What is the SAP IT Audit Risk with development objects?
SAP system is helpful in automating the company’s business processes and also improves the productivity of the employees. As part of the SAP system there are multiple tables and programs. These tables and programs are required to manipulate the data in the system. During the process of implementing the SAP system customers have the option of creating their own tables and programs in the system. These tables and programs have to start with Z or Y. These are called as custom development objects.
The only way to display data in these custom programs in with transaction SE38/ SA38 (Program Execution) and custom table is with (SE11, SE16, SE17, SE16N) transactions. But once you assign these transactions to the user the user is free to look at any table unless there are object restrictions. Typically in most of the clients the end users will be only interact with handful of custom objects. So it is like giving the user access entire public library when he just needs few books.
SAP system is helpful in automating the company’s business processes and also improves the productivity of the employees. As part of the SAP system there are multiple tables and programs. These tables and programs are required to manipulate the data in the system. During the process of implementing the SAP system customers have the option of creating their own tables and programs in the system. These tables and programs have to start with Z or Y. These are called as custom development objects.
The only way to display data in these custom programs in with transaction SE38/ SA38 (Program Execution) and custom table is with (SE11, SE16, SE17, SE16N) transactions. But once you assign these transactions to the user the user is free to look at any table unless there are object restrictions. Typically in most of the clients the end users will be only interact with handful of custom objects. So it is like giving the user access entire public library when he just needs few books.
The custom objects created in the system can have sensitive data or just display data. But these objects have to be properly secured. For securing the custom objects following process has to be followed
The custom objects created in the system can have sensitive data or just display data. But these objects have to be properly secured. For securing the custom objects following process has to be followed
Assign the custom object to an authorization group which indicates its functional team, sub team and the sensitivity of the data contained in the custom object
Then create a custom transaction to linking the object. This way the user can use the custom transaction for executing the transaction
For custom program also include authority check statement in the program so that the data can also further restricted.
Perform a trace analysis for the newly created transaction to identify the authorization objects required
Now update the SU24 settings in the transactions with authorization object found in your trace
The internal audit team and the company can have complete control of custom objects in the system
The internal audit team and the company can have complete control of custom objects in the system
Assigning data browser and program execution transaction to the user will cause performance issues. As the user will be able to execute data with wide open selection criteria
SAP Security errors can be reduced as objects needed for the transaction is automatically populated from the SU24 settings when the administrator creates the role
Tracking the transaction usage will easier
Tracking the transaction usage will easier
It is possible to give emergency access to only particular transaction
Looking to find the a solution for SAP Audit, then visit www.AuditBots.com to find the best advice on SAP Risk for you.