Why the conflict list gets so long
SoD conflicts come from combinations, so they grow quickly. One broad role can create thousands of lines. Most tools also report per user and per rule, so a single badly built role shows up again and again.
The other reason is the ruleset. A check that only looks at transaction codes will flag people who can open a screen but can't actually save anything. A useful ruleset also looks at the authorization objects behind the task, and at your own organisation.
Classic conflicts in SAP
| Task one | Task two | What could go wrong |
|---|---|---|
| Create a vendor | Run the payment | Payment to a vendor that doesn't exist |
| Change bank details | Run the payment | A real payment sent to another account |
| Create a vendor | Post a vendor invoice | A fictitious supplier and a fictitious invoice |
| Post a vendor invoice | Run the payment | No second pair of eyes on the money |
| Create a purchase order | Confirm goods receipt | Goods confirmed that never arrived |
| Create a purchase order | Post a vendor invoice | Order and invoice under one person's control |
| Confirm goods receipt | Post a vendor invoice | Receipt and invoice made to agree |
| Create users | Assign roles | A new account with any access |
Want more detail? Read the SoD conflict examples.
Three ways out, in this order
Remove
Often the access was never used. This is the cheapest fix, and it lasts.
Split
Two people, two roles. Fix the role when the role is the problem.
Compensate
In a small team a split isn't always possible. Review it, and document that.
A conflict shows what someone could do, not that they did it. Finding out whether a conflict was actually used is a separate step.
Questions about segregation of duties
What is segregation of duties in SAP?
Segregation of duties (SoD) means that no single person can complete a sensitive process alone. In SAP, it is usually checked with a ruleset that compares the transactions and authorizations each user holds.
What is an SoD conflict?
An SoD conflict is a combination of access that lets one person do two things that should be kept apart, such as creating a vendor and paying it. A conflict shows what someone could do, not that they did it.
Do we need SAP GRC to manage segregation of duties?
No. SAP Access Control is one way to do it, not the only way. A smaller company can start with a clear ruleset and SAP's standard reports, though that takes more manual work.
What is a compensating control?
A compensating control is a check that reduces the risk when a conflict can't be removed, such as a monthly review of payments by someone independent. It has to be carried out and documented to count.
