One role - One transaction - SoD errors

[Rich_Turnquist1]

I have a single role with just one transaction in it (F-44). When I run this singel role through Risk Analysis, I get the following SoD risks.

Risk Description: P0030LI01 : Create fictitious vendor invoice and initiate payment for it

Conflicting Action: Clear Vendor (F-44) and Clear Vendor (F-44)

This doesn't make any sense. It only has an "01" under object F_BKPF_BUK.

I can see a transaction conflicting with another transaction, but against itself? How can I remediate this role? Our goal is to remediate, not mitigate whenever possible.

Thanks,

Peggy

[Rich_Turnquist1 · Accepted solution]

I can't agree with your suggestion because I would want F-44 in both AP01 and AP02 to catch any of the other violations that would exist. For example, if we had F-44 with F.13, it would be an SoD violation and AP01 would catch it. And if we had F-44 with FB01 it too would be a violation which AP02 would catch. So I can't see disabling it from either AP01 or AP02 and I need the objects to be as they are.

We have a number of these SoD errors with other transactions such as FB02 with FB02 and FBV0 with FBV0 for risk F028 (Both are in AP02 and GL01).

I'm thinking we need to create one mitigation for these types of SoD violations (which really aren't violations). This should make the auditors happy and we aren't disabling or changing anything that would allow an SoD to get missed.

Do you agree with my thinking? Does anyone know what the best practice is for these?

Thanks,

Peggy

[Former Member · Accepted solution]

Peggy,

I am not asking you to fully remove the F-44 from one of the function. The idea is to customize the AP01 and AP02 in such a way that F-44 does not violate with itself but does violate with other tcodes. You can achieve this scenario by different methods and one of the method would be:

Remove F-44 from AP02. Copy AP01 to ZAP1 without F-44 and create ZAP2 (copy of AP02) with only F-44 in it. Now, create a risk with combination of ZAP1 and ZAP2 and another risk with combination of AP01 and AP02.

I would not recommend to mitigate false positives. If it is not a violation then remove the violation, instead of mitigating it.

Let me know in case of any questions.

Alpesh