This ReadMe explains execution steps to configure 50 mitigation controls.

Transcription

1 SAP AUTOMATED CONTROLS README README V1.0SP03 Purpose... 1 Overview... 1 Installation Instructions... 2 Import ABAP Add-on Support Package for Mitigation Control... 5 Related Documents... 5 Revision History... 6 Purpose This ReadMe explains execution steps to configure 50 mitigation controls. Overview AVM-LaserFocus eliminates up to 80% of the manual activities associated with the traditional remediation process by capturing within a single screen, both the visualization tool and providing the ability to drill down and eliminate the root cause within that same screen. LaserFocus combines the data related to each SOD conflict from the Access Control and its associated violation. This data is presented in an easy to understand business user level interface. Risk remediation is possible within different views and includes user, role and function level detail. The current build includes following folder: 1. Scripts: this folder contains: a. SAP_Automated_Controls.sql Figure 1.0: Build Note: Greenlight is providing AVM ECC ABAP Component separately. It contains: 1. EC _ PAT ensure to download this file from SAP SMP (Service Market Place).

2 .Pre-requisites The user should have sufficient technical knowledge and access permissions for the Net Weaver Java Stack Database schema, where AVM-LaserFocus application and applications are deployed. Installation Instructions Database Script for Control Configuration 1. Execute the SQL Script SAP_Automated_Controls.sql provided in package from folder /SAP Automated Controls/Scripts on NW JAVA database schema where LaserFocus tables reside. Execute following commands by replacing appropriate <user_id>/<password>: echo exit sqlplus SAP_Automated_Controls.sql 2. Perform Function Program Mapping for Following 26 Functions After Mitigation Control Configuration SQL scripts are executed on the NW JAVA server database, please login to LaserFocus application and perform Function Program mapping for following 26 Functions from "User Mitigation > Risk Configuration > Function Program Mapping". Function AP01 AP02 AP04 AR01 AR02 AR03 AR04 AR05 AR07 FA02 GL01 GL02 MM01 MM02 MM03 MM05 MM06 PR01 PR02 Function Description AP01 - AP Payments AP02 - Process Vendor Invoices AP04 - Manual Check Processing AR01 - AR Payments AR02 - Cash Application AR03 - Clear Customer Balance AR04 - Credit Management AR05 - Maintain Billing Documents AR07 - Process Customer Invoices FA02 - Maintain Asset Master GL01 - Post Journal Entry GL02 - Maintain GL Master Data MM01 - Clear Differences IM MM02 - Enter Counts - IM MM03 - Enter Counts and Clear Diff - IM MM05 - Goods Receipts to PO MM06 - Maintain Material Master Data PR01 - Vendor Master Maintenance PR02 - Maintain Purchase Order

3 Function PR05 PR06 SD01 SD03 SD04 SD05 SD06 Function Description PR05 - Purchasing Agreements PR06 - Release Requisitions SD01 - Maintain Customer Master Data SD03 - Sales Rebates SD04 - Sales Document Release SD05 - Sales Order Processing SD06 - Sales Pricing Condition This task is to be done by LaserFocus Administrator / Functional consultant. Refer section "27.5 FUNCTION PROGRAM MAPPING" from "SAP_AVM_User_Guide_v1.0SP03.pdf" guide for additional details. 3. In this build, we are releasing configuration scripts for following risks. Risk Id F001 F013 F028 M013 M014 P001 P002 P003 P004 P005 P006 P007 P008 P011 P013 P018 P026 P027 P028 P029 Risk Description Create a fictitious GL account and generate journal activity or hide activity via posting entries. Create the asset and manipulate the receipt of the associated asset. Adjust the subsidiary balance using the vendor invoice entry and then cover it up using journal entries. Hide IM inventory adjustments via ledger entries. Hide IM inventory adjustments via ledger entries. Maintain a fictitious vendor and enter a Vendor invoice for automatic payment. Maintain a fictitious vendor and create a payment to that vendor. Enter fictitious vendor invoices and then render payment to the vendor. Purchase unauthorized items and initiate payment by invoicing Enter fictitious purchase orders for personal use and accept the goods through goods receipt Enter fictitious vendor invoices and accept the goods via goods receipt. Enter a fictitious purchase order and enter the covering payment. Create a fictitious vendor and initiate purchases to that vendor. Inappropriately procure an item and manipulating the IM physical inventory counts to hide. Add items to the material master or service master file and create fraudulent purchase orders for those items. Add an item to the material master or service master file and then fraudulently adding those items to purchasing agreements. Enter fictitious purchasing agreements and then render payment. Risk of entry of fictitious Purchasing Agreements and the entry of fictitious Vendor or modification of existing Vendor especially account data. Modify Purch agmnts and receive goods for fraudulent purpose. Enter unauthorized items to a purchasing agreement and create an

