Sap GRC
Sap GRC
A001 High Unauthorized maintenance of planning model and version may AO02
adversely impact the production planning data stored in APO.
This transaction should be limited to selected demand planning
super user or manager.
A002 High Unauthorized deletion of active planning version may adversely AO03
impact the production planning data stored in APO. This
transaction should be limited to selected demand planning super
user or manager.
A003 High Unauthorized maintenance of planning model and version may AO04
adversely impact the production planning data stored in APO.
This transaction should be limited to selected demand planning
super user or manager.
A008 High Access to maintain macros/rules should be controlled via change AO09
management process. Unsupported or incorrect adjustments are
made to the macros/rules may result in inaccurate production
planning and production scheduling.
B002 High A developer could modify an existing program in production, BS02
perform traces to the program and configure the production
environment to limit monitoring of the program run by increasing
alarm thresholds and eliminating audit trails through external OS
comma
B004 High A developer could create or modify a program in production and BS02
force the transport of these changes after the fact to conceal
irregular development practices. This also enables the reverting
back to the program's original version without any trace of the
changes made in production.
B006 High A developer could modify program components (menus, screen BS04
layout, messages, queries) and configure the production
environment to limit monitoring of the program runs using the
modified program components by increasing alarm thresholds
and eliminating audit trail
B008 High A developer could modify program components (menus, screen BS04
layout, messages, queries) and force the transport of these
changes after the fact to conceal irregular development
practices. This also enables the reverting back to the program
components origin
B009 High An individual could modify data in tables or modify valid BS03
configuration values and setup the production environment to run
transactions and programs using the inappropriately modified
data. This could affect data integrity, system performance, and
proper
B010 High An individual could modify data in tables or change valid BS03
configuration and replicate these changes to other clients. This is
particularly sensitive if client administration transactions come
with client-independent authorization allowing the developer to
B011 High An individual could inappropriately modify roles and assignments BS10
and reflect this change to the production's mirror copy eliminating
the chance to revert to the appropriate setup.
D008 High User can create a fictitious business partner and then process CR07
billing in CRM for that partner.
D009 High User can create a fictitious business partner and then process AR05
billing in R3 for that partner.
D010 High Inappropriately accept or confirm a service order and generate a CR06
corresponding billing document in CRM for the order.
D011 High Inappropriately accept or confirm a service order and generate a CR06
corresponding billing document in R3 for the order.
D013 High User could create a fictitious credit memo and run billing due in CR08
CRM to prompt a payment to a customer. The customer could
provide a kickback to the internal user.
D014 High User could create a fictitious credit memo and run billing due in CR08
R3 to prompt a payment to a customer. The customer could
provide a kickback to the internal user.
D015 High Pricing conditions could be manipulated to provide inappropriate AR07
discounts or incentives to customers which will be realized in an
incorrect invoice.
D016 High A user could enter a sales order in CRM and lower prices via CR04
conditions for fraudulent gain
D017 High Commission or Incentives may be paid based on the number of CR02
qualified leads. Inappropriately qualified leads could result in
fraudulent commission payments.
D018 High Commission or Incentives may be paid based on the number of CR05
service orders. Fraudulent orders could be entered to achieve
higher sales for commissions.
D019 High Commission or Incentives may be paid based on the number of CR04
sales orders. Fraudulent orders could be entered to achieve
higher sales reporting for commissions.
E001 High Maintain a fictitious vendor and enter an invoice to be included in SR01
the automatic payment run
E002 High Purchase unauthorized items and prompt the payment by SR02
invoicing
E003 High Enter fictitious orders for personal use and accept the goods or SR02
services through goods receipt or service acceptance
E004 High Enter fictitious invoices and accept goods or services via goods SR03
receipt or service acceptance
E005 High Maintain a fictitious vendor and initiate purchases to that vendor. SR01
E010 High A user can hide differences between bank payments and posted FI03
AP records.
