SOD (Segregation of Duties)

[Former Member]

Hi,

I would like to know whether the following would be excess access rights or segregation of duties issue.

1- Every one having same or access all modules with change rights in the the development system (not sandbox)

2- Same person can create a change request and also approve the same change request in the change management process.

If they are either excess access rights or SOD, Are there any best practices from SAP or any other professional bodies available to suggest the same.

Regards,

Krishna

[Former Member · Accepted solution]

According to a general practice one individual should not have access to two or more than two incompatible duties also one individual should not be given rights to execute end to end processes. I think in your mentioned cases, both seems to be SOD conflicts. To understand any scenario you need to create SOD Role matrix for all your business Processes.

Following are some popular examples of incompatible duties:

1. Creating vendor and initiate payment to him.

2. Creating invoices and modifying them.

3. Processing inventory, and posting payment.

4. Receiving Checks and writing pay-offs

Please search for SOD Role matrix on SDN

Also you can download SAP GRC best practices for Access Controls 5.2 from SAP Service Market Place for free.

Best Regards,

Amol Bharti

[former_member184114]

What others have said is absolutely right. But these scenarios do matter on production system. I am not sure about DEV. However, this is purely business call. its better to discuss these issues with your business heads and do the needful.

Regards,

Faisal

[Former Member]

HEllo Krishna,

The scenerio you described would be both excess access rights and SOD as well. Reasons:

1. Excess Access Rights - As the user is having rights other than what he/she should be performing. Those functions which the user have rights in this case may not be conflicting but still undesirable, making it an excess authorization for him/her.

2. SOD - Because of the complete ownership of some processes, which are conflicting amongst each other.

Regards,

Hersh.