Sensitive fields and dual control

Some BP fields can move money. The most important is the supplier's bank account. A fraudster who gets a supplier's bank details changed, often with a convincing email and a letter that appears to come from the supplier, can redirect real payments for weeks before anyone notices. This "payment diversion" fraud is common, and the defense is partly in SAP and partly in process.

Dual control in SAP

SAP lets you define sensitive fields for customers and suppliers in Customizing (for example, bank details, payment method or alternative payee). When a user changes a sensitive field, the account is blocked for payment until a second, authorized person confirms or rejects the change. The change is visible immediately, but money cannot flow on it until it is confirmed. Confirmation is done per account, in SAP GUI with transactions such as FK08 (confirm a single supplier) and FK09 (list of suppliers to confirm), and FD08/FD09 for customers; Fiori apps cover the same step in many releases. Reports list the changes awaiting confirmation.

The process around the system

The system enforces two people; it cannot judge whether the change is genuine. That is the process's job. Contoso's rules for bank changes: requests arrive only through the supplier portal or on a signed letter, never by email alone; the approver verifies by calling a contact from the existing record, not from the request; the person who changed the field cannot confirm it; and changes within 30 days of a large payment get a second verification. Authorization design must back this up: the clerk's role must not include confirmation, and nobody should hold both for the same accounts.

Change documents as evidence

Every BP change is recorded in change documents: which field, old value, new value, who and when. In the BP transaction and the Fiori master data apps you can display the change history for a record. Together with the confirmation record, this is the evidence auditors ask for and the first place to look when a payment went to the wrong account.

Customers have sensitive fields too. A changed customer bank account matters for direct debits and refunds, and a changed alternative payer or payment method can redirect money in subtler ways. Contoso defined bank details, payment methods and alternative payee or payer as sensitive for both customers and suppliers, after the finance team walked through which fields could cause money to move to the wrong place. The list is reviewed whenever new payment methods are introduced.