Maxim Chuprunov. Auditing and. GRC Automation. in SAP. ^ Springer

Transcription

1 Maxim Chuprunov Auditing and GRC Automation in SAP ^ Springer

2 Contents List ofabbreviations xxix I From Legislation to Concept: ICS and Compliance in the ERP Environment 1 Legal Requirements in ICS Compliance Definition ofterms and Differentiation Compliance Internal Control System (ICS) 4 12 Legal ICS Requirements Around the World -the Many Faces of SOX SOX in the USA SOX in Canada (Nl ) SOX in Japan SOX in China 8 13 ICS Requirements in Europe Eighth EU Directive Germany Switzerland Austria United Kingdom of Great Britain and Northern Ireland France Denmark Italy Spain ICS Requirements in the Financial Sector Solvency II in the Insurance Industry Basel II and III in Banking 15 IS ICS as Contributing Factor to Business Success? Summary 17 2 The Auditor Is Coming: When, Why, and How to Cope ICS in the IT Environment from the view of Auditing The Challenge Presented by Information Technology Transaction Audit as Audit Approach in the IT Environment 21

3 xvlll Contents 2.13 Approaches for a Transaction Audit: Focus on ICS ICS and Mandatory Transaction Audit ICSAssurance in Practice The Auditor's Focus Selected Auditing Principles 223 Types of External Audit in the ERP Environment Recommendations forworking with the Auditor Summary 34 3 ICS Requirements and ERP Systems: Basic Principles, Frameworks, Structure Defining ICS Content in the SAP ERP Environment ICS Basic Principles in the ERP Environment: From GAAP to GAPCAS Who Definesthe Rules in the SAP Environment? Control Identification Process Structure of a Classic ICS Framework in the ERP Environment Structure of Efficiency-Oriented and Profitability-Oriented Controls in the ERP Environment ICS-Relevant Reference Models and Standards COSO CobiT ITIL GAIT ITAF Risk IT VallT CMM MOF ISO 27k PCI-DSS Summary View of Reference Models Summary 56 4 How Does SAP Deal with Risk- and Compliance-Related Topics? Software Certification SAPNote Certification Reports Compliance-Relevant Guides SAP Online Resources 61

4 Contents 422 Security Guides DSAG Guides: Audit Guides, Data Protection Guides Integrated Approach in SAP GRC 10.0 and Further Compliance-Relevant Solutions SAP Governance, Risk, and Compliance Suite SAP Process Control SAPAccess Control PolicyManagement SAP Risk Management Summary Overview of Integration Scenarios in SAP GRC SAP Audit Management SAP Audit Information System SAP Security Optimization Service RSECNOTETool Compliance-Relevant Content Direct ICS Content What Controls Are Available in SAP? Content with ICS Relevance: Standard Business Processes and Controls in SAP Summary 92 II From Concept to Content: Audit Guide for SAP ERP 5 AuditrRelevant SAP Basics In the Beginning Was the Table: SAP as Table-Controlled Application Data in an SAP System Controls in the SAP System Table-Specific Search Transaction-Specific Search Program-Specific Search The Relationship Between Programsand Transactions The Relationship Between Programs and Tables Summary of the Search Options in SAP Organizational Structures in the SAP System : Authorizations Flow and Hierarchy of Authorization Controls Authorization Objects Determining Authorization Objects Roles in the SAP System Users in the SAP System User Types in SAP 128

5 527 Example of an Authorization Analysis Summary IT General Controls in SAP ERP Organizational Controls IT Organization IT Outsourcing: Who Is Responsible forthe Controls? Guidelines and Documentation Controls in the Area ofchange Management and Development SAP System Landscape Change and Transport Management Client Control Maintenance and Updates SAP Solution Manager Security Controls for Access to the SAP System and for Authentication Identity and Life Cycle of the User Password Protection Handling Standard Users Emergency User Concept Security and Authorization Controls within SAP ERP Protecting Programs and Transactions Basic Level 151 6A2 Protecting Programs and Transactions-Advanced Level Protecting Tables Controlling Authorization Checks Critical AdministrationTransactions Consideration of the Principle of Segregation of Duties Summary General Application Controls in SAP ERP The Principle of Unalterability Protecting Data in Tables Debugging Modifiability of Documents Controls for Data-Related Traceability Change Documents in SAP Table Logging Document Number Assignment Traceability of User Activities in SAP System Log 174

