Webclass 107: SAP SOD: How to do a quick “auditor’s sense check”

Q1. Why might the auditor want to have an independent check of SAP user access?

Q2. Is it better to use SAP user master data for the auditor to check on Seperation of Duties conflicts during the period, or is it better to analyze transactional data?

Q3. If the entity uses role-based access to create user roles, should we base our audit on the role tables for analyzing if there are Seperation Of Duties transactions?

Q4. Why is it not enough to check the table that shows the list of users and profiles, in order to see which profiles a user has?

Q5. Within an Authorization Object there can be many Authorizations

Q6. An example of an Authorization field is BUKRS for company code and an example of a value in the authorization field is 0001 (the code for a company)

Q7. There can be many different types of authorization fields (BUKRS, TCODE, ACTVT) in an authorization

Q8. An Authorization requires all necessary fields for the object in order for it to be valid

Q9. If the Authorization Object does not have at least one Authorization with all necessary fields for that object, then, as long as the object is set to be checked and the transaction code is set to be checked, the user will not be able to access the object, and so will not be able to use the transaction code

Q10. Which table holds the user that entered the journal entry and the transaction code that was used to enter the journal entry?

Q11. If a transaction is entered into the SD or MM module then we will not find the user and transaction code in the general ledger BKPF table

Q12. When we use Process Mining for SOD analysis, is our result set – more – or less – restrictive than if we look at the list of users in each separate table of the process?

Q13. If we want to know if a user has access to transaction codes for the same company code, where can we find the information about which company codes the user can use a transaction for?