Authorization review process document

Question

Hi all,
  Our management wants to review authorization of all users yearly once.They are asking for a process document which will state all the process and procedures  to do the same.I have no clue how should I go about it.
  Can anybody please help with a document or something so that I can start preparing a "process document for annual authorization review".
Thanks,
Suman

Answer 1

Hello Chittranjan,
This is something for which you would need advise from your functional team. While doing auditing is a system adminsitrator or auditor's job the actual conceptual design of audit needs to be discussed with functional people as well.
First of all it depends on your business processes as well as on the modules of SAP which are in main use in your project.
Not only you need to check if the authorizations are vertically organized as also laterally.
Vertically means that a clerk in a department you should have restricted access for only what he is doing and a manager should have greater access.
Laterally means if your organization has mutiple sub units which can be identified with plants,company codes etc. then you need to make sure users belonging to one sub unit should have access for other sub unit/department.
Then also you need to the processes with in the organization.
There has to be a check on who creates master data and transactional data and who does not. Also check on customising authorizations needs to be in place. Similarily development authorizations also need to be brought under the ambit of the document.
The customising and development part is simple as it has to be restrcited to functional guys and developers respectively but master data and transactional data part is integrated with business proceeses. Also this is generally handled by end users.
You need to take advise from process owners also.
Regards.
Ruchit.