Organizations, with significant investments in SAP ERP and its implementation creates unique risk dynamics created by the interplay of the application, business processes and the supporting infrastructure.

Organizations implementing SAP ERP have had to deal with several issues when assigning user authorization access rights to SAP transactions. Some of the issues organizations have had to deal with resulting in users on the SAP system having excessive access rights include :

• Definition of user access rights is left to the end of the implementation process, granting excessive access rights to users
• The defintion and assignment of rights to users is left to the implementors and the systems department.
• Only a few users understand how the controls work in SAP. As a result, SAP control features do not get implemented.
• Transaction level controls are often overlooked at the process design phase.
• With no controls framework in place, no one is sure what each user can actually do on the system.
• Once the problem of excessive rights has been understood, no one knows how to go about correcting the problem.

Our risk management solutions help organizations identify users with excessive access rights for corrective action, review key configurable automated and manual controls in SAP to identify key risk areas and provide transaction analysis reports to enable management identify transaction passed by-passing controls for further investigation.