What is segregation of duties? Simply put, it is the separation between two or more tasks such that they cannot be performed by the same person.

... Read more

Most of us understand that risks in our business need to be proactively managed. We pragmatically do this by putting in measures either to stop the risks from taking place or to handle the impact of any risks materialising. When we do this, we are carrying out a control.... Read more

Controls are put in place in order to manage a risk. By putting a control in place, we can manage the impact of the risk, either by preventing it from taking place in the first place or to deal with the impact after it has taken place.

... Read more

First of all, don’t panic.
... Read more

In this blog post, we cover common questions we get from users of GRC Access Control who are involved in the management of access requests. These users may be GRC officers, approvers, reviewers, or those in similar roles, and they take part in the process which assesses and helps end-users get access to other SAP system (for example S/4 HANA or BW).... Read more

In our other blog posts, we have talked about the disconnect between IT and business when it comes to working with SAP. Perhaps nowhere is it more visible than when we talk about SAP authorisations. Even for technical professionals, the SAP authorisation concept can be challenging to fully understand. The problem would be magnified for business stakeholders who need to be involved in the management of SAP access.... Read more

In this blog, we aim to introduce readers to the technical world of SAP authorisations. This blog is intended for business stakeholders who are involved in the management of access in SAP. These include people who are involved in requesting or approving new SAP access, signing off SAP access reviews, or anyone whose responsibility intersects with access management in SAP.... Read more

In our previous blog posts, we have talked about SAP authorisations and the principles of role building.

... Read more

In our blog post about the principles of role building, we talk about the SAP way of role-building, which is to use the Profile Generator (PFCG) and its automatic functionality.... Read more

Having spent years working in the area of SAP authorisations, we realise that there is often a (wide) gap between the business (who need the access) and IT (who need to maintain and provision access to these users).... Read more