Get in Touch
 Duration 16 hours

Course Outline

R/3 Fundamentals for Auditors

  • Foundational architecture concepts (ABAP stack, SAP GUI, and client structure).
  • Key distinctions from legacy systems, highlighting modular design (FI, MM, SD).
  • Navigation of classic transactions tailored for audit objectives.

Access Management, Roles, and Core SoD

  • User administration and authorization management via PFCG, SU01, SUIM, SU53, and SU24.
  • Role architecture and functions critical to audit processes.
  • Basic SoD matrices and common audit findings (e.g., conflicts where invoice creation and approval reside in a single role).

Security Logs and System Traces

  • Security Audit Log (SM19/SM20): setup, filtering techniques, and reporting methods.
  • STAD and ST03N: analyzing usage statistics, session data, and workload patterns.
  • Best practices for retaining and exporting evidence for compliance purposes.

Configuration Modifications and Sensitive Data

  • Utilizing SCU3 (change documents) and SCC4 (client settings) for monitoring.
  • Identification and oversight of critical system parameters (RZ10/RZ11).

Process Controls (FI/MM/SD) in R/3

  • FI: Managing tolerances, OB52 (posting periods), and journal entry approvals.
  • MM: Implementing release strategies, purchase order limits, and single supplier controls.
  • SD: Monitoring credit limits, pricing adjustments, and conditions.
  • Application of audit sampling techniques for rigorous process testing.

Comprehensive Laboratory Session + Reporting

  • Reviewing roles and authorizations for a critical user profile.
  • Tracking operations (purchases/sales) and gathering audit evidence using SM20/SCU3.
  • Documenting findings through screenshots and data exports.
  • Developing working papers and ensuring full traceability.

Closure and Action Planning

  • Developing an internal control checklist specific to R/3.
  • Prioritizing audit findings and formulating actionable recommendations.

Course Deliverables

  • A comprehensive checklist containing 20+ controls covering FI/MM/SD.
  • A quick-reference guide for SM19/SM20, SUIM, SCU3, and STAD/ST03N.

Requirements

  • A solid grasp of fundamental auditing principles
  • Prior experience interacting with SAP systems
  • Knowledge of standard compliance and control frameworks

Target Audience

  • Auditors
  • Internal control specialists
  • SAP security consultants
  • Compliance officers

Testimonials (2)

Related Categories