{"id":48989,"date":"2023-09-05T07:39:05","date_gmt":"2023-09-05T07:39:05","guid":{"rendered":"https:\/\/compliancenow.eu\/?p=48989"},"modified":"2023-09-21T12:36:48","modified_gmt":"2023-09-21T12:36:48","slug":"mitigating-controls-in-sap","status":"publish","type":"post","link":"https:\/\/compliancenow.eu\/en\/blog\/mitigating-controls-in-sap\/","title":{"rendered":"Mitigating controls in SAP \u2013 The natural next step in the SoD process"},"content":{"rendered":"

While a Segregation of Duties (SoD) tool is a big and important step to take in order to mature your risk management processes in SAP, it will not be able to handle all risk in the organization. Some SoD risks and critical accesses will be accepted. To maintain full control of risks, organization\u2019s need to implement mitigating controls. While the SoD tool concentrates on determining your access permissions and whether they can be approved, the control functions as an audit mechanism to detect and avert errors after privileged access has been approved.<\/em><\/strong><\/p>\n

How does mitigating controls fit into the SoD process? <\/strong><\/h2>\n

When you introduce SoD in an SAP landscape, you have taken a huge step in maturing your risk management level. The organization now has advanced from only being covered by the ordinary access management in SAP. Based on the SAP dedicated risk library, the organization has gained transparency of who in the organization has a risk, and as the risks are now known, the risks can now be managed. The organization can reject accesses that result in SoD risks if they are not needed and\/or the employee is not to be trusted with the access. While the SoD tool is not a complete safety net that catches every possible risk in the organization, it does enable the organization to know who has a risk, and in addition someone has taken an active decision in consenting to whether the employee should have the risk-containing access. With transparency we can manage risks as we now know who has risks
\u2013 but there are still risks. <\/strong><\/p>\n\n\n

<\/div>\n\n\n\n
\n
\n<\/p>\n

So, even though you have taken a big step in maturing the risk management and preventing risks in the organization, we are still left with accepted risks. What is the logical next step then? How do we make sure that we still have full control of the organization\u2019s risk landscape when we know we have to accept a certain level of risk in order to keep the organization operational and effective? We need a process\/tool that takes over where the SoD tool leaves off.<\/p>\n<\/div>\n\n\n\n

\n
\"Mitigating<\/figure>\n<\/div>\n<\/div>\n\n\n

Establishing mitigating controls is the next natural step. Mitigating controls can exactly take over where SoD tools leaves off, in order for the organization maintaining full control over their risk exposure. Mitigating controls is a necessary process if you wish to avoid risk stemming from critical accesses, which cannot be segregated away via an SoD tool, as well as accepted SoD risks deemed necessary the employees ability to perform their functions. Where SoD tools act as a restriction to access that prevents risks, mitigating controls act as an audit process to investigate accepted risks and prevent potential oversights in the SoD process.<\/p>\n

ComplianceNow can help your organization with maturing your risk management processes with CN Internal controls.<\/p>\n

What is Internal Control from ComplianceNow<\/h2>\n

Internal Control is an SAP-integrated framework supporting the documentation and execution of your company\u2019s controls. Controls related to your SAP processes as well as controls relevant to other applications or even non-IT controls can be included in the scope.<\/p>\n

Internal Control digitalizes and optimizes your internal control process: \u00a0<\/p>\n