Application · app-sap
SAP S/4HANA
Controls (10)
| Control | Name | Domain | Applications | Q3 test | Open findings |
|---|---|---|---|---|---|
| ACC-02 | User access provisioning is approved before grant | Access Control | Microsoft Entra ID, SAP S/4HANA, ServiceNow ITSM | Pass | 0 |
| ACC-03 | Privileged access is just-in-time and reviewed | Access Control | Amazon Web Services (ap-south-1), Microsoft Entra ID, SAP S/4HANA | Fail | 1 |
| ACC-04 | Quarterly user access review of in-scope applications | Access Control | Microsoft Entra ID, Salesforce (Sales + Financial Services Cloud), SAP S/4HANA | Not tested | 0 |
| JML-01 | Leavers are de-provisioned within 24 hours | Joiner/Mover/Leaver | Darwinbox HRMS, Microsoft Entra ID, SAP S/4HANA | Pass | 0 |
| JML-02 | Mover access is recertified on role change | Joiner/Mover/Leaver | Darwinbox HRMS, Microsoft Entra ID, SAP S/4HANA | Fail | 1 |
| SOD-01 | Segregation of incompatible duties in SAP | Segregation of Duties | SAP S/4HANA | Fail | 2 |
| P2P-01 | Purchase orders follow approval thresholds; no self-approval | Procure-to-Pay | SAP S/4HANA | Fail | 1 |
| P2P-02 | Vendor master changes require dual control | Procure-to-Pay | SAP S/4HANA | Pass | 0 |
| LOG-02 | Audit logs retained 180 days online and 5 years archived, tamper-protected | Logging & Monitoring | Amazon Web Services (ap-south-1), SAP S/4HANA | Not tested | 0 |
| PAY-02 | Payment release requires maker-checker | Payments Security | SAP S/4HANA | Pass | 0 |
Open findings (5)
| Finding | Observation | Control | Applications | Severity | Status | Owner | Action | Validation |
|---|---|---|---|---|---|---|---|---|
| F-ITGC-01 | Unmitigated SoD conflict: payments approval and GL posting held by transferred employee | SOD-01 | SAP S/4HANA | High | In Progress | Priya Sharma | REM-F-ITGC-01 · In Progress | Pending |
| F-ITGC-03 | Purchase order released by requester above delegation threshold | P2P-01 | SAP S/4HANA | High | Open | Priya Sharma | REM-F-ITGC-03 · In Progress | Pending |
| F-RBI-01 | Access of transferred staff not revoked — SoD breach in payment approval (MD-ITGRCA §7.1) | SOD-01 | SAP S/4HANA | High | In Progress | Priya Sharma | REM-F-RBI-01 · In Progress | Pending |
| F-ITGC-02 | Standing privileged access in production AWS | ACC-03 | Amazon Web Services (ap-south-1), Microsoft Entra ID, SAP S/4HANA | Medium | In Progress | Rahul Nair | REM-F-ITGC-02 · In Progress | Pending |
| F-SOC2-02 | Mover access not removed timely (deviation in CC6.2 testing) | JML-02 | Darwinbox HRMS, Microsoft Entra ID, SAP S/4HANA | Medium | Open | Neha Iyer | REM-F-SOC2-02 · Open | Pending |