure that the client-independent tables for logging are always logged when the parameters are not set to OFF. In addition to the parameters listed here, the table itself must also have the table logging hook set; This is usually done with the help of the transaction SE13. The settings are made in development and then transported to the other systems. The SAP standard already provides some tables for logging; For an overview of these tables, see SAP Note 112388 (tables requiring logging). You can evaluate the logging settings of the tables using the RDDPRCHK report or the RDDPRCHK_AUDIT transaction in the SAP system. The selection is made in the start image of the report, e.g. via the table name or the selection of options for logging.
A concept for SAP authorizations prevents system errors and DSGVO violations
Have you ever tried to manually track who among the users in your SAP system has critical authorizations? Depending on your level of knowledge and experience, this work can take a lot of time. If audits have also been announced, the pressure is particularly high. After all, it is difficult to fulfill all requirements regarding SAP authorizations manually.
The SAP CO module is the module for classic controlling in a company. Part (the responsible area) of it is the control and analysis of costs. This also includes the control of the cost types and the cost rates that are incurred and posted in the company. Controlling then usually reports directly to the company management. It is supported by the tools from the SAP CO module, which can provide comprehensive evaluations and analyses. SAP CO can be subdivided into several further subareas. These include, for example, CO-PC (Product Cost Accounting), CO-PA (Profitability Analysis) or PCA (Profit Center Accounting).
The possibility of assigning authorizations during the go-live can be additionally secured by using "Shortcut for SAP systems".
Any deviation from the defined process must be fully documented and justified.
For details on the availability of BAdIs, see SAP Note 1835509.