Control · P2P-02

Vendor master changes require dual control

Procure-to-PaySOC 2 · ISO 27001 · ITGCRisk High

Requirement to validation

Requirement
ISO-A.5.3 · ITGC-BP-01 · SOC2-CC5.2
mapped
Policy
Payments Security Policy
pol-payments
Control
P2P-02
Vendor master changes require dual control
Application
SAP S/4HANA
mapped
Evidence · Q3
1 items
1 approved · 0 pending · 0 rejected
Test · Q3
Pass
TST-ITGC-P2P-02 · High confidence
Finding
None
Action
None
Validation
Not planned

What should be true

Creation of vendors and changes to vendor bank details in SAP are made by Procurement and independently verified by Finance before the vendor can be paid.

Requirements
ISO-A.5.3 A.5.3 · Segregation of duties
ITGC-BP-01 ITGC-BP-01 · Automated application controls — approval workflow and thresholds
SOC2-CC5.2 CC5.2 · Selects and develops general controls over technology
Policy
pol-payments · Payments Security Policy
Applications
SAP S/4HANA
Third parties
—
Testing procedure
SAP sensitive-field confirmation (FK08/FK09). Tests: SAP S/4HANA: Sensitive vendor fields confirmed by second user. Frequency continuous.

Findings (0)

Open list →
○ No data available

Evidence (2)

Open list →
EvidenceTitleControlSource systemCollectedStatus
ITGC-REQ-019SAP S/4HANA: Sensitive vendor fields confirmed by second userP2P-02SAP S/4HANA8 Oct 2026Accepted
Q2-EV-015SAP S/4HANA · access review (Q2)P2P-02SAP S/4HANA6 Jun 2026Accepted

Tests (2)

Open list →
TestControlCycleTestedByResultConfidence
TST-ITGC-P2P-02P2P-02 · Vendor master changes require dual controlQ3 2026 Unified Program Review7 Oct 2026Vikram Mehta, Farah Khan · Meridian Internal AuditPassHigh
TST-Q2-P2P-02P2P-02 · Vendor master changes require dual controlQ2 2026 Unified Program Review12 Jun 2026Farah Khan, Vikram Mehta · Meridian Internal AuditPassHigh