Enhancing effective access controls in your organisation

Good day, everybody, and welcome to today's session. We're really glad that you could join us today. As you've seen on the invite, our presenter today is Dudley Cartwright. So Dudley is the cofounder and the CEO of. He brings over twenty years of SAP authorization experience, and his strong technical background combined with his business insight has helped him implement security solutions for companies across the world. You'll notice during the presentation that Daddri is passionate about this topic and about delivering practical solutions. So this philosophy has also become a key part of the mission. With that, I'll hand over to Daddli to take us through the session. Daddli, over to you. Okay. Perfect. Thanks, Anton, and welcome, everyone. Thank you for joining today's session. I think also a very big thank you to EPI-USE Labs for arranging this. So I'm gonna just cover a very high level overview of, you know, how to implement effective financial controls. It's often a requirement for many organizations to implement access control solutions. A lot of time, there's pressure from the audit firms to implement these type of solutions. And we'll just sort of discuss today, you know, what our offering is and potentially how it can assist you implement more effective financial controls within your organization. Okay. So I'm gonna get straight into it. So just from a agenda perspective, I'll just we'll be spending sort of about twenty, twenty five minutes talking through a slide deck, and then I'll just spend around the last fifteen minutes, just showing you a high level sort of, demo of the Citroen, application. Okay. So to maybe go all the way back to the beginning, I think it's important for us to understand, you know, why do organizations implement access control solutions? What is the driver? What is the purpose of an access control solution? And so, you know, the main objective of these type of solutions is to assist the organization implement effective financial controls. That's to help you ensure that you don't have financial loss, that you, have the necessary controls in place. So an access control solution, is also sometimes referred to as a GRC solution, but I'll just keep cold calling referring it to as an access control solution. It's there to assist with access risk management activities. It can also assist with the provisioning of roles to users, and it can also assist with SAP licensing. And so today's session is not gonna touch on the licensing capabilities of these type of solutions, but I think it's important that we just sort of plot the seed as to how these type of solutions can assist with licensing because I think that is going to become a much more important aspect in the years that are coming for organizations to effectively manage the access in order that they don't overpay for SAP licenses. So on the access risk management side, is an access control solution there is to highlight which users have potentially got wide or inappropriate access. And with that wide inappropriate access can potentially perform segregation of duty sort of activities, which could result in a fraudulent activity. Likewise, with the user provisioning, what an access control solution allows an organization to do is to simulate the assignment of a role to understand what the risk impact of that proposed role change or user assignment prior to applying that change in SAP to understand what the risk impact of that is. So if Susie and your organization request the ability to create purchase orders, if you assign the role to Susie, Would that new role introduce any new segregation, segregation of duty violations, which potentially could result in Susie being able to perform a fraudulent activity because of that sort of conflicting access that's been assigned? And, also, SAP licensing on the user licensing has always been somewhat tied to, tied to authorizations and what access peep people have got. So, an access control solution can assist you with your license comp compliance. So what we found, though, in the ECC world, the vast majority of organizations would implement an access control solution primarily to assist them with the access risk management act So in other words, to assist them, help them with their sort of segregation of duty management in order to minimize the likelihood of fraud. So the vast majority of organizations in the ECC world implement an access control solution to assist them with fraud prevention and to assist them with the access risk management activities. And few very few organizations would actually implement an access control solution to help them with licensing. Organizations felt that they were at greater financial risk from fraud taking place within the organization than from license noncompliance. But the seed that I'd just like to plant with you, SAP is changing the way they measure user licenses, and it's becoming very sort of the way in which SAP changes the way that user licenses is measured based on what authorizations have been assigned to the users. So as you start considering is for an in particular rise or SAP ERP private, you will need to start thinking about how in managing your roles and your authorizations in order for you not to incur any license sort of true up costs or overpay in licenses. And so as we move into the IS four world, what we're finding is that for many organizations, they almost had greater financial risk from license noncompliance than from fraud taking place in the organization. So we're not saying that it's not important to still perform all your access risk management activities, but I think it's just important to understand with SAP's recent changes from a licensing perspective, you need to be managing your roles and your authorizations not only from an access risk and a segregation of duty perspective, but it's important that you are also doing those activities to ensure that you don't incur unnecessary license spend. And so with that, you know, what we tell organizations, it's important to understand, well, what's the risk in your space, and then what are the