Finding · F-ITGC-03
Purchase order released by requester above delegation threshold
OpenP2P-01 · Purchase orders follow approval thresholds; no self-approvalProcure-to-PayQ3 2026 Unified Program Review
Fraud indicator
Rating
No
High
Medium
Low
Requirement to validation
Requirement
ISO-A.5.3 · ITGC-BP-01 · ITGC-SOD-01 · SOC2-CC5.2
mapped
Policy
Payments Security Policy
pol-payments
Control
P2P-01
Purchase orders follow approval thresholds; no self-approval
Application
SAP S/4HANA
mapped
Evidence · Q3
2 items
2 approved · 0 pending · 0 rejected
Test · Q3
Fail
TST-ITGC-P2P-01 · Medium confidence
Finding
F-ITGC-03 · High
Open
Action
Priya Sharma
REM-F-ITGC-03 · In Progress
Validation
Pending
as recorded
Observation
Raised 2026-10-06 in the ITGC Q3 FY2026-27 Controls Testing (Meridian Internal Audit). PO 4500018734 (INR 12.4 lakh, vendor 'Apex Office Interiors') was created and released by the same user (procurement executive with temporary FC-level release authority granted for quarter-end). Value is above the INR 5 lakh department-head band and should have required the Financial Controller.
Applications: SAP S/4HANA.
Potential risk
Unauthorised or erroneous transactions could go undetected and expose Meridian to financial loss and regulatory action.
Root cause
Temporary quarter-end release authority was granted without the release-strategy check on requester = approver.
Agreed action plan
Temporary release authority revoked; release strategy updated to block ERNAM = approver; PO retrospectively approved by Financial Controller. Tracked as T-003, T-004 in Prismet Tasks.
Management response: Temporary release authority revoked; release strategy updated to block ERNAM = approver; PO retrospectively approved by Financial Controller.
- Action
- REM-F-ITGC-03
- Owner (FPR)
- Priya Sharma
- Target date
- 20 Oct 2026
- Priority
- High
- Status
- In Progress
- Validation
- Pending · planned 20 Oct 2026
Evidence for this control (3)
| Evidence | Title | Control | Source system | Collected | Status |
|---|---|---|---|---|---|
| ITGC-REQ-017 | SAP S/4HANA: No self-approved purchase orders | P2P-01 | SAP S/4HANA | 9 Oct 2026 | Accepted |
| ITGC-REQ-018 | SAP S/4HANA: Release strategy matches threshold | P2P-01 | SAP S/4HANA | 8 Oct 2026 | Accepted |
| Q2-EV-014 | SAP S/4HANA · ticket sample (Q2) | P2P-01 | SAP S/4HANA | 25 Jun 2026 | Rejected |
Tests of this control (2)
| Test | Control | Cycle | Tested | By | Result | Confidence |
|---|---|---|---|---|---|---|
| TST-ITGC-P2P-01 | P2P-01 · Purchase orders follow approval thresholds; no self-approval | Q3 2026 Unified Program Review | 6 Oct 2026 | Vikram Mehta, Farah Khan · Meridian Internal Audit | Fail | Medium |
| TST-Q2-P2P-01 | P2P-01 · Purchase orders follow approval thresholds; no self-approval | Q2 2026 Unified Program Review | 18 Jun 2026 | Farah Khan, Vikram Mehta · Meridian Internal Audit | Fail | High |