4 Risk Id P032 P035 P040 P045 P049 P052 S001 S002 S003 S004 S005 S006 S007 S008 S009 S010 S011 S013 S016 S017 S018 S019 S020 Risk Description invoice to obtain those items for personal use. Risk of entering or maintaining a purchasing agreement and authorizing the related requisition through its release. Risk of the same person entering a Purchasing Agreement for materials and then adjusting the IM inventory for those materials. Risk of the same person releasing a requisitioning and generating the accompanying purchase order. Inappropriately procure an item and manipulating the IM physical inventory counts to hide. Risk of the same person entering a Purchasing Agreement for materials and then adjusting the IM inventory for those materials. Enter fictitious vendor invoices and then render payment to the vendor. Enter or modify sales documents and approve customer credit limits. Create sales documents and immediately clear customers obligation. Create a fictitious customer and initiate fraudulent sales document. Make an unauthorized change to the master record (payment terms, tolerance level) in favor of the customer and enter an inappropriate invoice. Inappropriately create or change rebate agreements and manage a customer s master record in the favor of the customer. Could also change a customers master record to direct payment to an inappropriate location. Potentially clear a customer's balance before and create or make the same change to the billing document for the same customer, clearing them of their obligation. Inappropriately create or change sales documents and generate a corresponding billing document for it. Manipulate the users credit limit and assign generous rebates to execute a marginal customers order. Enter a fictitious sales document and then render fictitious payments. Create a billing document for a customer and inappropriately post a payment from the same customer to conceal non-payment. Create a fictitious customer and initiate payment to the unauthorized customer. Change the accounts receivable records to cover differences with customer statements. Enter sales documents and lower prices for fraudulent gain. Perform credit approval function and modify cash received for fraudulent purposes. Enter a fictitious sales rebates and then render fictitious payments. Risk of the same person entering changes to the Customer Master file and modifying the Cash Received for the customer. Risk of entering and releasing sales documents by the same person.

5 Risk Id S021 S022 S023 S024 S025 S026 S028 Risk Description Risk of entering sales documents and giving sales rebates by the same person, effectively granting an indirect price discount. Risk of modifying and entering Sales Invoices and approving Credit Limits by the same person. Risk of sales price modifications for sales invoicing. Maintain a customer master record and post a fraudulent payment against it. User can create a fictitious customer and then issue invoices to the customer. User can create/change an invoice and enter/change payments against the invoice. User able to create a fraudulent sales contract to include additional goods and enter an incorrect customer invoice to hide the deception. Import ABAP Add-on Support Package for Mitigation Control 1. Deploy LaserFocus ABAP Add-on on ECC system from the package /AVM ABAP Component/ECC Component. 2. SAP ECC ABAP Add-On Support Package.zip file consists of EC _ PAT For more information refer: ECC_Add-On_Support_Package_Installation_Guide_v1.0SP03.pdf Related Documents For more information on SAP automated controls refer the following guides. 1. AVM_Control_Validation_Guide_v1.0SP03.pdf- This document provides details to perform validation of SOD controls. 2. AVM_Mitigation_Control_Functional_Specification_Guide_v1.0SP03.pdf- This document provides functional specification details of all the functions used for mitigation controls. 3. AVM_Mitigation_Control_Reference_Guide_v1.0SP03.pdf- This document provides detailed information about risks along with the functions, joining conditions, execution sequences and the input parameter details. 4. ECC_Add-On_Support_Package_Installation_Guide_v1.0SP03.pdf- This guide provides step by step instruction on deployment of AVM-LaserFocus ECC Support Package. 5. LaserFocus_GRC_Add-On_Support_Package_Installation_Guide_v1.0.pdf- This guide provides step by step instruction on deployment of LaserFocus

6 6. Add-On Support Package. Revision History Document Title: SAP_Automated_Controls_ReadMe_v1.0SP03 Date Created: 05 June 2015 Document Revision: 1.0SP03 ======================================================= Copyright Greenlight Technologies, Inc. All Rights Reserved. =======================================================