![](bg2.png)
z SAP covers more business functions than any
other product on the market which adds to the
complexity of security and control issues.
z SAP is complex with thousands of configuration
tables and multitudes of alternatives.
z The integrated nature of SAP increases the risk
that design designs made for one SAP module
might have an unexpected adverse impact on
other modules.
There are few research papers regarding the ERP
or the SAP security control, according to the statistics
of “Enterprise Resource Planning System Research:
an Annotated Bibliography” (Esteves and Pastor,
2001). Moreover, most of the security related
research papers emphasis on the relationship between
database level security (Riet, R., Janssen, W., &
Gruitjer, P., 1998). So, this paper will propose a new
approach to conduct the security test in the SAP
system and will focus on the application level issues.
3 RESEARCH METHOD
The SAP security study is conducted in the system
environment of author’s company. Using IMG
(Implementation Guide) function in SAP the review
the financial related configurations in SOA related
components, such as Financial Accounting,
Controlling, Enterprise Consolidation. The system
architecture of this research is described as following
components:
z SAP version : R/3 Release 4.6C
z AIS version : 46D.1
z Database : Oracle 8.0.6.2.0
z OS : HP-UX 11.0
z Machine type : HP PA-RISC
3.1 Reset Company Code and Posted
Depreciation Test
Company code and Depreciation posting is the key
control point to ensure correctness of the financial
statements. If this configuration is misused, the
accounting entries will be deleted and the financial
reports could be wrong. It is an essential security
configuration to ensure the correctness of financial
statements. Therefore, this setting is the first step to
the financial data protection.
Menu path 1 - Reset Company Code: Financial
Accounting ∏ Assets Accounting ∏ Preparing for
Production startup ∏ Tools ∏ Reset Company Code.
Menu path 2 - Reset Posted Depreciation:
Financial Accounting ∏ Assets Accounting ∏
Preparing for Production startup ∏ Tools ∏ Reset
Posted Depreciation.
3.2 Create Asset Class Test
Asset Class controls asset master data and
depreciation calculation. The asset master data
includes assets classification, cost center, description,
capitalization information and related invoice, goods
receipt, and purchase order. The depreciation
calculation is composed by depreciation key,
depreciation method, depreciation start date and
depreciation area. If the asset class is modified or
created by non authorized persons, it will not only
bias the decision making of high level management
but also cause incorrect financial statements.
Menu Path 1 – Create Asset Class : Financial
Accounting ∏ Assets Accounting ∏ Asset Class ∏
Create Asset Class From GL (1 to 1).
3.3 Substitution and Validation Test
Substitution and Validation are powerful tool to
control mass data change in either financial data
posting or master data changes in customer, vender,
and fixed assets, etc. However, if these
configurations are misused, the financial data could
be seriously damaged and the all related transactions
should be reviewed or reposted.
Menu Path 1 – Define Substitution: Financial
Accounting ∏ Assets Accounting ∏ Master Data ∏
Define Substitution.
Menu Path 2 – Define Validation: Financial
Accounting ∏ Financial Accounting Global Setting
∏ Document ∏ Line Item ∏ Define Validation.
3.4 Delete Transaction Data Test
These three tests are related to production data
protection issue. The SAP system provides
production start-up tool for the system
implementation in Financial Accounting, Controlling,
and Enterprise Consolidation module for migration
data from testing to production environment.
However, this data cleansing function would also
damage production data if not proper controlled.
Menu Path 1 – Delete FI Transaction Data:
Financial Accounting ∏ Financial Accounting Global
Setting ∏ Delete Transaction Data.
Menu Path 2 – Delete CO Transaction Data:
Controlling ∏ General Controlling ∏ Production
Start-Up Preparation ∏ Delete Test Data ∏ Delete
Transaction Data.
Menu Path 3 – Delete Consolidation Transaction
Data: Financial Accounting ∏ Preparation for
Consolidation ∏ Tool for Creating the Initial Data
ICEIS 2004 - INFORMATION SYSTEMS ANALYSIS AND SPECIFICATION
582