controls that are available, and then what are the control activities that can be implemented to sort of mitigate that risk. So the risk in the SAP authorization space is very much around users being assigned wide or inappropriate access. And I'm sure all of you are very aware that, unfortunately, in the SAP space, there's such a tendency for users to be assigned wide and inappropriate access. The you know, people users get assigned more and more access as time goes on, and so there's such a tendency for users to be assigned much wider access than what they actually need to perform their duties. And this is often then highlighted by external audit. You know, all the audit firms have developed the capabilities to run these access risk assessments, and they often will highlight, you know, what is the risk exposure that your organization is facing due to the wide and inappropriate access. So a big part of what we are trying to assist and, understand what the risk is saying, listen. If there's such a tendency for users to be assigned wide and inappropriate access or more access than what they need to perform their job functions, how do we mitigate and manage that? And the controls are twofold. The base control is ensuring that users have only been assigned the access they need in order to perform their job function. So it's the least privileged concept. It's ensuring that users can't do more than what they need to carry out their day to day job functions. Unfortunately, that can be a bit more quite a difficult task to manage because, you know, you can maybe a user might request a particular transaction code. That user will be assigned a role that gives them forty or fifty transaction codes. So that's the concept of authorization creep in SAP, and users it's so easy for users to be assigned much broader access than what is required. The other control that's available to an organization is it's impossible to live in a world where you have no access risk. Okay? Unfortunately, you don't have the luxury of segregating every function to the point that you have no risk. You don't have enough personnel. You don't have enough employees to segregate all the functions to that degree that audit would expect you to segregate. So especially in some entities, you may have a smaller business unit where a particular user is performing two or three different type of job functions. So you live with. You do need to live with some risk, but it's about understanding who in the organization has that risk and then monitoring those users to ensure that those users are not doing anything untoward with that wide access or that access that they do have. And then the different sort of control activities that are available to an organization are is if you implement an access control solution, you can run regular access risk assessments to understand who in the organization has got conflicting access, who has got sensitive access. You can also then start performing what if simulation. So before any role content change is done or before any role is assigned to a user, you can run the simulation of that to say, listen. If we assign this role to this user, what is the is this gonna introduce any new segregation of duty violations or any access risk violations? And so you've got a pre preventative or preemptive control in which you can make a decision whether that role is acceptable if, before you actually apply that role change in SAP. Some of the other controls that are available is you've also got a rule set. All these products like Citroen will supply an out the box rule set, but it's important that you take that rule set and make it more relevant or applicable to your organization, whether that is removing any access risks in that rule set that you don't believe is a risk to your organization and or also adding any of the custom transaction codes that is specific or unique to your organization to the rule set. You've also another control activity is the firefighter process. This is the emergency access management process, and it's there predominantly to assist the IT or support users be able to sort of be granted wide emergency access in order to assist with sort of emergency access or business critical activities if and when needed, and they can do that in a controlled manner. Okay? So that process generally then allows you to assign a more cut down access to your support users for their day to day access, but they had the mechanism to check out a wide emergency access role to perform business critical activities if and when needed, and that can be done in a sort of automated controlled audit auditable manner. And then another very common control activity is the annual user access review. Okay? So that process is where your line managers or your reviewers need to review all the users access on an annual basis to ensure that all the access that's been assigned to them is still relevant and appropriate for the next the upcoming period. Okay. So that's typically what the audit firms try and get their their clients to implement those type of control activities. So if you implement an access control solution, it is very important that you understand the relationship between people, process, technology, and design. So I know this is very cliche in the IT world where people talk about people, process, technology, but I must say that it does lend itself very well to the GRC space. And what we mean by that is if there's any deficiencies in any one of these components, unfortunately, you as an organization are not going to be extracting the value you should from your GRC investment. Okay. So on the people side, and this is most probably the greatest challenge we have in our space, is there's two sets of people that we need to consider. There's IT and there's the business users. So, generally, the IT users are your sort of administrators of the role designs. They're the administrators of the GRC solutions, etcetera. But the more important person in the people part are the business users. You know, access risk is business risk. And so if a certain users needs a conflicting access that are potentially is an a segregation of