Reasoning behind rule set changes

[Former Member]

We are currently looking at updating our rule set to include the changes from Q2 2009 and Q2 2010 rule set changes. In the Q2 2009 changes there are MANY changes that involve removing the authorization object F_BKPF_KOA and activating F_BKPF_BUK with values 01 and 02. Does anyone know SAP's reasoning for why this authorization object is an issue? When doing tracing behind some of these transactions, that authorization object (F_BKPF_BUK) with value of 01 is needed just to execute the transaction.

Any ideas on what SAP's thoughts were behind this? Why would you want to put risk restrictions on switching company codes?

Any help would be great!

Elizabeth

[Former Member]

Hi Elizabeth,

The SAP ruleset changes are reviewed through a collaborative ruleset council based upon requests for updates from multiple sources.

There will always be continual improvements and substantial localisation requirements for individual businesses.

The SAP Delivered ruleset should be used as an accellerator and a guideline but should never be treated as the absolute truth!

It is designed to be generic in nature so that it can be used as a quick start for multiple clients.

It maybe that in this case, the investigations showed that F_BKPF_BUK is a more appropriate check as it is required to call the transaction and therefore a mandatory object to complete the activities in the defined function.

However, your own system configuration of processes and authorisations may mean that you chose to trigger the risk on a different combination. I would be inclined to work with your compliance function, internal and external auditors to define the rules which work for you rather than just update a ruleset based on an SAP released update.

[Former Member]

Ok thanks Simon.