BSI sets the standard for SAP access risks and SoD

I'm Zaki Mouden. I'm global head of applications or enterprise applications within BSI. BSI is the British Standards Institute, so we are the national standards body. We then effectively sell a service in terms of auditing those standards. So it's literally how can we improve things. With Soterion, what we have is a list of all the risks within SAP, and we're able to run reports, for example, should individuals have access to ME 21 and also then ME 29 so as to be able to create and approve purchase orders. So it's that segregation of duties. So look at the standard segregation of duties matrix built into Soterion to ensure that what we're doing is best practice and just not what we've been used to doing over the last twenty years. Historically, I've always sort of looked at SAP as our finance system. And so therefore, it's not just about SOX compliance in terms of merit, it's ensuring that our estate is secure, ensuring that the data is secure, and there's that clear definition in terms of what people can and can't do. So the ability to report on that means that I feel secure in terms of I'm doing the best for the organization, and my team are doing the best for the organization. We've had a lot of feedback in terms of the end user community. So we have given access to each individual department within finance so they can run their own reports in terms of to see what transaction codes their team have access to. It's user friendly. It's intuitive. It's simple. The ability to just reach out to people and get the access and the support I need without having to go through a whole ITSM tool and rest of it. So I'll still log things just for the traceability, but knowing that I can just go to someone and they will respond. It's not what you normally get from larger organizations.

The challenge: Minimal access and SoD controls

BSI has an SAP ECC6 system with around 1 200 users. They had very few controls in place to manage risks of
user access, reporting and Segregation of Duties (SoD) in their SAP environment. When they received a request
for an internal audit of their finance system, they extracted all the requested reports by a long and manual
process, and they found different high- and medium-risk areas.

They identified five challenges in their internal access control processes:

Directive controls: Periodic reviews of their user access rights were not performed
consistently.
System reporting: Their existing user access reporting tool did not provide sufficient detail to
perform an effective review process.
Third-party users: Third-party users received similar access to internal employees, without
sufficient monitoring.
Super-users: Super-access rights were granted to members of internal teams: Finance
System, SAP Experts, and Data and Reporting Integrity. This needed to be checked.
Inappropriate user access rights: Access rights were not allocated correctly, and SoD was
inadequate.

Soterion solutions: mitigating all risk areas

To overcome and resolve the risk areas, BSI’s options included:

doing nothing, using existing reports to extract data, and then manually manipulating it in
Excel to produce required reports.
building custom reports in SAP, using the existing ABAP-developed programmes and
customising them (assuming the risks that comes with this approach).
finding a tool that could help them overcome and resolve risks.

BSI decided to adopt the solutions from EPI-USE Labs’ partner Soterion, which solves GRC for SAP clients.
Soterion provides them with a list of all the risks within SAP, and they can run reports about which individuals
should have specific access, using the built-in SoD parameters. This allowed them to develop a best-practice
process, rather than falling back on historical ways of operating.

Solving GRC for BSI

BSI is putting Soterion’s solutions to good use, including:

Allowing business users to extract their reports based on their roles and responsibilities. Not
everyone needs SAP access. They have amended access to ensure that everyone can access
what they need to for their specific roles, without exposing and risking company information.
Amending transaction codes based on Soterion’s reports.BSI decided to adopt the solutions from EPI-USE Labs’ partner Soterion, which solves GRC for SAP clients.