Audit Question - Access to SU01

Question

I have a question in regards to access to SU01.  We currently have a team to setup users and assign roles.  We are SOx regulated and have been questioned about having individual having this access.
Does it make sense to have one user setting up the ID without any authorizations assigned and then another person add the roles?  We have compliance calibrator installed and no issues from that, but I am aware sometimes it is a business process decision from our auditors.
To me this does not make sense to me at all.  Not sure if this would be the same for all our other applications either at this point including BW, IPC, XI, network access etc. etc. etc.

Answer 1

Chris,
This causes a lot of confusion and consternation across the industry. Having been on both sides of the fence from an audit perspective, I tend to take a pragmatic approach.
The key issue is about being able to amend roles and assign to users. Wherever possible, this should be avoided. It is up to you how you manage that but if you have a situation whereby a single person can create a role / profile and assign it to a user they control, then you have a potential audit issue.
You can split it in any way you like but you are basically trying to stop that SoD.
Some choose to have a dedicated team who are able to create users but not create or assign authorisations, a separate team who can assign authorisations and not create users or roles and a third team who can only create roles but not create or assign to users.
While that is ideal, it is not always practical so it is often somewhere in the middle.
As long as your central team cannot amend the roles and authorisations that they are assigning (or assign super user access like SAP_ALL) without appropriate controls in place, then you can generally have a fairly reasonable discussion with your auditors.
Simon