Control · SOD-01
Segregation of incompatible duties in SAP
Segregation of DutiesSOC 2 · ISO 27001 · ITGC · RBIRisk High
Requirement to validation
Requirement
ISO-A.5.3 · ITGC-SOD-01 · RBI-ITGRCA-2023-7.1 · SOC2-CC5.2 · SOC2-CC6.3
mapped
Policy
Payments Security Policy
pol-payments
Control
SOD-01
Segregation of incompatible duties in SAP
Application
SAP S/4HANA
mapped
Evidence · Q3
2 items
2 approved · 0 pending · 0 rejected
Test · Q3
Fail
TST-ITGC-SOD-01 · Medium confidence
Finding
F-RBI-01 · High
In Progress
Action
Priya Sharma
REM-F-RBI-01 · In Progress
Validation
Pending
as recorded
What should be true
SAP role design prevents a single user from holding incompatible functions (create vendor / post invoice / release payment / post GL journal); conflicts are detected by a ruleset and either removed or mitigated.
- Requirements
- ISO-A.5.3 A.5.3 · Segregation of dutiesITGC-SOD-01 ITGC-SOD-01 · Segregation of incompatible duties in business applicationsRBI-ITGRCA-2023-7.1 RBI-ITGRCA-2023 §7.1 · Access control — least privilege, privileged access management, periodic review (RBI Master Direction on IT Governance, Risk, Controls and Assurance Practices, 2023)SOC2-CC5.2 CC5.2 · Selects and develops general controls over technologySOC2-CC6.3 CC6.3 · Role-based access, least privilege and segregation of duties; access modification and removal
- Applications
- SAP S/4HANA
- Third parties
- —
- Testing procedure
- SAP GRC Access Risk Analysis ruleset run monthly; mitigating controls documented. Tests: SAP S/4HANA: SoD ruleset — no unmitigated conflicts. Frequency monthly.
Findings (3)
| Finding | Observation | Control | Applications | Severity | Status | Owner | Action | Validation |
|---|---|---|---|---|---|---|---|---|
| F-ITGC-01 | Unmitigated SoD conflict: payments approval and GL posting held by transferred employee | SOD-01 | SAP S/4HANA | High | In Progress | Priya Sharma | REM-F-ITGC-01 · In Progress | Pending |
| F-RBI-01 | Access of transferred staff not revoked — SoD breach in payment approval (MD-ITGRCA §7.1) | SOD-01 | SAP S/4HANA | High | In Progress | Priya Sharma | REM-F-RBI-01 · In Progress | Pending |
| F-IAQ2-SOD-01 | Unmitigated SAP SoD conflicts | SOD-01 | SAP S/4HANA | High | Closed | Priya Sharma | REM-F-IAQ2-SOD-01 · Closed | Validated |
Evidence (3)
| Evidence | Title | Control | Source system | Collected | Status |
|---|---|---|---|---|---|
| ITGC-REQ-016 | SAP S/4HANA: SoD ruleset — no unmitigated conflicts | SOD-01 | SAP S/4HANA | 4 Oct 2026 | Accepted |
| Q2-EV-013 | SAP S/4HANA · configuration report (Q2) | SOD-01 | SAP S/4HANA | 20 Jun 2026 | Rejected |
| RBI-REQ-012 | SAP S/4HANA: SoD ruleset — no unmitigated conflicts | SOD-01 | SAP S/4HANA | 4 Oct 2026 | Accepted |
Tests (3)
| Test | Control | Cycle | Tested | By | Result | Confidence |
|---|---|---|---|---|---|---|
| TST-ITGC-SOD-01 | SOD-01 · Segregation of incompatible duties in SAP | Q3 2026 Unified Program Review | 5 Oct 2026 | Vikram Mehta, Farah Khan · Meridian Internal Audit | Fail | Medium |
| TST-RBI-SOD-01 | SOD-01 · Segregation of incompatible duties in SAP | Q3 2026 Unified Program Review | 5 Oct 2026 | Vikram Mehta, Farah Khan · Meridian Internal Audit (IS Audit cell) | Fail | Medium |
| TST-Q2-SOD-01 | SOD-01 · Segregation of incompatible duties in SAP | Q2 2026 Unified Program Review | 18 Jun 2026 | Farah Khan, Vikram Mehta · Meridian Internal Audit | Fail | Medium |