Lesson 1 of 5
Control types
10 min
A control is anything that makes a process more likely to produce the right result and less likely to produce the wrong one. Process owners own the controls in their processes, even when IT configures them and internal audit tests them. This lesson gives you the vocabulary auditors use, with SAP examples for each term.
Why controls matter in an SAP program
Many companies follow the COSO Internal Control - Integrated Framework, which organizes internal control into five components: control environment, risk assessment, control activities, information and communication, and monitoring activities. US-listed companies must also report on internal control over financial reporting under the Sarbanes-Oxley Act, and their external auditors test it. An ERP migration replaces the system in which most of those controls run, so every in-scope control has to be re-designed, re-tested and re-evidenced. That makes control work part of the process owner's sign-off, not a separate audit exercise.
Three types by how they run
| Type | What it is | Contoso SAP example |
|---|---|---|
| Automated (application) control | The system enforces it every time, with no human judgment. | Supplier invoice verification blocks an invoice for payment when the price exceeds the PO price beyond the configured tolerance. |
| IT-dependent manual control | A person performs it, but relies on system output being complete and accurate. | Dan reviews the monthly list of blocked invoices released for payment and investigates any released without a buyer's approval note. |
| Manual control | A person performs it without relying on system output. | The plant controller physically counts a sample of rotors CMC-RTR-200 in storage location 171A and compares with the count sheet. |
Control types by how they are performed.
Automated controls are attractive because they run consistently and are cheap to operate. But they depend on IT general controls (ITGCs): who can change the configuration, how changes are tested and transported, and who has access. If anyone can change the tolerance settings in production without approval, the automated control cannot be relied on.
Two types by when they act
| Preventive | Detective | |
|---|---|---|
| Purpose | Stops an error or fraud before it happens | Finds it after it happens so it can be corrected |
| SAP example (P2P) | Purchase order cannot be output until approved | Review of changes to supplier bank details |
| SAP example (O2C) | Credit check blocks an order above the limit | Review of credit memos above a threshold |
| SAP example (R2R) | Closed posting period rejects postings | Review of manual journal entries after close |
A balanced process has both. Preventive controls reduce volume of problems; detective controls catch what gets through and show whether the preventive ones are working.
Process owners do not need to classify every control themselves; internal control usually maintains that classification. What the process owner must know is which controls in their process are key, meaning the ones the company and its auditors rely on to prevent or detect a material error. Those are the controls that need the most care in design, testing and evidence.
Segregation of duties
Segregation of duties (SoD) means no single person can complete a sensitive transaction end to end. The classic example: one person should not be able to create a supplier, post its invoice and pay it. In SAP, SoD is implemented through authorizations in business roles. Many companies analyze SoD conflicts with SAP Access Control, part of SAP's governance, risk and compliance portfolio, and document and monitor controls with SAP Process Control. Whatever the tool, the process owner decides which combinations are unacceptable for their process.
What would you do?
Contoso's auditors ask whether the invoice price tolerance is an automated control they can rely on. What must also be true?
- Controls are automated, IT-dependent manual or manual; and preventive or detective.
- Automated controls depend on IT general controls over change and access.
- Segregation of duties prevents one person completing a sensitive transaction end to end.
- An ERP migration means re-designing, re-testing and re-evidencing in-scope controls.
Check your understanding · not graded
Lesson check
1. Which is an automated application control?
2. What is an IT-dependent manual control?
3. Why do automated controls depend on IT general controls?
4. Which is a detective control?