E011 High Accept goods via SRM goods receipts and perform a WM SR06
physical inventory adjustment afterwards.
E012 High Accept goods via SRM goods receipts and perform IM physical SR06
inventory adjustment afterwards.
E013 High Accept goods via SRM goods receipts and perform IM physical SR06
inventory adjustment afterwards using powerful IM transactions
E014 High Enter fictitious orders for personal use and access the goods or SR02
services through goods receipt
E015 High Enter fictitious orders for personal use and access the goods or SR02
services through service acceptance
E019 High Approve the purchase of unauthorized goods and hide the SR07
misuse of inventory by not fully receiving the order in R3
E020 High Where release strategies are utilized, the same user should not SR02
maintain the purchase order and release or approve it.
E021 High Create a fictitious vendor or change existing vendor master data SR01
and approve purchases to this vendor
E022 High Enter fictitious orders for personal use and manipulate the SR02
organizational structure to bypass approvals
E023 High Create or maintain fictitious vendor and manipulate the SR01
organizational structure to bypass approvals or secondary
checks
E024 High Initiate purchases to selecting goods to be included in a SR08
shopping cart then approving the purchase
F005 High Create a non bona-fide bank account and create a check from it. FI04
F006 High Pay an invoice and hide it in an asset that would be depreciated FA01
over time.
F007 High Create an invoice through ERS goods receipt and hide it in an FA01
asset that would be depreciated over time.
F008 High Allows differences between cash deposited and cash collections AR02
posted to be covered up
F013 High Create the asset and manipulate the receipt of the associated FA02
asset.
F014 High Post overhead expenses to the project and settle the project PS02
without going through the settlement approval process.
F015 High Use a fictitious project to allocate overages of an actual project, PS01
and settle the project without going through the settlement
approval process.
F016 High Manipulate the work breakdown structure elements (profit PS01
centers, business areas, cost centers, plants) and post overhead
expenses to the project
F017 High Maintain a non bona-fide bank account and divert incoming FI04
payments to it.
F025 High Create a non bona-fide bank account and create manual checks FI04
from it
F027 High Users can create a fictitious trade and fraudulently confirm or FI08
exercise the trade
G001 High AP/AR/GL master data creation and posting functions in EC01
conjunction with payment processing, receipt of money, GL
account access; and the ability to modify ECCS hierarchy and
reporting output
G002 High AP/AR/GL master data creation and posting functions in EC01
conjunction with payment processing, receipt of money, GL
account access; and the ability to modify ECCS hierarchy and
reporting output
G003 High AP/AR/GL master data creation and posting functions in EC01
conjunction with payment processing, receipt of money, GL
account access; and the ability to modify ECCS hierarchy and
reporting output
G004 High AP/AR/GL master data creation and posting functions in EC01
conjunction with payment processing, receipt of money, GL
account access; and the ability to modify ECCS hierarchy and
reporting output
G005 High AP/AR/GL master data creation and posting functions in EC01
conjunction with payment processing, receipt of money, GL
account access; and the ability to modify ECCS hierarchy and
reporting output
G006 High AP/AR/GL master data creation and posting functions in EC01
conjunction with payment processing, receipt of money, GL
account access; and the ability to modify ECCS hierarchy and
reporting output
G007 High AP/AR/GL master data creation and posting functions in EC01
conjunction with payment processing, receipt of money, GL
account access; and the ability to modify ECCS hierarchy and
reporting output
G008 High AP/AR/GL master data creation and posting functions in EC01
conjunction with payment processing, receipt of money, GL
account access; and the ability to modify ECCS hierarchy and
reporting output
G009 High AP/AR/GL master data creation and posting functions in EC01
conjunction with payment processing, receipt of money, GL
account access; and the ability to modify ECCS hierarchy and
reporting output
G010 High AP/AR/GL master data creation and posting functions in EC01
conjunction with payment processing, receipt of money, GL
account access; and the ability to modify ECCS hierarchy and
reporting output
G011 High AP/AR/GL master data creation and posting functions in EC01
conjunction with payment processing, receipt of money, GL
account access; and the ability to modify ECCS hierarchy and
reporting output
G012 High AP/AR/GL master data creation and posting functions in EC01
conjunction with payment processing, receipt of money, GL
account access; and the ability to modify ECCS hierarchy and
reporting output
G013 High AP/AR/GL master data creation and posting functions in EC01
conjunction with payment processing, receipt of money, GL
account access; and the ability to modify ECCS hierarchy and
reporting output
G014 High AP/AR/GL master data creation and posting functions in EC01
conjunction with payment processing, receipt of money, GL
account access; and the ability to modify ECCS hierarchy and
reporting output
H001 High Modify payroll master data and then process payroll. Potential for HR03
fraudulent activity.
