Audit Question - Access to SU01

[Chris-Hall]

I have a question in regards to access to SU01. We currently have a team to setup users and assign roles. We are SOx regulated and have been questioned about having individual having this access.

Does it make sense to have one user setting up the ID without any authorizations assigned and then another person add the roles? We have compliance calibrator installed and no issues from that, but I am aware sometimes it is a business process decision from our auditors.

To me this does not make sense to me at all. Not sure if this would be the same for all our other applications either at this point including BW, IPC, XI, network access etc. etc. etc.

[Former Member · Accepted solution]

Hi Chris,

Normally security (if not basis) team will take care of authorization part i.e. creating users and assigning roles to users.

They only(Security) should have access to SU01.There is no point to split authorization activity in to two categories like one person will create user id with out roles and another person will assign roles to that user.

We can have common security team for ECC, BW, and XI....etc.

Thanks & Regards,

KKRao.