MIS 5121: Exam 3 – Review Sheet Edward Beaver Edward.Beaver@temple.edu ff

ISC framework in the ERP environment Other Reg’s Organization’s Objectives & Policies External Financial Reporting regulations Balance Sheet P & L Notes FDA etc. Performance & Policies Arise through Must be observed / achieved in Business Processes _____ ______ ______ ______ ___ _______ ___________ __________ ______ __ _____ _______ _ ________ __ … Contain Risks ___________ ___________ Assertions Value / Benefits Errors & Fraud Minimized by ISC framework in the ERP environment Entity level controls Automated application controls Manual and semi-automated business process controls Authorizations and access protection (confidentiality, integrity) IT General controls (change management, operation, security) Automated testing and monitoring of business processes, KPIs, etc.

Procurement at GBI Marketing / Sales Customers Suppliers Supply Chain Finance / HR Payment

Procure to Pay Process Common Risks Common Controls

Order to Cash at GBI Marketing / Sales Customers Suppliers Supply Chain Finance / HR

Order to Cash Process Common Risks Common Controls

Environment Favorable to Fraud Framework for spotting high-risk situations _________________________ (____________________ _________) _____________________ ________________________ (____________________ _________) ______________________ (____________________ _________) Fraud __________ ____________ ________ / _________ Fraud Triangle

Inventory: Record Accuracy Does ______________-- Match __________________ Check: _______________ Physical Counting Cycle Counting

Typical SAP Landscape Development System Type of Users: - Type of Work: Quality-Assurance System Type of Users: - Type of Work: Production System Type of Users: - Type of Work:

Client Dependent vs. Independent System/Instance Client Dependent Dev 100 Master (Gold) ________ Data Dev 110 Dev Test … …. Dev 180 Data Conversion … …. Dev 900 Sandbox … …. Client Independent _____________ > Repository Objects (Client Independent Config _____________ - _____________, _____________ _____________ - _____________ _____________ > _____________

SAP Change Management SAP Transports are: ____________________________________________ They Contain: _________________________________________________ SAP Change Management Recommendations Risk: _____________________________________________ Control: _____________________________________________

System (Server) / Client Parameters Risk: _____________________________________________ Control: _____________________________________________

Table Security Tables are Integral part of SAP Application Different Types of Tables _________________ SAP is customized using thousands of ____________ tables through the _________________ (SPRO) Class Exercise: SE16N - T000, T001, MARA, TDAT (Auth groups)

Table and Information Security Risk: _____________________________________________ Control: _____________________________________________

Program & Development Security Good Development Practices _________________________________________ Control Concerns: Development, Data Dictionary

Powerful ID’s and Profiles List few SAP Supplied Powerful ID’s and Profiles that need ‘caged’ _________________________________________ Risks and Control Recommendations for Powerful ID’s / Profiles Risk: _____________________________________________ Control: _____________________________________________

Firefighter / Emergency User Valid Scenarios, Situations for Firefighter Use _________________________________________ Key differences of Firefighter vs. Regular ECC access: Audit of reason and transactions used Emergency vs. routine use Firefighter Best Practices

GRC & Other SAP Module Security GRC (G___________, R____, & C__________________ Module Beyond ERP / ECC and GRC: What is another SAP module What is another SAP module: _________________________________________ What does the module do: _______________________________________ ______________________________________________________________ How is Security Administered: ____________________________________ ______________________________________________________________ GRC v 10.0 Module Function / Reason for Being

Segregation of Duties Goal: __________________ Definition ‘__________________________________’ Person who ______________ should not be the person who ______________ . An Individual should only have 1 of following Responsibilities / Privileges: A_____________ R_____________ C_____________

Finance Common Risks Common Controls

Inventory Control Common Risks Common Controls