Finding · F-IAQ2-SOD-01
Unmitigated SAP SoD conflicts
ClosedSOD-01 · Segregation of incompatible duties in SAPSegregation of DutiesQ2 2026 Unified Program Review
Fraud indicator
Rating
No
High
Medium
Low
Requirement to validation
Requirement
ISO-A.5.3 · ITGC-SOD-01 · RBI-ITGRCA-2023-7.1 · SOC2-CC5.2 · SOC2-CC6.3
mapped
Policy
Payments Security Policy
pol-payments
Control
SOD-01
Segregation of incompatible duties in SAP
Application
SAP S/4HANA
mapped
Evidence · Q3
2 items
2 approved · 0 pending · 0 rejected
Test · Q3
Fail
TST-ITGC-SOD-01 · Medium confidence
Finding
F-IAQ2-SOD-01 · High
Closed
Action
Priya Sharma
REM-F-IAQ2-SOD-01 · Closed
Validation
Validated
as recorded
Observation
Raised 2026-06-20 in the Q2 2026 internal audit baseline. The quarterly SoD ruleset run flagged 4 users holding vendor-master change and payment release; no mitigating control was documented.
Applications: SAP S/4HANA.
Potential risk
Unauthorised or erroneous transactions could go undetected and expose Meridian to financial loss and regulatory action.
Root cause
SoD ruleset results were not reviewed after the SAP role redesign in February.
Agreed action plan
Remediate: unmitigated sap sod conflicts.
Management response: Management agreed and committed to remediate before the Q3 review.
- Action
- REM-F-IAQ2-SOD-01
- Owner (FPR)
- Priya Sharma
- Target date
- 31 Jul 2026
- Priority
- High
- Status
- Closed
- Validation
- Validated · planned 26 Sep 2026
Evidence for this control (3)
| Evidence | Title | Control | Source system | Collected | Status |
|---|---|---|---|---|---|
| ITGC-REQ-016 | SAP S/4HANA: SoD ruleset — no unmitigated conflicts | SOD-01 | SAP S/4HANA | 4 Oct 2026 | Accepted |
| Q2-EV-013 | SAP S/4HANA · configuration report (Q2) | SOD-01 | SAP S/4HANA | 20 Jun 2026 | Rejected |
| RBI-REQ-012 | SAP S/4HANA: SoD ruleset — no unmitigated conflicts | SOD-01 | SAP S/4HANA | 4 Oct 2026 | Accepted |
Tests of this control (3)
| Test | Control | Cycle | Tested | By | Result | Confidence |
|---|---|---|---|---|---|---|
| TST-ITGC-SOD-01 | SOD-01 · Segregation of incompatible duties in SAP | Q3 2026 Unified Program Review | 5 Oct 2026 | Vikram Mehta, Farah Khan · Meridian Internal Audit | Fail | Medium |
| TST-RBI-SOD-01 | SOD-01 · Segregation of incompatible duties in SAP | Q3 2026 Unified Program Review | 5 Oct 2026 | Vikram Mehta, Farah Khan · Meridian Internal Audit (IS Audit cell) | Fail | Medium |
| TST-Q2-SOD-01 | SOD-01 · Segregation of incompatible duties in SAP | Q2 2026 Unified Program Review | 18 Jun 2026 | Farah Khan, Vikram Mehta · Meridian Internal Audit | Fail | Medium |