duty violation, it's the business users that should be making the decision whether that access is acceptable or that risk is acceptable to the organization. It's not IT that needs to be making that decision. Businesses better place to be making that decision whether that access is appropriate for that user. The business users understand what the risk impact of that combination or conflicting access may be. The challenge we often have is that the whole space that we in this whole SAP authorizations, access risks, segregation of duties, etcetera, and the GRC's, these are very technical. So a lot of the time, the responsibility falls back onto the IT users because they are more technical in nature, and the business users can say, this is too difficult for me. I don't understand it. IT, please, you run with this. Another area that's important to understand, you know, if you implement an access control solution, your processes will change. So instead of manually assigning roles to users, maybe the access control solution starts assigning doing the role assignment. So your process change. So it's very important that you go through the effort of updating your policies and procedures in order to sort of define every use case that is available or is going to happen within the organization. What we find is that if an organization doesn't go through the effort of clearly defining that their policies and procedures, the business users do not under do not know what is expected of them. They do not know under what circumstances are they allowed to prove certain requests, and they do not know within what time frames they are expected to perform certain functions. So it's very important that you spend effort in clearly defining your policies and procedures in order to educate the business users in order for them to know what's expected of them. The technology part is very much where it fits in. We try and emphasize to every client or company we speak to. We say, please do not think that all access control solutions are made equal, and find an access control solution that's a good fit for your environment, that's a good fit for where your what your current ERC maturity is, what your internal capabilities or expertise is. There is a risk sometimes organizations can implement some of the larger solutions or the more complex solutions like SAP GRC, but unfortunately, they then may struggle with underutilization of that because it's too technical and it's too complex for the environment. And then just lastly, it's also very important that we've gotta add to our trilogy of the people, process, and technology, the design. And what we mean here, this is the SAP role design. It forms the foundation of all things GOC. And if you've got an updated or inappropriate role design, unfortunately, it doesn't matter how enthusiastic your business users are at performing the access risk management activities. It doesn't matter how well defined your policies and procedures are, and it doesn't matter if you've implemented the best access control solution in the world. You're just not gonna extract the value you should from your GRC investment if you have got an inappropriate or outdated SAP role design. So it's important that you put in the effort to address the underlying SAP role design if you wish to extract value from your GOC activities. Okay. And then just quickly just to talk through some of these control activities. I'm not gonna go into too much detail with all of these, but before I get into the product demo, think it's just important that we I just emphasize at a high level what are some of the key takeaways or what are some of the differentiators of Citroen. Because when we get into the product demo, it's a bit more technical. And so these slides are just covering some of the views within the application or some of the functionality that we can just sort of discuss at a high level what is the key takeaway for that. So the one thing that Saturna is very passionate about is converting the more technical GRC language into a more business friendly language in order to make the business users be able to make more informed decisions with regards to what's data or information that's been presented to them. We do not want to give business the opportunity to push this responsibility back onto IT and say, this is too complicated for us, or I don't understand it. IT, you run with it. Saturina is all about saying, we've differentiated our software from all other vendors out there by saying, how do we convert the technical GRC language into a more business friendly language in order for the business users? In other words, the nontechnical users to be able to understand what's been presented to them and be able to make informed and quick decisions as to whether certain access is acceptable or appropriate for a particular user. And so all of the our design and development is saying how do we present information in easy in an easy consume manner? So the first this is one of the main dashboards where we just show what is the risk impact that is facing the organization. And we've got certain things like this is a view that highlights or illustrates what are the segregation of duty violations within the organization. And so but some of this reporting can be considered quite technical for certain users. So what we've done is we provide all of the supporting business process flow illustrations with each of our segregation of duty risk reports. So in case a person now a business user can say, okay. So this user, this is the procure to pay business process. I see the two items highlighted in red, which is the purchase order approval and the goods receipt. This user has that ability. They can visualize or conceptualize where is this conflicting access, where does it reside in the business process in order to make the business user be able to understand what's being presented to him, in order to make allow that business user to make a more informed decision as to whether that combination of access is acceptable for that particular user. Has also got some incredibly powerful risk remediation capabilities. So for a lot of organizations