Question Re: One role - One transaction - SoD errors in Additional Q&A

One role - One transaction - SoD errors

Rich_Turnquist1 — Wed, 19 May 2010 20:47:33 GMT

I have a single role with just one transaction in it (F-44). When I run this singel role through Risk Analysis, I get the following SoD risks.

Risk Description: P0030LI01 : Create fictitious vendor invoice and initiate payment for it

Conflicting Action: Clear Vendor (F-44) and Clear Vendor (F-44)

This doesn't make any sense. It only has an "01" under object F_BKPF_BUK.

I can see a transaction conflicting with another transaction, but against itself? How can I remediate this role? Our goal is to remediate, not mitigate whenever possible.

Thanks,

Peggy

Re: One role - One transaction - SoD errors

Former Member — Wed, 19 May 2010 20:56:54 GMT

Peggy,

Look at auth object/permission level details regarding this violation. Some of the SAP global rules contain violations arising due to same tcodes. In this case, F-44 is in AP01 and AP02 and these functions conflict with each other. Either you should customize auth objects for this tcode in AP01/AP02 to catch the right violation or remove this tcode from one of the function to remediate this risk.

Alpesh

Re: One role - One transaction - SoD errors

Rich_Turnquist1 — Wed, 19 May 2010 21:30:57 GMT

I can't agree with your suggestion because I would want F-44 in both AP01 and AP02 to catch any of the other violations that would exist. For example, if we had F-44 with F.13, it would be an SoD violation and AP01 would catch it. And if we had F-44 with FB01 it too would be a violation which AP02 would catch. So I can't see disabling it from either AP01 or AP02 and I need the objects to be as they are.

We have a number of these SoD errors with other transactions such as FB02 with FB02 and FBV0 with FBV0 for risk F028 (Both are in AP02 and GL01).

I'm thinking we need to create one mitigation for these types of SoD violations (which really aren't violations). This should make the auditors happy and we aren't disabling or changing anything that would allow an SoD to get missed.

Do you agree with my thinking? Does anyone know what the best practice is for these?

Thanks,

Peggy

Re: One role - One transaction - SoD errors

Former Member — Wed, 19 May 2010 22:10:22 GMT

Peggy,

I am not asking you to fully remove the F-44 from one of the function. The idea is to customize the AP01 and AP02 in such a way that F-44 does not violate with itself but does violate with other tcodes. You can achieve this scenario by different methods and one of the method would be:

Remove F-44 from AP02. Copy AP01 to ZAP1 without F-44 and create ZAP2 (copy of AP02) with only F-44 in it. Now, create a risk with combination of ZAP1 and ZAP2 and another risk with combination of AP01 and AP02.

I would not recommend to mitigate false positives. If it is not a violation then remove the violation, instead of mitigating it.

Let me know in case of any questions.

Alpesh

Re: One role - One transaction - SoD errors

Rich_Turnquist1 — Thu, 20 May 2010 14:01:44 GMT

Thank you! I get it now. I wasn't thinking of moving the transaction to a Z* function. It makes sense. I'll try this.

Peggy

Re: One role - One transaction - SoD errors

Former Member — Thu, 20 May 2010 16:23:21 GMT

Yes, Peggy. You always have to customize the SAP delivered functions and risks depending on the nature of business, processes and compliance requiremetns.

Alpesh