Rationale for rules in standard ruleset

Question

I'm reviewing the violations reported against out R/3 production system, and I'm struggling to understand why some of them, particularly in the "Basis" business process, are SoD violations. Is there a list or document somewhere that explains the thinking behind the standard rules and what issues they are trying to highlight. There are some rules I'm tempted to disable, but there's a nagging doubt in my mind that I might have missed something and disabling the rules would be a really bad idea! Obviously somebody, somewhere, thought all of these standard rules were right for them...
For example, we have some users that have transaction SE16 (display only) and transaction SM50. This trips over risk B009, but why? What am I missing?
Thanks,
Steve.

Answer 1

Thanks. Yes, I'm quite happy with the approach we're taking. Some of the default rules obviously don't apply to us and have been disabled. Some have needed fairly obvious changes before they are appropriate for us. Those rules have been copied, and the copies changed and the originals disabled - doing the same to affected functions where necessary. This gives us an easy audit trail. All of this has been done with the help of our internal auditors.
What we're left with now are rules that our users are triggering, but we don't understand well enough to know why. I like to think I have quite a devious mind, and so if there's a possible exploit somewhere I can figure it out. But some of the standard rules I just don't understand at all. Somebody, somewhere, must have thought all these rules worth including in the standard ruleset, so there must be an exploit hiding in there somewhere. That's what makes me nervous about disabling the ones I don't understand. It would have been really nice if the people compiling the standard ruleset had kept, and published, notes about why each rule was there and what it was intended to detect, rather than letting each customer figure it out for themselves. Yes, we're all different and need a different customised ruleset, but that doesn't mean we don't need to know what the standard rules are there for. We need to understand the starting point before we can be sure about what we get when we customise it.
Sorry. Rant over...!
Steve.