The SAP GRC SOX compliance checklist

It’s been about 19 years since the passage of the Sarbanes-Oxley Act (SOX), enacted in the wake of corporate accounting scandals at Enron and WorldCom. The goal of SOX was to make publicly traded companies more accountable for the accuracy and integrity of their financial reporting. As a result, in the last nearly two decades, SOX has had a major impact on the way companies handle their governance, risk management and compliance (GRC) duties.

Considering the central role of SAP systems in accounting, SAP GRC controls are essential when evaluating your SOX compliance checklist.

Background first: what is SOX compliance?

The Sarbanes-Oxley law has many elements. Two sections are most relevant to IT, finance and GRC professionals.

• Section 302 states that the CEO and CFO are directly responsible for ensuring that financial reports (e.g., the 10Q and 10K) are accurate and well -documented. It also holds that these executives are responsible for the company’s internal control structure.
• Section 404 takes this further, obligating the company to assert it has adequate internal controls in place, and that they are operational and effective. Registered external auditors must then attest to the accuracy of management’s assertion.

To comply, you need to understand how transactions flow through your SAP landscape, calculate risks of fraud and error, put in necessary controls, and evaluate and report on the effectiveness of those controls. Whether this is a Herculean task or a trivial one depends on your SAP SOX compliance checklist, and the SAP GRC software you use to implement it.

SOX internal controls

An internal control is a rule or process (or combination of them) that is intended to prevent or detect actions that might affect the integrity of financial transactions. A simple example is the lock you see on a cash register, preventing unauthorized people from stealing from the till.

Controls in SOX are comparable, but much more sophisticated – running the gamut from basic accounting practices, such as bank account reconciliation, to IT controls, such as running regular system backups. Internal controls fall into two categories:

• A detective control detects if there is fraud or mistakes affecting reporting.
• A preventive control stops someone from committing fraud or making an error that would negatively impact accuracy of business operations.

The SOX compliance audit

The SOX audit is primarily involved with Section 404, and the process starts before external auditors arrive. Whoever is assigned to SOX compliance creates a list of internal controls (usually getting suggestions from the auditor beforehand). They go through the controls themselves first – checking them before the auditor gets to work. If the company has gone through SOX before, they typically update the previous year’s controls list and go from there.

The audit of internal controls looks at four main categories. These encompass all of a company’s IT assets, including:

• Access (both physical and virtual)
• Security
• Change management
• Backup procedures

The auditor also takes a careful look at the company’s segregation of duties (SoD) controls.

The SOX audit and overall compliance process are no longer manual affairs. Software, such as ControlPanelGRC, can quickly identify and mitigate risk, and automate audit readiness.

The SAP SOX compliance checklist:

Your checklist should address these areas:

1. Segregation of SOX compliance duties

Allowing a single user to create and pay a vendor, or order and receive inventory, increases the risk of fraud and embezzlement. SoD controls prevent users from obtaining multiple, incompatible roles. ControlPanelGRC Access Control contains a complete set of tools to automate the SoD tasks in your SAP SOX compliance checklist.

• The SoD Risk Analyzer module contains customizable SoD rules, as well as compliance monitoring and remediation controls to quickly identify and correct SoD conflicts.
• This works with the SAP User Provisioning and Role Management module, enabling your security admins to quickly provision new user assignments or positions without risking SAP SOX Compliance.

2. SAP GRC compliance monitoring

There are two choices for monitoring compliance: manually reviewing records for inconsistencies or implementing automation for SOX compliance in SAP. An SAP GRC solution will look for warning signs that could indicate fraud or missing controls, and report on them in real time. Manual reviewers will take months to sample a fraction of your records with far less accuracy.

3. Safeguard SOX audit trails against emergency access

SAP landscapes create a permanent, automated record of every transaction as it happens. Anytime someone creates a vendor, files a purchase order, or changes a customer record, it’s recorded in a tamper-proof system. The problem occurs when there’s an emergency, and generic firefighter IDs are used. This allows a consultant to go in and fix whatever has broken using a generic firefighter log, but it poses risks. It’s very difficult to track changes made by generic firefighters and compare them to the consultant’s regular ID.

It can go unnoticed if, for example, a consultant creates a vendor with a firefighter ID and then cuts a PO to the vendor with their regular ID. With this in mind, generic firefighters can make changes that harm the system, violate compliance rules or compromise audit trails. An SAP GRC solution like ControlPanelGRC can provide firefighter access without using generic logons and hold firefighters accountable for any changes they make.

4. Automate SAP audit reporting

SAP GRC software can eliminate the arduous task of hunting down and compiling data for auditors. ControlPanelGRC’s SAP Audit Management with AutoAuditor automatically executes reports and routes them for review based on your organization’s requirements. It integrates with your other SAP GRC modules, delivering a complete report for internal review or external audits. That integration facilitates remediation, allowing you to act on auditor findings immediately.

5. SOX compliance checklist for database

The SAP transaction data that underpins your financial reports should receive attention in the SOX compliance process. SOX Section 302.2 dictates, ‘Establish safeguards to prevent data tampering.’ You’ll be audited to determine whether you’re meeting this criterion. The best practice is to implement GRC software for SAP that tracks user log-in access to any endpoint in the SAP landscape that has access to sensitive data. Section 302.4 adds to this, requiring that you ‘establish verifiable controls to track data access.’

6. An SAP SOX compliance checklist and solution in one

ControlPanelGRC automates every step of the SAP GRC SOX compliance process. It provides risk evaluation, real-time monitoring, and effortless reporting and risk remediation. Contact us for a free SAP GRC risk assessment to learn how your organization can remediate SoD risks and take the stress out of SAP SOX compliance.