that have a lot of over allocated access or there's a users have been assigned much broader access than what they need. This our remediation capabilities can help your security team align the solution with what the users are doing and thus reduce the potential for fraud by removing a lot of the over allocated or unused access. For the what if simulations, this is the process which, hopefully, you would introduce into your sort of SAP access change request process. A person is requesting additional access, or maybe a person is moving from one function to another function, or maybe a person is just performing a substitution for a period while someone goes on maternity leave. You want to, assign additional access to that user, and wanna understand, well, what is the access risk impact of those role roles additional roles to that user. And often because this has a very big touch point with nontechnical users, as an aligned manager should be the one reviewing and approving this or possibly a role owner. So then presents this information in, again, using these business process flows, presents us in a way in which makes it easy for the business user to understand to say, listen. Mister business user, if you grant this access, your user is going to be able to do perform purchase order maintenance, and they also can do vendor invoice processing. If you push accept, understand that's the risk that will be introduced. It's not to say it shouldn't go through. Maybe there's a business need or business requirement for it, but it's just to be to highlight what is the proposed access risk impact of this and present that in a in a manner that makes sense to the nontechnical users. Okay. And I'm also doing just gonna jump also that we've got a firefighter module, which allows users, your support users, and even some business users to be able to check out some sensitive or wide access in a very controlled manner. And, again, the big differentiator of this product from our side is the way in which we present the activity logs of that sort of elevated rights or firefighter session. One of the key controls available to the organization is saying, listen. If one of your support users needed to perform a business critical activity and log in at three o'clock in the night and sort of open the system for configuration or open the periods, financial periods, etcetera, whatever that was, how do you know that user did not perform anything that he shouldn't have done while he had this broad wide emergency access? So the controllers, everything that person did while they had that elevated right access is recorded, every transaction code, etcetera, and then that activity logs is then reviewed by someone to sign off and say, yes. Everything that our support person did looks correct, and it's aligned with the help desk tick ticket that the person requested the access. The other control activity that I just wanted to mention is a annual the user access review. It's a very common control activity, and this is where your line managers need to review all of the users' SAP access and just sign off and ensure that access is still appropriate. The challenge that many organizations face with this is a lot of the time, the SAP role design the SAP role names are nondescriptive, and it's difficult for the line managers or the reviewers to know exactly what access is contained in those roles. So Saturna allows for that entire review to be done by business process. The reviewer can just perform just needs to look at the business process to see what these users can do. They do not need to then understand the SAP technical role names. Saturn will handle that logic in the background. Okay. And then just we've also got a materialized risk module, which analyzes which users have actually which SODs have actually materialized. So maybe a person's got the ability to create a purchase order, and they've also got the ability to lease a purchase order. This module will then highlight which users have actually created a purchase order, and they've also released that same purchase order. That's our materialized risk module. And then we've also got a licensing module. And as I mentioned with SAP's recent changes, we've got can highlight which you know, what's the optimization or how do you sort of optimize your role design to in order to ensure that you don't oversubscribe to FEEs if you are considering a move to RISE. Again, then just lastly, we think that's important if you are going to implement an access control solution. Please don't make the mistake of thinking that all access control solutions are made equal. Find one that's a good fit for your organization. There are some solutions that are very technical and very complex and could make your life a lot know, very difficult. So I'm hoping that in the course of the demo now that you will see that we're a very sort of user friendly, very business friendly solution, and we can sort of bring value almost immediately. And then we've, you know, got over a hundred and fifty customers around the world that use our software. And just maybe just to end this before I get into the product demo, just to try and just emphasize what are some of the differentiators. I think Saturna is an incredibly user friendly solution. We often do implementations of our software anywhere between three and five days. That implementation not only includes the technical implementation, but also includes the end user training. So compared to some other sort of access control solutions, significantly easy easier to train your internal team how to make use of certain application. I'm gonna try and emphasize in the demo now how we spent a lot of effort trying to translate the more technical GLC language into a more business friendly language in order to allow your business users to be able to be more effective in the access risk management activities. I'm gonna hopefully demo to you that we've got superior functionality to a lot of the other vendors. I'm also gonna mention that we do pride ourselves on the technical support and the consulting support that we give in combination with EPI-USE Labs. We know all