This tool checks for conflicting transactions present within a SAP User or Role.

Function of the Tool:

SAP Governance Risk analysis tool is developed by SAP. The Main function of the tool is to analyze the user or the SAP Role to find the conflicting access or transactions within the role or user. This is accomplished by comparing the access with standard rule set which created by SAP

Process:

This is achieved by grouping the transactions into Business functions. The transactions which perform the same kind of function are grouped into the business function. For example functions Process vendor invoice and vendor master maintenance have two sets for transactions.

Process Vendor Invoice Transaction F-43 Enter incoming invoices Transaction MR01- Process incoming invoices Vendor Master Maintenance XK01- Create Vendor Master Centrally FK01- Create Vendor Accounting Risk (Create fictitious vendor and initiate payment to the vendor) is generated when one of the transactions from these functions combine with other function.

Implementation of the Tool:

So when company is creating a role or setting up a user they can check if these combinations are present within the role or user. SAP provides a standard set of Business functions grouping based on best industry practice. But companies can also add their own or disable the risks which are not relevant. The product has management report s analysis of risk which can be interactive or scheduled.

Cost Savings:

Audit of the financial systems could cost the company lot of money and resources. An audit will be involved pulling your company resources to work with the external audit group to see if your system is compliant with external audit and SOX. This means that financial statement does not have material misstatement. For this the auditor should be able to certify with confidence that system is compliant. The tool will identify the access or users who have risks of subverting the business process. Since the tool is developed with the co operation of auditing companies it is easy to comply with auditing process

Selva Kumar
http://www.SAPSECURITYTRAINER.COM