What is the SAP IT Audit Risk with development objects?
The custom programs and table can make changes to the system, so it is required that the custom development objects are properly managed and documented. If left unmanaged there will be numerous custom objects in the system without proper documentation. This is like leaving the dog loose in the house and you will be pushed to the corner
The custom programs and table can make changes to the system, so it is required that the custom development objects are properly managed and documented. If left unmanaged there will be numerous custom objects in the system without proper documentation. This is like leaving the dog loose in the house and you will be pushed to the corner
The only way to display data in these custom programs in with transaction SE38/ SA38 (Program Execution) and custom table is with (SE11, SE16, SE17, SE16N) transactions. But once you assign these transactions to the user the user is free to look at any table unless there are object restrictions. Typically in most of the clients the end users will be only interact with handful of custom objects. So it is like giving the user access entire public library when he just needs few books.
The only way to display data in these custom programs in with transaction SE38/ SA38 (Program Execution) and custom table is with (SE11, SE16, SE17, SE16N) transactions. But once you assign these transactions to the user the user is free to look at any table unless there are object restrictions. Typically in most of the clients the end users will be only interact with handful of custom objects. So it is like giving the user access entire public library when he just needs few books.
The custom objects created in the system can have sensitive data or just display data. But these objects have to be properly secured. For securing the custom objects following process has to be followed
The custom objects created in the system can have sensitive data or just display data. But these objects have to be properly secured. For securing the custom objects following process has to be followed
Created the custom programs or tables with proper naming convention. For example if the object belongs to finance team and accounts payable sub team. Then the object should include abbreviations of finance team and accounts payable sub team in the naming convention.
Assign the custom object to an authorization group which indicates its functional team, sub team and the sensitivity of the data contained in the custom object
Then create a custom transaction to linking the object. This way the user can use the custom transaction for executing the transaction
Perform a trace analysis for the newly created transaction to identify the authorization objects required
Perform a trace analysis for the newly created transaction to identify the authorization objects required
The internal audit team and the company can have complete control of custom objects in the system
Since the custom object are assigned transactions the training and testing can be focused on the transaction
Since the custom object are assigned transactions the training and testing can be focused on the transaction
Assigning data browser and program execution transaction to the user will cause performance issues. As the user will be able to execute data with wide open selection criteria
Tracking the transaction usage will easier
It is possible to give emergency access to only particular transaction
It is possible to give emergency access to only particular transaction
Looking to find the a solution for SAP Audit, then visit www.AuditBots.com to find the best advice on SAP Risk for you.ducts send a email for demo.http://auditbots.com/