H002 High Change employee HR Benefits then process payroll without HR01
authorization. Potential for fraudulent activity.
H003 High Change to master data and creating the remittance could result PY07
in fraudulent payments.
H004 High Change payroll master data and enter time data applied to HR04
incorrect settings.
H005 High Modify time data and process payroll resulting in fraudulent HR04
payments
H006 High Change configuration of payroll then process payroll resulting in PY02
fraudulent payments
H007 High Change configuration of payroll then modify payroll master data HR03
resulting in fraudulent payments
H008 High Change payroll master data and modify PD Structure HR05
H009 High Enter false time data and perform payroll maintenance. HR04
H010 High Change payroll and process payroll without proper authorization. PY03
H013 High Enter false time data and maintain PD structure HR04
H014 High Users may enter false time data and process payroll resulting in HR03
fraudulent payments.
H015 High Users may maintain employee master data including pay rates HR03
and delete the payroll result
H016 High Users may enter false time data and perform work schedule PY06
evaluations
M006 High Accept goods via goods receipts and perform a WM physical MM04
inventory adjustment afterwards.
M011 High Accept goods via goods receipts and perform an IM physical MM04
inventory adjustment afterwards.
M012 High Accept goods via goods receipts and perform an IM physical MM04
inventory adjustment afterwards.
P001 High Maintain a fictitious vendor and enter a Vendor invoice for PR01
automatic payment
P002 High Maintain a fictitious vendor and create a payment to that vendor AP01
P003 High Enter fictitious vendor invoices and then render payment to the AP02
vendor
P004 High Purchase unauthorized items and initiate payment by invoicing PR02
P005 High Enter fictitious purchase orders for personal use and accept the PR02
goods through goods receipt
P006 High Enter fictitious vendor invoices and accept the goods via goods AP02
receipt
P007 High Enter a fictitious purchase order and enter the covering payment PR02
P008 High Create a fictitious vendor and initiate purchases to that vendor PR01
P011 High Inappropriately procure an item and manipulating the IM physical PR02
inventory counts to hide.
P014 High Can hide differences between bank payments & posted AP FI03
records
P016 High Receive or accept services and enter the covering payments PR08
P019 High Approve the purchase of unauthorized goods and hide the PR04
misuse of inventory by not fully receiving the order
P020 High Commit the company to fraudulent purchase contracts and PR04
initiate payment for unauthorized goods and services.
P021 High Release a non bona-fide purchase order and initiate payment for PR04
the order by entering invoices
P022 High Release a non bona-fide purchase order and the action remain PR04
undetected by manipulating the IM physical inventory counts
P023 High Create a fictitious vendor or change existing vendor master data PR04
and approve purchases to this vendor
P026 High Enter fictitious purchasing agreements and then render payment AP01
P027 High Risk of entry of fictitious Purchasing Agreements and the entry of PR01
fictitious Vendor or modification of existing Vendor especially
account data.
P028 High Modify purchasing agreements and then receive goods for PR05
fraudulent purposes.
