Why PR department can see invited vendor list for RFQ

Question

I found that PR department can see invited vendor list for RFQ in PR Document Status tab.  In my company, invited vendor list should be kept confidential and only authorized persons can access.   As PR authorizatin control is not down to PR creator, this information may be disclosed to other non-related persons wihtin same purhasing group.   In SAP,  I would like to know the rationale to let the PR department know the RFQ vendors.    Moerover, I want to understand the current industrial practice on treating RFQ vendor list information so that I can make recommendation for senior review.   Thanks in advance

Answer 1

Hi,
You issue well explained the 50% of solution. As you said importance for all organization to have secured and efficient authorization concept. Based on organizational structures and business processes an authorization matrix( is just working sheet) is very useful for to control all t.codes under Module / Business role specific.
For example:
Purchase Requisition (internal purchasing document) is a request by any department to purchasing department to supply material or provides service. Only here user(Mr.X) in department create PR(ME51N) and Department head (Mr.Y) release (ME54N)the Purchase Requisition(PR). For change PR , you can use Mr.X and you can have another User ID Mr.Z { Mr.X, Mr.Y & Mr.Z should not have access for RFQ or PO details}
Once Purchase Requisition released, then its responsibility purchasing organisation or respective purchasing group (buyer) , start work on determining source by sending Request for quotation(RFQ,ME41) to different vendors by Mr.A. Once all quotation received, you can maintain quotation in ME47 by user Mr.B. In vendor selection process, you can compare quotation in ME49 by user Mr.C.( also you can set approval process for Request for quotation ME45 by Mr.D) {Mr.A, Mr.B,Mr.C,Mr.D may have access on PR but no access on PO)
Once Vendor decided, user (Mr.E) can create Purchase Order (PO )and then it will be released by Mr.F, so then only PO print send to vendor. {Mr.E & Mr.F have access on PR & PO}
Likewise you should have different users for authorisation based on role in inventory management ( Mr. G can receive goods, Mr.H can have authorisation for Excises, Mr.J can have issuing goods)
For more check
http://help.sap.com/saphelp_nw04/helpdata/en/52/6714a9439b11d1896f0000e8322d00/content.htm
Regards,
Biju K