Segregation of Duties and Access Risk Analysis

Keep this: job aid

SoD and access risk card

• SoD: no one person authorizes, records, holds and reconciles the same flow.
• Classic risks: supplier master plus invoice or payment; PO plus goods receipt or invoice; users or roles plus anything.
• Rule set: risk (type, process, level, owner), functions, actions (transactions and Fiori apps), permissions.
• Tailor for S/4HANA: business partner, Fiori apps, custom transactions; validate with a conflicting test role.
• Analyze roles before transport and users before assignment; group results by role combination.
• Remediate first: redesign role, remove assignment, split task.
• Mitigate only with an independent, frequent, evidenced control, approved by the risk owner, with validity.
• Test: negative SoD tests for top risks; clean mapping analysis as exit criterion.
• Operate: risk check on every access request; periodic reviews; check controls are performed.