of our sort of hundred and fifty clients by name and providing good support is a very sort of key objective of ours as an organization. And then just lastly, we've got a lot of plug and play capabilities. We've got predefined rule sets. We've got pre predefined materialized risks, etcetera. So we can run an assessment on your solution, and or you can start making use of Citrone, and you almost start extracting value from from day one. Okay? Okay. So I am going to now jump to the product demo now. So first of all, Serturn is a non ABAP based solution. So we've got it nothing needs to be installed within your SAP environment. We make use of standard RFC calls, standard function modules, etcetera. We do have a few custom function modules that are needed for some additional information, but they're not needed for the standard use of the product. We do we make use of Microsoft Azure as our hosting provider, and we then go through sort of annual sort of SOC two type two security certifications with pin testing and ISO twenty seven or twenty one, double seven, whichever one it is. Sorry. And so a lot of audit firms make use of our software too, so we do need to adhere to the strictest security protocols. We also have a lot of pharma companies, even some nuclear companies in Europe that make use of our software. So we need to adhere to the strictest of security, so requirements or protocols. So once we've connected Serturn to your SAP environment, we then import the data, the authorization related data from the SAP environment, and then we run a risk analysis against that data. So this is one of the main dashboards within the application. And this first tile here represents the potential risk, represents the number of access risk violations that we have identified based on the authorizations or the access that's been assigned to the users. So in theory, if your external audit firm had the exact same rule set as us, they would be reporting on that number, that fifteen thousand. That's the they rep audit firms report on what the potential risk is, what people can potentially do. Luckily, a lot of the time, users don't know they've even got that access, but in reality, it still is a risk to the organization. So Serturn reports on potential risk in relation to what we refer to as actual risk. So an actual risk in Serturn is where all of our clients turn on the SM twenty logs or the user transaction logs with now called RSAU. And so we then monitor all of the transactions or the Fiori apps that have been executed by each of the individuals within the organization. So if we've identified a user has executed or is anything to do with purchase order maintenance that create or maintain the purchase order, and that same user has also gone and released the purchase order and whether that's m e twenty eight or m e twenty nine. And that is what S'Tern will refer to as an actual risk. So we then know what users are using. And what becomes very valuable to your security team is if you know what transaction codes and Fiori apps you the users are using, you can then work out what they're not using. And then that becomes quite valuable to your security team to assist with sort of some role cleanup or, you know, risk reduction type activities. So as an example, yeah, we've if we look at this light blue tile here, the superfluous roles, there's two thousand five hundred role assignments that have been where roles have been assigned to users and which is contributing to risk at this organization, yet those users are not executing any of the transaction codes contained in those roles. So in theory, you'd be able to remove those roles without impacting that user's job function. It's just it's over allocation of access, but it's contributing to the potential risk count. But there's a significant number of that access risk that's being reported on that's made just because of over allocated and unused access. Likewise, will also report on what we refer to as superfluous sensitive transactions. The those are transact sensitive transactions that's in the role design, yet none of the users assigned to those roles are executing any of those transaction codes. So those type of activities is what Serturn can sort of highlight is the cleanup opportunity. We can even project then how clean we could get the solution if all of the unused access were to be removed from the users. So I'll just go ahead and show then how to turn in reports on access risk. I've gone into the segregation of duty view. This we've got this trends graph here that it is that highlights what's the number of segregation of duty violations that the organization has. And you do want these two lines running in parallel together. That would indicate a well aligned solution. So the blue dot represents the number of potential risks based on the access assigned to the users, and we show that in rep in relation to the actual risk, the number of access risk violations based on usage. So the intention is to get these two lines running in parallel to each other that will indicate a well aligned solution. Your authorization team have aligned the role design sort of to what the users are actually doing in the system. But what we can see at the end of this graph here, there's been a jump in the SOD, so something's happened. A dis wide access or additional roles have been assigned to some or, you know, one or many users, and all of a sudden, the access risk count has jumped quite recently. So you'd wanna go and investigate that and bring that back down. But if we had to come and have a look at this over a five year period, you'll see that this organization had significant over allocation of access at one point. There was a hundred and twenty four thousand access risk or SOD violations. And so there was just, you know, huge amount of just access that was assigned to users that was not needed for those users to carry out their job functions. So a big part of what the Citroen product can do can help you align your solution, almost eliminate or remove all of that over allocated or superfluous access. And the benefits of that activity are, you know, you obviously reduce