Test · TST-Q2-P2P-02
P2P-02 · Vendor master changes require dual control
PassQ2 2026 Unified Program ReviewTested 12 Jun 2026 by Farah Khan, Vikram Mehta · Meridian Internal Audit
Requirement to validation
Requirement
ISO-A.5.3 · ITGC-BP-01 · SOC2-CC5.2
mapped
Policy
Payments Security Policy
pol-payments
Control
P2P-02
Vendor master changes require dual control
Application
SAP S/4HANA
mapped
Evidence · Q3
1 items
1 approved · 0 pending · 0 rejected
Test · Q3
Pass
TST-ITGC-P2P-02 · High confidence
Finding
None
Action
None
Validation
Not planned
Procedure and result
- Procedure
- SAP sensitive-field confirmation (FK08/FK09). Tests: SAP S/4HANA: Sensitive vendor fields confirmed by second user. Frequency continuous.
- Sample
- 25 items sampled (Q2 baseline)
- Expected
- Creation of vendors and changes to vendor bank details in SAP are made by Procurement and independently verified by Finance before the vendor can be paid.
- Observed
- No exceptions in the sample; dual control on vendor master operated as designed.
- Confidence
- High
- Evidence
- Q2-EV-015