Mitigation controls for self-conflicting transactions

[Former Member]

   
We have seen as per SAP Note 1600667 - Transactions that conflict with
themselves, that there are transactions in the SAP GRC Standard Rule Set
that conflict with themselves. 

Please advise on what could possibly be used as suitable controls -
e.g. reports that can be run or other.

We require suitable mitigation controls or examples that can be adapted
or used for addressing these.

The note indicates that "Permissions are not different, mitigating
control required"

Per conflict reports we have the following of these transactions in our
roles:

FB02
FB08
FBRA

[alessandr0]

Dear Don,

as most of the community members are technical consultants it might be difficult to get the answer you are looking for.

Let me give you some hints how to define the mitigation. Please also see the following documents which might give you an overview of how mitigating controls should be defined.

With FB02/FB08/FBRA (as far as I know) you have SOD required between accounts payable voucher entry and vendor master data maintenance. Hence a possible mitigation might be defined as follow:

• Masterdata changes of vendors (payment terms) are reviewed (e.g. with spot checks) by payment proposal approver, while checking the payment propsoal
• Check the change document of vendor master data (within SAP: S_ALR_87012089 change documents) at least once a month
• Configure a workflow that requires a second person to approve changes of sensitive fileds in vendor master data

Please be aware that this is only an idea I have and your scenario depends on your business requirement how to define the compensating controls.

Let me know if you need furthers inputs.

Best regards,

Alessandro