User testing/signoff procedures

[Jelena_Perfiljeva]

Most likely every SAP client has some kind of a procedure in place for the user testing and signoff before the transports may be moved to production. From your experience, what procedures have you seen (not just in the SAP world) and which ones, in your opinion, work the best?

Here are two examples from my past jobs as a programmer:

1) Developer prepares testing scenarios (in Excel); Business Analyst runs them through and marks each line with the result. This spreadsheet is then embedded in another document that lists all the items to be implemented in that week (scheduled weekly implementation).

2) A signoff form (Word template) is prepared by developer/functional analyst and emailed to the business user responsible for testing. The form includes basic information (usualy there is a corresponding ticket) and developer's name/date as form of a signature. The user then signs/dates the form and returns it to the developer. The form is forwarded to Basis admin as an approval to move the transports.

In perfect world, the signoff should not be an additional burden for a developer yet need to ensure that testing has been performed properly. In reality, this may be difficult to achieve. As a developer, I liked the 2nd option better, but it sometimes lead to users signing off without any testing (and then guess who gets blamed when something doesn't work).

What are your thoughts?

[Former Member]

Hi

One of my favorite moans... testing

A requirement for an addtional custom transaction requiring a custom program is raised and approved, the new coding is created and moved to QAS. The functional person logs onto QAS and runs the additional access and it works as expected.

The sign-off in whatever form is given and the program is transported to Prod where the end user says they don't have authorisation to run it. Julius' comments about users with SAP_ALL and developer creating the roles is a good point - all the individual components of the testing need to be accounted for (including SoD and authority checks/call transactions) and security can be the last people to know something new is needed.

Sign-off is fine as long as we know what is being signed off - testing at role level using proper test users with just the one role and SU53 are needed and this isn't always adhered to. The documentary evidence is excellent to have as long as it isn't left to the developer and security to raise and complete and the test users are actually used...

moan over with...

David

[Former Member]

What can at times be a lot of fun (if you are that way inclined) is negative-testing and pen-testing...

Cheers,

Julius