SAP SOX Compliance Consulting

SAP's access model is built from authorization objects — data structures that pair a transaction or object type (vendor master, purchase order, journal entry) with field-level values such as company code, plant, or document type. Roles built in PFCG bundle these authorization objects into a coherent job function, and users are assigned one or more roles through PFCG or a downstream identity-governance tool. For SOX purposes, this is the layer where segregation of duties either exists or does not: a role that includes both the authorization object for creating a vendor master record and the one for releasing a payment run to that vendor is a textbook SoD conflict, and SAP will enforce it exactly as designed, conflict included, unless someone has explicitly ruled it out.

The complication auditors run into is that authorization objects are additive and composable. A user can inherit a payment-release capability from a role built for treasury and a vendor-master-change capability from a role built for procurement, with neither role author aware the combination creates a conflict. This is why SAP GRC Access Control's rule set — a maintained library of SoD conflict definitions mapped to specific transaction codes and authorization objects — matters more in SAP environments than a generic access review would in a simpler platform. Without it, SoD conflicts are effectively invisible until someone runs a targeted query or an auditor samples the wrong user.

SAP separates development and configuration work from production using transport requests — packaged units of change that move through a landscape (development, quality assurance, production) via the transport management system (STMS). Every transport that touches a financially relevant object — a validation rule, a tolerance limit, a workflow configuration, a custom program touching the general ledger — leaves a record: who created it, what objects it contains, who approved it for import, and when it landed in production. This transport log is one of the most reliable ITGC change-management artifacts available in any ERP, because it is generated by the platform itself rather than maintained separately in a ticketing tool.

The control gap that shows up repeatedly in SAP 404 testing is not the absence of transport logging — SAP logs faithfully — but the absence of enforced approval gating before import to production. SAP does not require a second approver on a transport import by default; that discipline has to be configured through STMS authorization restrictions or layered on through a change-management tool that gates the import step. Auditors specifically test whether the person who released a transport for import is different from the person who created it, and whether emergency changes (a common SAP fallback path) were retroactively reviewed rather than left undocumented.

SAP Process Control automates the testing of application-level controls that would otherwise require a manual walkthrough each quarter — things like three-way match exceptions, duplicate vendor payments, or journal entries posted outside a defined threshold without the expected approval. It runs against live transactional data inside the SAP environment and produces exception reports that internal audit or a control owner reviews on a defined cadence, which converts what used to be sample-based testing into something closer to full-population monitoring for the controls it covers.

The realistic scope for Process Control in most SOX programmes is a focused set of high-risk, high-volume controls — not every control in the ICFR matrix. Configuring and validating a Process Control rule takes real effort, and a rule that is not periodically revalidated against changing business logic (a new plant, a revised approval hierarchy) becomes a false-negative risk of its own. Programmes that get the most value treat Process Control as a complement to SoD enforcement in GRC Access Control, not a replacement for it — one governs who can do what, the other watches what actually happened.