P029 High Enter unauthorized items to a purchasing agreement and create AP02
an invoice to obtain those items for personal use
P030 High Risk of modifying service master data (to add a service that is AP01
normally not ordered by the company) and the entry of covering
payments
P038 High Risk of entering unauthorized payments and reconcile with the AP01
bank through the same person.
P045 High Inappropriately procure an item and manipulating the IM physical PR02
inventory counts to hide.
P046 High Inappropriately procure an item and manipulating the WM PR02
physical inventory counts to hide.
P047 High Release a non bona-fide purchase order and the action remain PR04
undetected by manipulating the IM physical inventory counts
P048 High Release a non bona-fide purchase order and the action remain PR04
undetected by manipulating the WM physical inventory counts
P051 High Maintain a fictitious vendor and create a payment to that vendor AP04
P052 High Enter fictitious vendor invoices and then render payment to the AP02
vendor
P053 High Enter a fictitious purchase order and enter the covering payment PR02
P054 High Receive or accept services and manually enter the covering PR08
check payments
P055 High Commit the company to fraudulent purchases and initiate PR04
manual check payments for unauthorized goods and services.
P056 High Enter fictitious purchasing agreements and then render manual AP04
checks for payment
P057 High Risk of modifying service master data (to add a service that is AP04
normally not ordered by the company) and the entry of covering
payments
P058 High Risk of entering unauthorized manual payments and reconcile AP04
with the bank through the same person.
P059 High Where release strategies are utilized, the same user should not PR02
maintain the purchase order and release or approve it.
S001 High Enter or modify sales documents and approve customer credit AR04
limits
S002 High Create sales documents and immediately clear customer's SD05
obligation
S003 High Create a fictitious customer and initiate fraudulent sales SD05
document
S004 High Make an unauthorized change to the master record (payment SD01
terms, tolerance level) in favor of the customer and enter an
inappropriate invoice.
S005 High Inappropriately create or change rebate agreements and manage SD01
a customer's master record in the favor of the customer. Could
also change a customer's master record to direct payment to an
inappropriate location.
S006 High Potentially clear a customer's balance before and create or make AR03
the same change to the billing document for the same customer,
clearing them of their obligation.
S007 High Inappropriately create or change a sales documents and SD05
generate a corresponding billing document for it.
S008 High Manipulate the user's credit limit and assign generous rebates to AR04
execute a marginal customer's order.
S010 High Create a billing document for a customer and inappropriately AR02
post a payment from the same customer to conceal non-
payment.
S011 High Create a fictitious customer and initiate payment to the SD01
unauthorized customer.
S012 High Initiate an unauthorized payment to the customer by entering AR06
fictitious credit memos.
S013 High Change the accounts receivable records to cover differences AR02
with customer statements.
S014 High Cover up unauthorized shipment by creating a fictitious sales SD05
documents
S015 High Sales price modifications for sales invoicing. AR07
S016 High Enter sales documents and lower prices for fraudulent gain SD05
S017 High Perform credit approval function and modify cash received for AR04
fraudulent purposes.
S018 High Enter a fictitious sales rebates and then render fictitious AR02
payments.
S019 High Risk of the same person entering changes to the Customer AR02
Master file and modifying the Cash Received for the customer.
S022 High Risk of modifying and entering Sales Invoices and approving AR07
Credit Limits by the same person.
S023 High Risk of Sales Price modifications for Sales invoicing. AR05
S024 High Maintain a customer master record and post a fraudulent SD01
payment against it
S025 High User can create a fictitious customer and then issue invoices to SD01
the customer.
S026 High User can create/change an invoice and enter/change payments AR02
against the invoice.
S027 High User can create fictitious/incorrect delivery and enter payments SD02
against these, potentially misappropriating goods.
S028 High User able to create a fraudulent sales contract to include SD05
additional goods and enter an incorrect customer invoice to hide
the deception.
S029 High Create a credit memo then clear the customer to prompt a AR03
payment.
Function 1 Tc Function 2 Tc Function 3
APO Maintain Model AO01 APO Supply & Demand
Planning