the potential for fraud happening in your organization, but there's also gonna be a licensing benefit if you can align the solution more accurately with what users are doing in the system. Your user your SAP user licenses will be you'll be paying for you'll be oversubscribing to less licenses. But, also, a lot of your other control activities will be performed much, much more effectively. If this organization, as an example, were performing an annual user access review and the data looked like it did in May twenty, there would be hundreds, if not thousands, of additional role assignments that would form part of that review that would need to be, you know, reviewed by the reviewers, taking up a lot more effort. And you could maybe argue that would lessen the sort of the effectiveness of that sort of activity where once you've gone through this alignment process and you've got the data to a much more acceptable level, if the organization were to embark on a user access review today, it would be, as I've mentioned, hundreds, if not thousands of list roles that would form part of that review set and will reduce the effort it would take of your business users to carry out the sort of annual user access review activity. Okay. So just to then go and show then how Serturn reports on access risk, these are all now users that have got segregation of duty violations. As an example, this user here, this Angela Baker has got a handful of segregation of duty risk. I'll just go and show you this particular one here where the user can put do the purchase order approval and also hide the inventory by not fully receiving the goods. We've got in conflict with the purchase order approval transactions. We see the role in which the user gets the conflicting tran transaction code. But the more valuable information comes in the frequency column. This transaction frequency column says, how many times has Angela Baker executed the transaction code meager? And there's a count there of naught. So, yes, the person has got the role, but we haven't seen that this person has executed that particular transaction code. So it lends itself to possibly being removed if it's not forming part of that job function. Maybe that person was assigned that access a year ago when there was a substitution. That role was never taken away. That person doesn't need that access today. But a lot of the times, a lot of organizations will look at some of this information and say it's very technical, and I don't quite understand how can fraud be committed with this combination of access. And this is where converts the more technical language into a more business friendly language and say, listen. Let's visualize this combination of access in the business process flow. So we're saying, listen. This user, this is the procure to pay business process. This is saying, listen. This user can do the purchase order approval, and they can do the goods receipt. So it just allows the business users or less technical users to be able to conceptualize or visualize where is this combination or the segregation of duty combination, where in the business process does it belong in order for the line manager or whoever reviewing this to say, no. That makes sense. That person performs both those functions. I'm comfortable for them to have it or for the person to say, no. Listen. I didn't realize this person had the ability to approve purchase orders. Let's take that access away. So these process flows are shipped standard with the Citroen product, and you can then just come and update those process flows to be more sort of reflective of your actual business processes. So maybe as an example, you don't do any manual checks anymore, so you just get rid of manual checks and say, listen. We only gonna we only do EFT. So this is a blank canvas for you to sort of tailor to be more reflective of your actual business processes. But those business processes have been those that functionality has been very well received by our customers that we've actually introduced them in many areas. So as in job, you might also just go and say, listen. I wanna then see all users that have got procure to pay segregation of duty risk. Everything highlighted in red, there's a user within your organization that has got a segregation of duty that contains that ability or that function. So you might say, listen. Let's go and look for all users that have got a segregation of duty risk that contains vendor master maintenance. Just by clicking on that, Sertion will then filter the users that have a segregation of duty risk that contains vendor master maintenance, and we're going to show you what the role is that gives that user that ability. So, again, we're just making this more usable for potentially some less technical for some less technical users. Okay. So turn, we'll report on critical transaction risk. We've also got a data privacy, rule set, etcetera. You know, we've, we'll also report on users that have risks at a composite role level and as well as a single role level. So there's no type of category that does not cater for from an access risk reporting. What I'm gonna do then, I'll just also maybe then show you Citroen's got some very, very powerful cleanup and remediation functionality. We've got some amazing cleanup wizards that allow your security team to do some very technical role splits or cleaning up composite roles, etcetera. But what I wanted to spend a bit of time with is, let's assume you've now introduced Serturn in your business as usual process, and you want to start getting business approval on every SAP access change request, and they having the they performing that approval, understanding what the access risk impact is of a particular change. So Tunc has got a number of different simulation types for all of the different use cases. So whether that's a person substituting, whether it's a new user starting, whether it's a person just requesting additional access, and I'll just go through that as an example. We've got all those different use cases. You'll maybe a particular person is requesting the ability to create purchase orders that gets logged with your