Use of Role Based AIS for Technical System Auditing at DuPont Chris Leeder DuPont Chris Carr SAP Session: 509

Introduction DuPont Company Overview DSAP Project Overview DSAP Architecture AIS Background Role Based AIS Benefits and Next Steps

The DuPont Company Based in Wilmington, Delaware: operates in more than 70 countries 2002 Sales were $24 Billion Total Assets are $35 Billion 79,000 Employees, about half are outside of the United States 200+ years Consists of 5 business platforms Agriculture & Nutrition Coatings & Color Technology Electronic & Communication Technologies Performance Materials Safety & Protection

What is DSAP? The Organization put in place to successfully complete the SAP implementation and eventually support the application run activities.

Discovery & Evaluation DSAP Leverages ASAP Discovery & Evaluation 1 Project Preparation 2 Business Blueprint 3 4 5 Realization Final Preparation Go Live & Support Deliverables: ……… ………… ………………. QC Prepare Execute Next Phase Plan Train Kickoff Monitor progress against deliverables

DSAP Architecture

KPMG Deutsche Treuhand-Gesellschaft AIS Background Created by an SAP user group for internal and eternal auditors. Auditing firms provided the initiative for creating audit-supporting tools for the R/3 environment. Arthur Andersen Bansbach Schübel Brösztl & Partner KPMG Deutsche Treuhand-Gesellschaft Price Waterhouse Coopers Ernst & Young Deutsche Allgemeine Treuhand AG SAP User Groups Internal auditors from various companies

A I S AIS Overview AIS is the Toolbox for . . . Internal Auditors External Auditors System Auditors Data Security Officers

AIS Overview SAP System Audit Business Audit G/L IS Audit IS Development Audit IS Customer IS User/Security Vendor IS System Admin Assets IS Security guide ----------- SAP Audit guideline ---------- User group BC940 AC900 BC680

Frequently asked questions AIS Overview Information retrieval using Existing R/3 programs Checklist for system audit FAQ Frequently asked questions Who is permitted to ...?

Why AIS ? To ensure compliance with project standards created by DSAP for: System Administration Design and Configuration Security and Controls Monitor Progress against deliverables

Role Based AIS The role based AIS “Audit Information System” consists of several single end user roles.   In order to work with the AIS, the auditor needs a user in the SAP System with the relevant single roles assigned to his user master record. Note: The menus do not have authorization values. The authorization roles contain authorization values but no menu.

Role Based AIS Until SAP Release 4.6C, AIS was realized using a menu technique (transaction SECR). As of SAP Release 4.6, AIS is part of the SAP Standard System As of SAP Release 4.6C (Support Package SAPKH46C27), the technical implementation of AIS in the program has been changed to a role-based maintenance environment (transaction PFCG). Additional development of AIS will only be carried out in this new environment.

Role Based AIS A I S SAP Auditor To facilitate working with the AIS, the auditor needs a user in the SAP System. This user master record requires a wide range of display authorizations. Several single roles have been defined for the AIS. These single roles are divided into two groups: Transaction roles (SAP_AUDITOR*) Authorization roles (SAP_CA_AUDITOR*) Installation recommendation: SAP Note 0 451 960 Auditor SAP

Role Based AIS The authorization roles required for these menus are documented in PFCG. (Pull up the menu role and read the info in the description tab)  

Role Based AIS AIS – Single roles Copy / Modification . . . SAP_AUDITOR_ADMIN SAP_AUDITOR_BA_ORGA Y_AUDITOR_BA_ORGA SAP_AUDITOR_BA_FI_GL Y_AUDITOR_BA_FI_GL SAP_AUDITOR_BA_FI_AA SAP_AUDITOR_BA_FI_AR Y_AUDITOR_BA_FI_AR SAP_AUDITOR_BA_FI_AP Y_AUDITOR_BA_FI_AP . . . SAP_CA_AUDITOR_APPL_ADMIN SAP_CA_AUDITOR_SYSTEM Y_CA_AUDITOR_SYSTEM SAP_CA_AUDITOR_HR SAP_CA_AUDITOR_APPL

Role Based AIS

Data Collection Strategy using MS Excel: Role Based AIS - Data Collection Data Collection Strategy using MS Excel: The transaction roles contain a menu tree, from which the data collection XLS worksheets will be derived. This menu will occupy the leftmost column of the spreadsheet and will be a copy of the AIS menu being executed in the SAP system.   Example: Run menu item, report or transaction ,check against inputs column, then record results in the Results/Observations column on the data collection worksheet.

Role Based AIS - Data Collection Worksheets

The following sources are used for reference: Role Based AIS- Supporting Documentation Reference(s): The following sources are used for reference: 1-DSAP- Documentation, and Position Papers 2-SAP Security Guide and Checklist 3-AIS System Audit Guide 4-SAP Online Service System (OSS)  

Role Based AIS- Summary The auditor will execute the transactions in the SAP provided role based AIS menus, and compare findings with the standards defined in the "inputs" field on the data collection spreadsheet.   Additional documents such as the output list of a report or transaction are saved on a network directory or a lotus notes database.

Role Based AIS –Benefits The use of role based AIS has provided benefits in the following areas Standardized audit format Easy to create and maintain security access/privileges for audit team Shorter audit time frames with custom front end Ease of customization Preventative Maintenance Identify gaps across systems via the data collection worksheets

Role Based AIS –Benefits , cont

Role Based AIS –Next Steps The repository auditor role will be used to review compliance with DSAP standards for development and maintenance of technical objects. The repository audit will focus on the following areas: Table Authorization Groups Table logging for critical tables Changes Repository Objects Repairs

Role Based AIS –Next Steps The Users and Authorizations auditor role will be used to review compliance with DSAP standards for development and maintenance of SAP users and security objects. The User and Authorization audit will focus on the following areas: Users and Authorizations Role Administration Central User Administration Security Profile Parameters

Role Based AIS –Next Steps Data Collection Worksheets in Lotus Notes: Shared Access to Audit Findings Links to Supporting Documentation Workflow Permanent record of audit results “Real time AIS” Collaboration

Role Based AIS - Next Steps SAP System Audit Business Audit G/L IS Audit IS Development IS Audit IS Customer IS User IS Vendor IS Assets IS Security guide ----------- SAP Audit guideline ---------- User group BC940 AC900 BC680

Thank you for attending! Please remember to complete and return your evaluation form following this session. Session Code: 509