6 Contents 732 Security Audit Log History of Transaction Calls Traceability of System Changes in the Change and TransportManagement System (CTS) ; Cross-Process Processing Controls Monitoring Update Terminations Completeness of the ALE Interface Processing Remote Function Call Connections Completeness of Batch Input Processing Summary Controls in Financial Accounting Underlying Control Mechanisms in General Ledger Accounting (FI-GL) Principle: Real-Time Postings Financial Statements G/L Account Master Data Checking that Transaction Figures Are Consistent with the Accounting Reconciliation Selected Controls for Closing Operations Reconciliation Work in FI-GL Controls over the Accuracy and Quality of Data in General Ledger Accounting Accurate Account Determination Field Status Groups Calculating Taxes for Manual Postings A Validations in SAP Foreign Currencies Completeness of Processing in General Ledger Accounting Document Parking Recurring Entries Reconciliation Ledger Data Security and Protection in General Ledger Accounting Protecting Company Codes Tolerance Groups Protecting Master Data Critical Transactions Segregation of Duties in General Ledger Accounting Controls in Asset Accounting (FI-AA) Basics of Asset Accounting in SAP 218

7 xxii Contents 852 Default Values for Asset Classes Account Determination in Asset Accounting Consistency Check for Account Determination and Configuration Depreciation Asset History Sheet LowValue Assets Authorization Control in Asset Accounting Critical Authorizations in Asset Accounting : Controls in Accounts Payable (FI-AP) and Accounts Receivable (FI-AR) Accuracy of the Reconciliation Accounts Payment Functions One-Time Customers and Vendors-Caution! Ageing Structure and Value Adjustments Segregation of Duties for Master Data Maintenance Summary Control Mechanisms in the SAP ERP-Supported Procure to Pay Process Ordering Maintenance of the Organizational Structures Consistentwith Authorizations Segregation of Duties in Ordering Goods Receipts and Invoice Verification Goods Receipts: Critical Movement Types Way Match and Payment Blocks in Logistics Invoice Verification Check for Duplicate Invoice Entry GR/IR Account Clearing the GR/IR Account Closing Operations and Reporting of the GR/IR Account in the Balance Sheet Controlsfor Stocks Maintenance of Material Master Data Non-Valuated Stock Value and Split Valuation Account Determination for Material Movements Correction of Stock Values: Inventory and Material Devaluations Release of Scrapping Product Cost Accounting Goods Issues from Non-Valuated Stock Corporate Governance Summary 258

8 Contents 10 Control Mechanisms in the SAP ERP-Supported Order to Cash Process Controls in the Preparatory Sales and Distribution Phase Controls during Order Entry Quality of Customer Master Data Segregation of Duties for Master Data Maintenance Credit Limit Assignment and Control Controls in Order Fulfillment and Revenue Recognition Controls for Delivery of Goods Pricing and Determination of Sales Tax Return Deliveries and Credit Memos Billing Due List Completeness of Accounting Entry of Billing Documents Dunning Summary Data Protection Compliance in SAP ERP Human Capital Management Legal Data Protection Requirements Data Protection Basic Principles: European Union Directive Co-Determination and Employee Data Protection Excursion: Protection of Patient Data General Data Protection-Relevant Control Mechanisms in SAP Tracing Changes to Personal Data Logging Report Calls in SAP ERP HCM Deleting Data and Making it Unrecognizable Personal Data Outside SAP ERP HCM Special Requirements of SAP ERP HCM Authorizations and Roles in SAP ERP HCM Differentiating Attributes in SAP ERP HCM Personnel Events Structural Authorizations Authorization Main Switches Summary Fraud in an SAP System Introduction to "Fraud" TypesofFraud Fraud and the SAP System 305

9 xxiv Contents 122 Fraud Scenarios in SAP Basis "Wrlte-Debugging"Authorizations Processing a Batch Input Session undera Different User ID Fraud Scenarios in the General Ledger Fraudulent Manual Document Postings in the General Ledger Identification and Analysis of Manual Journal Entries Fraud Scenarios in the Sales Area Issuing Fictitious Invoices to Fictitious Customers Granting Improper Credit Memos or Discounts Excessive Use offree Goods ImproperWrite-OffofOpen Customer Receivables Fraud Scenarios in Personnel Accounting Fictitious Employees Limited Access to Own HR Data Segregation of Duties for Confidential Data Summary Excursion: FDA Compliance and Controls in SAP Legal Requirements in the Manufacture of Food and Medicinal Products FDA-Relevant Legal Requirements in an International Comparison GxP-The FDA Basic Principles IT from the View of FDA Compliance Validation of IT Systems Validation Procedure Controls in Implementation Processes FDA Compliance in IT-Supported Business Processes Examples: Controls in Procurement Examples: Contcols in Production Management Examples: Controls in Quality Management." Examples: Controls in Asset Maintenance Examples: Controls for Batch Traceability Examples: Controls in Warehouse Management Processes Observing FDA Compliance for System Maintenance, System Updates, and System Changes Summary Examples of Efficiency-Oriented and Profitability-Oriented Analysis Scenarios in SAP ERP Process-Related Data Analyses 331