help desk, and your help desk will forward that, call to your security team, and your security team see says sees that, listen. Angela Baker has been requesting, the ability to create purchase orders. Your security team finds the SAP role that's the best fit for that request, and then they can simulate that assignment prior to applying that change in SAP. So will run the simulation and say, listen. If we assign this role to this user, it's going to introduce two critical access risk and one higher access risk. And we can then see what those risks are that's been introduced. So maybe your security team says, okay. Well, listen. Let's get the line manager's opinion on of this. You can initiate the workflow of this. This will then be workflow to who's ever in the workflow part. Let's assume it's a line manager. The line manager will open this will get a link. He'll open this view, and he might look at this and say, okay. But I don't actually quite understand what this SOD is. Again, by just clicking on this information, this will say, listen, mister line manager. If you approve this, this user your user's gonna be able to do purchase and maintenance and then invoice processing. You know? Are you happy to proceed? If the line manager proceeds and says it's approved, will provision that role to that user. So your security team don't need to do that. The application will handle that itself. Again, then just lastly, just the last view that I wanted to just touch on is on the period review, the user access review process. This is a, as I mentioned, a very common control activity that the audit firms try and recommend their clients to perform, and it's just the way the reviewers or line managers need to review the access of all the users from from time to time. Okay. So this is a review set, and we've got a number of reviewers. As an example, we've got Christopher Lopez. He's got eleven users that report to him. And maybe Jason Carter, he's got a hundred and fifty six users that report to him. So if we were to drill into maybe Christopher Lopez's inbox, and Christopher Lopez will then make use of to perform this annual user. Instead of receiving this information via spreadsheet, the eleven users that report to Christopher Lopez and all the roles that those eleven users have got. This that user annual user action review can be performed by the reviewers in the situation application. So I'm gonna simulate going into Christopher Lopez's inbox, and this is what Christopher Lopez will see. Christopher Lopez will see all the users that report him and all the roles that have been assigned to the that user. From this, Christopher Lopez, the review will be able to see, did I previously approve this assignment if this was a if this is not a second review and or I can see if I previously rejected this particular assignment. And, again, if the SAP roles are nondescriptive or do not make sense, maybe you've got an outdated role naming convention and it's difficult for your reviewers to know what's contained in the role, again, the reviewer can do the entire review by business process and say, okay. Well, there's someone reporting to Christopher Lopez that can perform purchase orders. Okay. Just by clicking on that, filter the users and which roles give that user that ability. So we're moving away from a reviewer needing to know the technical SAP role name. They can just perform the entire review by business process. Will do the filtering of which users and which roles give those users that ability, and we will give you show that information down. The reviewer can then, you know, go through this. And I'm not logged in as Christopher Lopez, so these are all grayed out. But if I was Christopher Lopez, I would be able to check these items here and then approve or reject them based on that particular decision. Okay. So that at a very high level is the functionality that I was hope hoping to show you today. It's obviously a very brief demo. So I apologize for the speed at which I go through it, but I'm hoping it gives you some indication of as to what the capabilities are. And if there's anyone that would like to find out a little more, obviously, please do reach out to, Labs or and just ask, and we'll gladly jump on a call and provide you with more information. So that's it from my side. I'll happily hand over back to you if you would like to give the final words. Thank you, Dudley. I think let me start by thanking you. I followed it. I know the product very well. I used it myself. It is excellent. You don't need a full team to manage this product. It's very user friendly. So thank you. Yeah, and it was very insightful. Plus the demo, I think a lot of the issues is around the wizards that you have, I think, is a big benefit because it helps by correcting errors in the system. And then I want to thank the attendees for making time and joining us on this event. We tried to keep it short so that you can carry on with your daily tasks, but thank you very much for joining. We will keep in contact with you afterwards. You all have my emails. I want to just mention that Sutterion offers a free assessment. So if you've had any audit findings that you're uncomfortable with, the assessment gives you an insight in your assessment risks and what is currently at this stage, so please get in contact with me. It is a simple four step process. Out of that comes a very nice report in detail and in summary and in detail the other way around to give you exactly what is your risk at the moment. And you can also maybe then connect that back to your audit findings. So very welcome to get in contact with me and we can get the process started. And then you can actually see why you need Sauterian, because we're going to highlight to you all those risks and all your duplications of people using different functions and all of those things. Thank you very much, Tabli. Appreciate your time and effort. And Amy for speaking this up. Thanks, Marika. Thanks, Dudley. We will end off the session now. Everyone will receive the recording. But thank you so much. Enjoy the rest of your Thursday, and we'll all connect soon. Thank you, everyone.