The Challenges in Auditing SAP

Quite a few businesses use SAP software to help them prepare their means and things to do. Its versatility and array would make it a obstacle to audit.

SAP is remarkably configurable and implementations frequently vary, even within just several organization units of a corporation – both of those fiscal and non-monetary. At the similar time, the productive operation of controls in the system’s setting is important to a sturdy money and operational command environment. For that reason, it is important to gain a great knowing of how SAP is currently being utilised in the company though setting up the audit scope and tactic. Auditing an SAP environment introduces numerous one of a kind complexities that can influence the audit scope and technique.

Small business procedures

SAP addresses most small business processes and a minor modify in the business approach can have a immediate result on the audit processes owing to the complexity of the program. Changes in the setup and configuration of the system, the launch method or generating new procedures may possibly end result in new modules and/or functionality in SAP and as such, added hazards require to be regarded as.

For illustration, a shopper may possibly take into consideration retiring a person of its legacy paying for units and relocating this performance on to SAP. In the previous, crucial controls above acquire order acceptance may perhaps have been carried out manually. But with the SAP implementation the shopper has considered automating the approval procedure in SAP. The set up of the automatic workflow course of action and consumer accessibility safety is hence critical to make sure that sufficient controls are preserved to mitigate the challenges. This would involve testing automated controls alternatively of the handbook controls more than acquire purchase.

Segregation and sensitivity

For an productive audit, the auditor requires to attain a good understanding of the style of SAP’s authorisation thought (stability design and style). In some scenarios, bad protection style and design success in users getting inadvertently granted access to pointless or unauthorised transactions. As a result the evaluation of the structure and implementation of SAP protection and access controls is significant to ensure proper segregation of duties is maintained and obtain to delicate transactions is well-controlled.

Segregation of responsibility conflicts can crop up when a consumer is specified entry to two or more conflicting transactions – for case in point, building a acquire order and amending seller master facts. A distinct mapping of the small business processes and identification of roles and duties concerned in the processes is vital in the structure of obtain controls to efficiently audit protection.

In addition, there could be transactions or accessibility ranges that are viewed as delicate to the business, these kinds of as amending G/L codes and buildings, amending recurring entries or amending and deleting audit logs. In an SAP audit these types of sensitive transactions would have to have to be thought of in the course of the scheduling stage.

Command selection

Organisations can tailor the SAP program to in good shape their organization demands together with a choice of configurable and inherent controls. Being familiar with the range approach guiding these controls is critical to the audit technique. Allowing for purchase orders, for case in point, to be authorized routinely via the technique is considered a configurable automated handle.

Nonetheless, the client might also select not to put into practice this functionality and address this threat by a guide handle. Auditors will need to fully grasp the controls the shopper has picked out to implement and the matrix of controls that they place reliance on to mitigate a person or additional challenges.

Varieties of Controls

In SAP there are 4 styles of controls that an audit client can utilise in order to produce a safe environment: inherent controls, configurable controls, software safety, and handbook critiques of SAP stories.

Generally entry or configurable controls are executed by the SAP system and are preventive in nature. On the other hand, manual controls together with handbook critiques of experiences are executed by an staff and are generally detective in nature. For illustration, in the procure-to-pay (P2P) procedure of SAP, there are typical automatic controls such as a few-way matching (matching of purchase orders, products receipt and invoices). The client may select to adopt four-way matching, or two-way matching of invoices, therefore requiring customisation to suit their distinct processes.

Every consumer will use a different mix of controls in order to realize their particular manage objectives, and since of the complexity of SAP application, auditing close to the system to obtain manage assurance is not an choice. For that reason the audit method wants to be customized for every single circumstance properly. It is also significant to highlight that SAP provides several controls that are inherent in the SAP natural environment. An instance of an inherent handle is that journal entries should equilibrium prior to publishing in SAP.

Configurable controls

In SAP it is significant to recognize the link concerning configurable controls and accessibility controls. In purchase to achieve the management objective there might be a mix of configurable and entry controls that produce a manage alternative. For example, “Obtain orders in excess of £1m get blocked routinely and simply cannot be processed.” This seems like a configurable regulate, but is really each a configurable handle and an access control, as it bargains with the configuration of the Buying Launch System in just SAP and specials with who has accessibility to make and approve a PO.

One more case in point is “Invest in Orders more than US$1m will have to be accepted by the supervisor.” This seems like an obtain management, but it is a configurable management as nicely owing to the configuration required for the launch strategy. In actuality, these are complimentary controls, two controls masking the exact same chance jointly. Without a person control, the other cannot deal with the hazard to the similar precision. The auditor ought to examination both equally the configuration and access aspects of these controls, so it is critical that they are recognized by the auditor and classified appropriately.

Approach pitfalls

SAP is a procedure based mostly ERP process and each and every SAP occasion may perhaps have different dangers connected with it. The capacity to customise and tailor the method, and its inherent complexity, noticeably will increase the overall complexity of stability configurations and prospects to possible stability vulnerabilities. Segregation of duty conflicts, glitches and flaws for that reason turn out to be much more possible.

Every single customer has distinctive business enterprise processes, solutions and companies, and techniques that match their environment. Coming up with the course of action successfully in SAP is critical to mitigate the risks linked with insufficient or failed business processes. An successful audit approach really should thus consist of an analysis of threats and an knowing of the organization method mapping for every SAP instance.

Rotation prepare

Offered that the technique is hugely customisable, course of action pushed and permits a vary of management picks, every SAP occasion would possibly have a unique chance profile. Additional inside SAP, the hazard profile of distinct modules and sub-modules such as financials (FI), materials administration (MM), income and distribution (SD), payroll, human capital (HC), enterprise details warehouse (BW), purchaser romantic relationship management (CRM) and so on will be diverse.

The extensive regions of the business enterprise operations that SAP software include would make it impractical to protect them all in a single solitary audit. To complete a in depth audit of SAP, it is suitable to consider a rotation strategy. This may possibly entail planning opinions of each SAP company process, module, sub-module program configuration and transform management and program stability, including the style and design of segregation of obligations and entry degrees. This makes sure that the audits are executed working with properly competent resources and include each individual threat place which includes small business procedure, security and related controls. These spots can for that reason be assessed properly to identify gaps in command weaknesses and advocate proper actions to solve concerns.

Threat-dependent Strategy

In addition to the previously mentioned challenges, SAP programs are also upgraded and increased periodically to satisfy ever-altering enterprise prerequisites. In the present-day economic weather, organizations are faced with modifying dangers in the surroundings that affect their enterprise procedures.

The intention of a danger-primarily based technique is to allow for auditors to tailor the overview to the locations of organization risk, giving way to larger focus on audit spots with a high-threat probable. The complexity of the SAP program and relevant small business procedures, as indicated over, may possibly lend by itself to increased inherent hazard and command possibility which ought to be taken into account in scheduling the audit.

The threat-based mostly approach really should include things like standard chance analysis, analytical audit processes, systems and course of action based fieldwork, and substantive testing. In this way, an auditor can perform the audit successfully with a diploma of reliability, as very well as optimising the time and exertion it consists of. It is hence essential that a prime-down risk centered audit solution is adopted to efficiently overview SAP.