Organizations, with significant investments in the SAP R/3 and its implementation creates unique risk dynamics created by the interplay of the application, business processes and the supporting infrastructure.

Organizations implementing SAP R/3 have had to deal with several issues when assigning user authorization access rights to SAP transactions. Some of the issues organizations have had to deal with resulting in users on the SAP system having excessive access rights include :

• Definition of user access rights is left to the end of the implementation process, granting excessive access rights to users
• The defintion and assignment of rights to users is left to the implementors and the systems department.
• Only a few users understand how the controls work in SAP. As a result, SAP control features do not get implemented.
• Transaction level controls are often overlooked at the process design phase.
• With no controls framework in place, no one is sure what each user can actually do on the system.
• Once the problem of excessive rights has been understood, no one knows how to go about correcting the problem.

Our risk management solutions help organizations identify users with excessive access rights, provide all the information required for correcting the problem, assist in the development of a framework for user access rights administration and enable monitoring of all changes to user access rights.