Test · TST-Q2-P2P-01
P2P-01 · Purchase orders follow approval thresholds; no self-approval
FailQ2 2026 Unified Program ReviewTested 18 Jun 2026 by Farah Khan, Vikram Mehta · Meridian Internal Audit
Requirement to validation
Requirement
ISO-A.5.3 · ITGC-BP-01 · ITGC-SOD-01 · SOC2-CC5.2
mapped
Policy
Payments Security Policy
pol-payments
Control
P2P-01
Purchase orders follow approval thresholds; no self-approval
Application
SAP S/4HANA
mapped
Evidence · Q3
2 items
2 approved · 0 pending · 0 rejected
Test · Q3
Fail
TST-ITGC-P2P-01 · Medium confidence
Finding
F-ITGC-03 · High
Open
Action
Priya Sharma
REM-F-ITGC-03 · In Progress
Validation
Pending
as recorded
Procedure and result
- Procedure
- SAP release strategy configuration + continuous monitoring check of release history. Tests: SAP S/4HANA: No self-approved purchase orders; SAP S/4HANA: Release strategy matches threshold. Frequency continuous.
- Sample
- 25 items sampled (Q2 baseline)
- Expected
- SAP release strategies route purchase orders by value (< INR 5L department head; 5–50L Financial Controller; > 50L CFO) and the requester cannot release their own PO.
- Observed
- 2 of 40 sampled purchase orders above INR 5 lakh were released by department heads instead of the Financial Controller.
- Confidence
- High
- Evidence
- Q2-EV-014