SAP release strategies route purchase orders by value (< INR 5L department head; 5–50L Financial Controller; > 50L CFO) and the requester cannot release their own PO.

Requirements: ISO-A.5.3 A.5.3 · Segregation of duties
ITGC-BP-01 ITGC-BP-01 · Automated application controls — approval workflow and thresholds
ITGC-SOD-01 ITGC-SOD-01 · Segregation of incompatible duties in business applications
SOC2-CC5.2 CC5.2 · Selects and develops general controls over technology
Policy: pol-payments · Payments Security Policy
Applications: SAP S/4HANA
Third parties: —
Testing procedure: SAP release strategy configuration + continuous monitoring check of release history. Tests: SAP S/4HANA: No self-approved purchase orders; SAP S/4HANA: Release strategy matches threshold. Frequency continuous.

Findings (2)

Open list →

Finding	Observation	Control	Applications	Severity	Status	Owner	Action	Validation
F-ITGC-03	Purchase order released by requester above delegation threshold	P2P-01	SAP S/4HANA	High	Open	Priya Sharma	REM-F-ITGC-03 · In Progress	Pending
F-IAQ2-P2P-01	Purchase orders released above delegated threshold	P2P-01	SAP S/4HANA	High	Closed	Priya Sharma	REM-F-IAQ2-P2P-01 · Closed	Failed

Evidence (3)

Open list →

Evidence	Title	Control	Source system	Collected	Status
ITGC-REQ-017	SAP S/4HANA: No self-approved purchase orders	P2P-01	SAP S/4HANA	9 Oct 2026	Accepted
ITGC-REQ-018	SAP S/4HANA: Release strategy matches threshold	P2P-01	SAP S/4HANA	8 Oct 2026	Accepted
Q2-EV-014	SAP S/4HANA · ticket sample (Q2)	P2P-01	SAP S/4HANA	25 Jun 2026	Rejected

Tests (2)

Open list →

Test	Control	Cycle	Tested	By	Result	Confidence
TST-ITGC-P2P-01	P2P-01 · Purchase orders follow approval thresholds; no self-approval	Q3 2026 Unified Program Review	6 Oct 2026	Vikram Mehta, Farah Khan · Meridian Internal Audit	Fail	Medium
TST-Q2-P2P-01	P2P-01 · Purchase orders follow approval thresholds; no self-approval	Q2 2026 Unified Program Review	18 Jun 2026	Farah Khan, Vikram Mehta · Meridian Internal Audit	Fail	High