Finding · F-RBI-01
Access of transferred staff not revoked — SoD breach in payment approval (MD-ITGRCA §7.1)
In ProgressSOD-01 · Segregation of incompatible duties in SAPSegregation of DutiesQ3 2026 Unified Program Review
Fraud indicator
Rating
No
High
Medium
Low
Requirement to validation
Requirement
ISO-A.5.3 · ITGC-SOD-01 · RBI-ITGRCA-2023-7.1 · SOC2-CC5.2 · SOC2-CC6.3
mapped
Policy
Payments Security Policy
pol-payments
Control
SOD-01
Segregation of incompatible duties in SAP
Application
SAP S/4HANA
mapped
Evidence · Q3
2 items
2 approved · 0 pending · 0 rejected
Test · Q3
Fail
TST-ITGC-SOD-01 · Medium confidence
Finding
F-RBI-01 · High
In Progress
Action
Priya Sharma
REM-F-RBI-01 · In Progress
Validation
Pending
as recorded
Observation
Raised 2026-10-06 in the RBI Regulatory Controls — Q4 2026 Periodic Internal Audit (Meridian Internal Audit (IS Audit cell)). Rohan Gupta moved Finance -> Operations effective 2026-09-15. 8 business days later SAP still assigns Z_FI_PAY_APPROVER (payments approval) and Z_FI_GL_POST (general ledger posting); Concur expense admin and vendor portal access also retained. Payments approval + GL posting is an unmitigated SoD conflict. Related controls: JML-02.
Applications: SAP S/4HANA.
Potential risk
Unauthorised or erroneous transactions could go undetected and expose Meridian to financial loss and regulatory action.
Root cause
Same root cause as F-ITGC-01: prior-role entitlements not removed on transfer.
Agreed action plan
Same root cause as F-ITGC-01; tracked as one remediation (T-001).
Management response: Same root cause as F-ITGC-01; tracked as one remediation (T-001).
- Action
- REM-F-RBI-01
- Owner (FPR)
- Priya Sharma
- Target date
- 5 Nov 2026
- Priority
- High
- Status
- In Progress
- Validation
- Pending · planned 5 Nov 2026
Evidence for this control (3)
| Evidence | Title | Control | Source system | Collected | Status |
|---|---|---|---|---|---|
| ITGC-REQ-016 | SAP S/4HANA: SoD ruleset — no unmitigated conflicts | SOD-01 | SAP S/4HANA | 4 Oct 2026 | Accepted |
| Q2-EV-013 | SAP S/4HANA · configuration report (Q2) | SOD-01 | SAP S/4HANA | 20 Jun 2026 | Rejected |
| RBI-REQ-012 | SAP S/4HANA: SoD ruleset — no unmitigated conflicts | SOD-01 | SAP S/4HANA | 4 Oct 2026 | Accepted |
Tests of this control (3)
| Test | Control | Cycle | Tested | By | Result | Confidence |
|---|---|---|---|---|---|---|
| TST-ITGC-SOD-01 | SOD-01 · Segregation of incompatible duties in SAP | Q3 2026 Unified Program Review | 5 Oct 2026 | Vikram Mehta, Farah Khan · Meridian Internal Audit | Fail | Medium |
| TST-RBI-SOD-01 | SOD-01 · Segregation of incompatible duties in SAP | Q3 2026 Unified Program Review | 5 Oct 2026 | Vikram Mehta, Farah Khan · Meridian Internal Audit (IS Audit cell) | Fail | Medium |
| TST-Q2-SOD-01 | SOD-01 · Segregation of incompatible duties in SAP | Q2 2026 Unified Program Review | 18 Jun 2026 | Farah Khan, Vikram Mehta · Meridian Internal Audit | Fail | Medium |