Category: Spreadsheets, Tools

This worksheet shared by Claire Worledge was used in the virtual event “Segregation of Duties Audits in SAP”, where we did hands-on practical exercises to check for Separation Of Duties issues in the Purchase To Pay document flow in SAP systems. When we check for SOD issues in a document flow, we not only look at risks relating to who has access to what; but we look at who has actually done what during the period. But even more than that, when we look at a document flow, we can see risks relating to specific documents in terms of user access. For example, I create a purchase order, and then I create a goods receipt for that purchase order and then I create an invoice for that goods receipt, and even the payment for the invoice. When we identify such cases, we are identifying risks that are much more “real” than only looking at who has a separation of duties conflict based on their access.

This spreadsheet shared by Claire Worledge was used as the first practical exercise in the virtual event on Thursday July 22nd, 2021 “Segregation of Duties Audit in SAP”. In this spreadsheet we see the methodology followed in order to check who has violated user access, based on the general ledger header table. Normally, this process would be done in a data mining tool (ACL, IDEA, SQL, Alteryx, QLIK), however, here we show it in Excel, for the purpose of understanding the process and to help those of you that don’t have access to any of the above tools.

This list of tables and fields shared by Claire Worledge includes those that were used in the virtual event on July 22nd, 2021 “Segregation of Duties Audit in SAP”. Here we list the SAP tables that help us to determine “who did what” during the period, either in the general ledger, purchase to pay or order to cash.