Surprisingly, it was discovered that more than half of the companies surveyed haven’t customised their rule sets and are still using the vendor’s out-the-box standard rule set. This comes as a surprise considering SAP access risk rule set customisation is a common recommendation by many of the Big 4 audit firms.

SAP access risk rule sets typically contain risks for the following categories:

• Segregation of Duties (SOD)
• Critical Transactions
• Data Privacy

There are a number of benefits to customising these rule sets – and yes, some of these are obvious. But for many organisations, the advantages of customising your SAP access risk rule set aren’t immediately apparent.

Here are some reasons to customise your SAP access risk rule sets that you might already know about (and some you might not have considered).

Benefit 1: Reduce the cost and effort of managing irrelevant risks

The out-the-box rule set has been defined for all industries and chances are these are not all going to be applicable to your organisation’s needs. Every access risk in the rule set requires some level of effort (which has a cost implication) to manage.

By removing risks that are not applicable to your organisation, you will reduce the effort and costs involved in managing those risks.

Benefit 2: Get better coverage of all your processes

The out-the-box rule sets generally cover the main business processes such as Procure to Pay, Order to Cash, Finance, Materials Management, and Hire to Retire. But some of the not-so-common business processes such as IS Health, Media, Insurance, and Global Trade Services are not included in many of the out-the-box rule sets. By adding these risks to the rule set, your organisation has better coverage of all your processes.

The more common scenario with regard to updating the rule set is adding custom functionality. As out-the-box rule sets do not contain any custom (Z tcodes) transactions, it is important to add these to the rule set. For example, if the organisation has created a custom version of VA01 (e.g. ZVA01) if this performs a similar function to VA01 and allows the users to create Sales Orders, it should be added to the rule set.

Benefit 3: Get more business buy-in for GRC activities

As detailed above, when using an out-the-box rule set, many of the risks are not relevant to your organisation. What often happens is business users lose confidence in GRC activities because they don’t agree with the risk that they are being asked to monitor.

For those organisations who struggle to get the necessary business buy-in and participation from their business users in GRC activities, a rule set customisation exercise has significant benefits to addressing this challenge in several ways:

At Soterion, a study was recently conducted to find out how many organisations have customised their SAP access risk rule set.

Surprisingly, it was discovered that more than half of the companies surveyed haven’t customised their rule sets and are still using the vendor’s out-the-box standard rule set. This comes as a surprise considering SAP access risk rule set customisation is a common recommendation by many of the Big 4 audit firms.

SAP access risk rule sets typically contain risks for the following categories:

• Segregation of Duties (SOD)
• Critical Transactions
• Data Privacy

There are a number of benefits to customising these rule sets – and yes, some of these are obvious. But for many organisations, the advantages of customising your SAP access risk rule set aren’t immediately apparent.

There are a number of benefits to customising these rule sets – and yes, some of these are obvious. But for many organisations, the advantages of customising your SAP access risk rule set aren’t immediately apparent.

Benefit 1: Reduce the cost and effort of managing irrelevant risks

The out-the-box rule set has been defined for all industries and chances are these are not all going to be applicable to your organisation’s needs. Every access risk in the rule set requires some level of effort (which has a cost implication) to manage.

By removing risks that are not applicable to your organisation, you will reduce the effort and costs involved in managing those risks.

Benefit 2: Get better coverage of all your processes

The out-the-box rule sets generally cover the main business processes such as Procure to Pay, Order to Cash, Finance, Materials Management, and Hire to Retire. But some of the not-so-common business processes such as IS Health, Media, Insurance, and Global Trade Services are not included in many of the out-the-box rule sets. By adding these risks to the rule set, your organisation has better coverage of all your processes.

The more common scenario with regard to updating the rule set is adding custom functionality. As out-the-box rule sets do not contain any custom (Z tcodes) transactions, it is important to add these to the rule set. For example, if the organisation has created a custom version of VA01 (e.g. ZVA01) if this performs a similar function to VA01 and allows the users to create Sales Orders, it should be added to the rule set.

Benefit 3: Get more business buy-in for GRC activities

As detailed above, when using an out-the-box rule set, many of the risks are not relevant to your organisation. What often happens is business users lose confidence in GRC activities because they don’t agree with the risk that they are being asked to monitor.

