7/22/2019 sapnote_0001600667

http://slidepdf.com/reader/full/sapnote0001600667 1/4

27.06.2013 Page 1 of 4

  SAP Note 1600667 - Transactions that conflict withthemselves

 Note Language: English Version: 3 Validity: Valid Since 09.06.2013

Summary

Symptom 

A transaction code is shown as conflicting with itself. This note provides

an explanation of why transaction codes may conflict with themselves.

Other terms

rule, action, permission, ruleset files, Risk Analysis and Remediation,

Access Risk Management, function, delivered rules, conflict, risk

Reason and Prerequisites

Certain SAP transactions allow users to perform multiple functions which

can be inherent segregation of duties risks.

Solution

In the SAP delivered ruleset, there are currently 15 transactions that

conflict with themselves. For some of these transactions, there are

security authorization objects that can be used to limit the transaction to

one function. For these transactions, the permissions enabled in the

functions they're included in are different. Therefore, for these, it is

possible to segregate in the system by setting the authorization objects

appropriately in order to remove the segregation of duties risk.

For other transactions, there is no way to limit the transactions through

authorization objects so that they can only perform one of the functions.For these transactions, there is no way via security to remove the

segregation of duties risk. In these cases, the only option is to apply a

mitigating control to the risk.

An example would be for risk F028 and transaction code F-02. A mitigating

control would be for someone to run a report of manual journal entries and

review periodically to determine whether any manual journal entries were

made inappropriately.

The exact transactions that conflict with each other are listed below:

o Risk BO19: Function BS13 - Maintain User Master and Function BS14

- Maintain Profiles / Roles

- PFCG - Permissions are different, can segregate by security

o Risk F027: Function FI08 - Create / Change Treasury Item and

Function FI09 - Confirm a Treasury Trade

- TM_65 - Permissions are different, can segregate by security

o Risk F028: Function AP02 - Process Vendor Invoices and FunctionGL01 - Post Journal Entry

7/22/2019 sapnote_0001600667

http://slidepdf.com/reader/full/sapnote0001600667 2/4

27.06.2013 Page 2 of 4

  SAP Note 1600667 - Transactions that conflict withthemselves

- ACACACT - Permissions are not different, mitigating control

required

- ACEREV - Permissions are not different, mitigating control

required

- F-02 - Permissions are not different, mitigating control

required

- FB01 - Permissions are not different, mitigating control

required

- FB01L - Permissions are not different, mitigating control

required

- FB02 - Permissions are not different, mitigating control

required

- FBRA - Permissions are not different, mitigating control

required

- FBV0 - Permissions are not different, mitigating control

required

o Risk F029: Function AR01 - AR Payments and Function GL01 - Post

Journal Entry

- F-04 - Permissions are not different, mitigating control

required

- FB05 - Permissions are not different, mitigating control

required

- FB05_OLD - Permissions are not different, mitigating control

required

o Risk F030: Function AR02 - Cash Application and GL01 - Post

Journal Entry

- F-04 - Permissions are not different, mitigating control

required

o Risk M012: Function MM03 - Enter Counts & Clear Diff - IM and

Function MM04 - Goods Movements

- MI10 - Permissions are not different, mitigating control

required

- MI40 - Permissions are not different, mitigating controlrequired

7/22/2019 sapnote_0001600667

http://slidepdf.com/reader/full/sapnote0001600667 3/4

27.06.2013 Page 3 of 4

  SAP Note 1600667 - Transactions that conflict withthemselves

o Risk SO20: Function SD04 - Sales Document Release and Function

SD05 - Sales Order Processing

- VA02 - Permissions are different, can segregate by security

o Risk F012: Function FA01 - Maintain Asset Document and Function

FA02 - Maintain Asset Master

- ABNAN - Permissions are different, can segregate by security.

(Note:- In current available latest Standard ruleset,

permissions are delivered identical in both the Functions for

ABNAN tcode. This has been decided to change them based on

Master & Document objects. This is scheduled to be changed in

Q3, 2013 review. If any customer would like to get the exact

changes which are going to be done in Q3, 2013, raise a CSSmessage under GRC-SAC-ARA component and ask for the same)

Header Data

Release Status: Released for Customer

Released on: 10.06.2013 16:09:30

Master Language: English

Priority: Recommendations/additional infoCategory: FAQ

Primary Component: GRC-SAC-ARA Access Risk Management

The Note is release-independent

Related Notes

Number Short Text

1604722 Risk Analysis and Remediation Rule Update Q3 2011

1446680 Risk Analysis and Remediation Rule Update Q2 2010

1373465 Rule Upload and Rule Import - Explanation of functions

1326497 Risk Analysis and Remediation Rule Update Q2 2009

1173980 Risk Analysis and Remediation Rule Update Q2 2008

1083611 Compliance Calibrator Rule Update Q3 2007

7/22/2019 sapnote_0001600667

http://slidepdf.com/reader/full/sapnote0001600667 4/4

27.06.2013 Page 4 of 4

  SAP Note 1600667 - Transactions that conflict withthemselves

Number Short Text

1061380 Compliance Calibrator Rule Update Q2 2006

1050832 ME23N in Compliance Calibrator (RAR) Default rules

1035070 Compliance Calibrator Rule Update Q1 2007

1033326 Risk Analysis and Remediation Rule Upload guidance

986996 GRC Access Control- Best Practice for Rules and Risks