Test · TST-ITGC-P2P-02
P2P-02 · Vendor master changes require dual control
PassQ3 2026 Unified Program ReviewTested 7 Oct 2026 by Vikram Mehta, Farah Khan · Meridian Internal Audit
Requirement to validation
Requirement
ISO-A.5.3 · ITGC-BP-01 · SOC2-CC5.2
mapped
Policy
Payments Security Policy
pol-payments
Control
P2P-02
Vendor master changes require dual control
Application
SAP S/4HANA
mapped
Evidence · Q3
1 items
1 approved · 0 pending · 0 rejected
Test · Q3
Pass
TST-ITGC-P2P-02 · High confidence
Finding
None
Action
None
Validation
Not planned
Procedure and result
- Procedure
- SAP sensitive-field confirmation (FK08/FK09). Tests: SAP S/4HANA: Sensitive vendor fields confirmed by second user. Frequency continuous.
- Sample
- 2 items sampled (reperformance)
- Expected
- Creation of vendors and changes to vendor bank details in SAP are made by Procurement and independently verified by Finance before the vendor can be paid.
- Observed
- Operating effectiveness confirmed for SAP S/4HANA; no exceptions in 2 sample(s).
- Confidence
- High
- Evidence
- ITGC-REQ-019