For those organisations who struggle to get the necessary business buy-in and participation from their business users in GRC activities, a rule set customisation exercise has significant benefits to addressing this challenge in several ways:

• Monitoring relevant and applicable risks:
  Monitoring risks that the business believe in will enhance their participation and buy-in. This will raise the organisation’s risk awareness.
• Building understanding of business impact:
  A big challenge for many organisations is that business users do not understand the SOD access risks, resulting in actions being taken without fully understanding the consequences or impact it will have on the business. Rule set projects are usually workshop based where business users and functional consultants discuss and analyse each risk. This is a useful educational exercise where each SOD risk is explained in detail and how fraud can potentially be committed with the conflicting combination of access. Once business users understand the SOD risk, they will have a better understanding of the impact of these risks on the organisation, and thus be able to make a more informed decisions as to whether users should have that particular access or not.
• Defining a Standard Operating Procedure (SOP):
  As it is unlikely that the organisation can operate without any risk violations, there will be a number of end users who will have access risks. When a user requests additional access that is in conflict with access they already have, it’s unclear whether the access requested can be approved. As a result, these types of requests often sit in the reviewer’s inbox for several days

  It’s important to define a policy for risk levels i.e. what is the rule for a simulation for each risk level? Part of the rule set customisation is to define these rules (SOP).

  An example here is:

• • If risk = Critical – access cannot be assigned
  • If risk = High – access can be assigned but with Mitigating Control
  • If Risk = Medium – access can be assigned without Mitigating Control

By defining these types of guidelines, your business users are able to make quicker decisions on whether the additional access requested can be approved. This reduces the time that SAP access change requests sit in a manager’s inbox waiting to be approved, which ultimately reduces the business downtime (end-user waiting for requested access) saving your organisation valuable time and costs.

Whether you need assistance with customising your out-the-box SAP access risk rule set or advice on where to start, Soterion’s team of SAP experts can assist with your unique requirements and help you implement more effective GRC.

How can Soterion Help You?

Soterion is the market leader in business-centric GRC. By converting the technical GRC language into a language the business users can understand, we facilitate business buy-in and accountability.

Feel free to email us on info@soterion.com. Let us help you take your GRC to the next level.

This article is sponsored by Soterion

The post The Hidden Benefits of Customising Your Organisation’s SAP Access Risk Rule Set appeared first on InsideSAP Asia.

However, current data architectures that exist in organizations today do not meet these customer requirements. A Forrester report showed that between 60 percent and 73 percent of all data within an enterprise goes unused for analytics. Fifty-two percent of SAP users as surveyed by SAPinsider – the largest SAP membership group worldwide – said that a top analytics pain point is data integration. And an Accenture survey revealed that only 32 percent of executives say they can create value from data!

If this is your situation, Qlik is here to help. To unlock the hidden insights in SAP data, Qlik is leading the industry in accelerating use of SAP data for actionable insights and decision making. We just launched the Qlik Order-to-Cash solution accelerators for SAP, the first in a series of SAP-focused data and analytics solution accelerators that speed the ROI of integrating SAP data with modern analytics projects.

Order-to-cash is a critical business process. It includes activities from booking and fulfilling an order to getting paid. Order fulfilment and billing affect customer experience and loyalty. Receivables management and payments affect working capital and cash. Given the times, what could be more important than taking care of your customers and taking care of cash so you can run your business smoothly?

However, order-to-cash also happens to be one of the more complex of business processes to optimize. It is highly fragmented across teams, as there are stakeholders in sales order management, in supply chain logistics and warehousing, and in finance billing, accounts receivables management, and financial accounting. In addition, the data is also fragmented across multiple systems. This is where Qlik’s data integration and data analytics platform shines.

The solution accelerators come with prebuilt components for SAP sales orders and accounts receivables data replication, data warehouse automation to a cloud platform of your choice (Azure Synapse, Microsoft SQL Server, Google BigQuery, Snowflake DW, AWS RedShift, etc.), as well as order-to-cash modern analytics.

The prebuilt data integration and transformation into order-to-cash analytics-ready data and KPIs can save months and thousands of hours of data effort. And, the prebuilt analytics components empower users of all levels of data skills with actionable insights via rich, interactive order-to-cash KPI dashboards, intelligent alerting and AI-enabled conversational analytics. Users don’t have to wait till next day for updates on sales bookings, billings, fulfilment or payments. If shipments are delayed, they can be notified in real-time and proactively contact fulfilment or the customer. If payments are predicted to be delayed, they can act fast and thus reduce days sales outstanding and optimize working capital.

With tremendous amount of order-to-cash and working capital performance management functionality already built-in, these accelerators can speed your SAP data modernization, enable more agility, and quickly deliver a business solution for order-to-cash analytics users.

To find out how your business can benefit from real-time modern analytics, join us for “How to Turn SAP Data into Critical Business Insights” on 20^th May 2021.

The session will cover:

• Learn how to build a strategy to modernize analytics to support core finance and order management functions such as order-to-cash.
• Provide real-time data from the various LoB applications and core ERP.
• See a live demo of how to actually transform raw SAP data into usable information and actionable insights for the business.
• Discover new ways to support order-to-cash visibility and important views into cash, liquidity, and working capital.

This article is sponsored by Qlik

The post Qlik Launches Order-to-Cash Solution Accelerators for SAP: Modern Real-time Analytics to Optimize Your Cash Flow appeared first on InsideSAP Asia.