Soterion Technologies Pty Ltd

An infographic to illustrate the inter-relationship between the various components of SAP security and GRC. Deficiencies in any layer will negatively impact your organisation’s ability to manage your SAP access risk.

Conducted by SAPInsider, this brief provides insights into how an organisation can build a more effective access control capability through business-centric GRC. Business-centric GRC converts the technical GRC language into a language the business users can understand, facilitating better decision making and a more risk aware organisation.

For those organisations who do not have an access control/GRC solution, there are considerable benefits in performing regular SAP access risk assessments. Performing more regular access risk assessments can be a more failsafe way to ensure the SAP authorisation solution has not provided inappropriate access to the users during the course of the year.

It has been found that organisations running SAP are either in the project phase or in the planning phases of their S/4HANA project journey. Many of these organisations have identified this journey as a unique opportunity to strengthen their SAP security. Thoughts intuitively turn to GRC and IAM tools to achieve this; however, without addressing the underlying issues of the SAP role design, GRC and IAM tools will not deliver the expected results and will leave the organization disappointed. Does

Organisations have been asking their business users to review SAP access change requests for quite some time now. However, even with regulations such as SOX / JSOX being in existence for almost 20 years, the requirement to perform a User Access Review is a more recent requirement for many organisations. We shed light on why this is becoming so important and provide you with insights on how you can facilitate this shift in thinking.

For Saint-Gobain SA there was a constant challenge around accessing control to their SAP systems. After engaging with Soterion, Saint-Gobain SA became better equipped for audit success through the role redesign. With a better understanding of business risks and access control, process owners developed more business accountability.