10 Contents Comparison of the Purchase Order Date with the Goods Receipt Date Timely Release or Creation of Purchase Requisitions and Purchase Orders Time between Incoming Purchase Order and Confirmation of the CustomerOrder Ten Further Examples of Possible Data-Based Process Analyses ' Analysisof Master Data Quality Qualityof Customer Master Data Produced Materials with No Bill of Materials Reconciliation of Material Costs within a Company Code Ten Further Examples of Possible Master Data Analyses Manual Data Changes Changes to Purchase Requisitions Changes to Purchasing Documents Changes to Sales Documents Manual Data Changes-Ten Further Examples Supplementing SAP ERP Standard Reports A1 Planning Parameters Added to Stock Analyses Customer Master Data Added to Credit Management Analysis Summary 360 III From Concept and Content to Implementation: Automation of an Internal Control System 15 ICS Automation: How to Set the COSO Cube in Motion Basic Concept of ICS Automation COSO Cube in Action Concept of ICS Automation ICS-Relevant Objects and Documentation Organizational Units Processes Controls Control Objectives Risks Account Groups Example of an ICS Data Model Basic Scenarios of ICS Activities Documentation Selection and Prioritization ofcontrol Activities Control Execution Design Test 376

11 xxvi Contents 1535 Effectiveness Test ; Survey Risk Assessment Remediation Sign-Off Report Evaluation Persons as Links Between ICS Objects and Activities Summary ICS Automation Using SAP Process Control introduction: ICS Implementation with SAP Process Control Technical Implementation Technical Architectureand Installation Initial Configuration of the Standard Functions Information Sources on Implementing, Operating, and Upgrading SAP Process Control r Data Model ICS Master Data in SAP Process Control ICS Data Model in SAP Process Control Central vs. Local ICS Master Data Time Dependency of ICS Master Data Traceabilityof Changes Concept of Object-Related Security Customer-Specific Fields Multiple Compliance Framework Concept Implementation ofthe ICS Process ICS Documentation Process Scoping Process Planning Process, Tests, and Assessments Issue Remediation Process Reporting ICS and Compliance Implementation: Roles Authorization Model in SAP Process Control Object-Related Security in Action First Level vs. Second Level Authorizations Predefined Best Practice Role Concept in SAP Adjusting the Roles SAP Process Control as GRC Component -New Features and Developments Policy Management and Other New Features in Release

12 Contents Integration with SAP Access Control Integration with SAP Risk Management Merging GRC, Strategy, and Performance Topics Summary Implementation of Automated Test and Monitoring Scenarios in the SAP ERP Environment Automated Test and Monitoring Scenarios in the SAP Environment Offline CAATTools Online CAAT Reports and Evaluations Compliance Management Software Automated Tests and Monitoring in SAP Solutions for GRC Release Introduction Continuous Monitoring Framework Continuous Monitoring Framework - Potential and Expectations Setting up CMF Scenarios in SAP Process Control Connecting SAP Solutions for GRC with Business Applications Data Sources in SAP Process Control Creating Business Rules in CMF Monitoring Data Changes in CMF Automation Using Predefined Best Practice Scenarios Connecting Controls with Rules And off You Go! Potential of CMF Scenarios in SAP Process Control Use of SAP NetWeaver Business Warehouse forcontinuous Monitoring Thoughts About SAP BusinessObjects Summary Experiences from Practice and Projects Practical Experiences: Projects for ICS and Compliance Automation Tools for Implementation Best Practice Project Structure for ICS Implementation Business Blueprint ICS Content Factorsthat Influence the Project Expense Success Factors Project Examples for ICS and Compliance Automation Coverage of Swiss Compliance Requirements at KUONI Integrated GRC Approach at Tecan 485

13 xxvlll Contents 183 SOX at Ericsson ICS Framework at Ericsson SOX Compliance Process at Ericsson Experiences from Previous Projects Optimization Potential Steps Towards Optimization Review of the Stages of Evolution of the ICS and Conclusion 496 References 5fll The Author of this Book Contributors to this Book Index 509