Erpsapbusproc

SAP: Business Process Controls
and AIS

Jennifer Hahn
Michael Juergens
Deloitte & Touche

ISACA Spring Conference
April 27, 1999

Presentation Outline
SAP: Business Process Controls and AIS

s SAP Module Overview
s SAP Business Process Overview
s Audit Information System (AIS) Overview

© 1999 Deloitte & Touche LLP. All rights reserved. Bpcontrols.ppt 2

1


SAP Module Overview


SAP R/3 Modules

SD FI
Sales & Financial
Distribution Accounting
MM CO
Materials
Mgmt. Controlling
PP AM
Production

R/3
Fixed Assets
Planning Mgmt.

QM
Quality
Client / Server PS
Project
Manage-
ment PM ABAP/4 WF
System

Plant Main- Workflow
tenance
HR IS
Human Industry
Resources Solutions


2

SAP Modules - Functional Category

Functional Category

s Financial Applications
Financial Applications Š FI, CO, EC, IM, TR, AM, PS

s Logistics Applications
Logistics Applications Š SD, MM, PM, PP, QM, LO

s Human Resources
Human Resources Š PA, PD
s Cross Applications
Cross Applications Š WF, OC, AL, CAD. DMS, ALE,
EDI, I/Net, EC
Industry Solutions s Industry Solutions
Š IS


Financial Accounting

q General Ledger
q Accounts Receivable

FI q

q
Accounts Payable
Tax and Financial
Reports
q Special Purpose Ledger
q Legal Consolidations

Financial Applications. . . . . . . .


3

Controlling

q Cost Center Accounting
q Profit Center Accounting
q Product Cost
CO Controlling
q Profitability Analysis
q Activity Cost
Management
q Internal Orders



Fixed Asset Management

q Depreciation
q Property Values
AM q Insurance Policies
q Capital Investment
Grants



4

Project System

q Project Tracking
q Work Breakdown
Structure
PS q Budget Management
q Cost and Revenue
Planning
q Networks and Resources



Sales and Distribution

q Computer Aided Sales
q Quotations

SD q

q
Sales Order Management
Pricing
q Delivery
q Invoicing

Logistics Applications . . . . . . . .

5

Materials Management

q Procurement
q Inventory Management
MM q Vendor Evaluation
q Invoice Verification
q Warehouse Management


Production Planning

q Sales & Operations
Planning
q Demand Management

PP q Material Requirements
Planning
q Production Activity
Control
q Capacity Planning


6

Quality Management

q Quality Certificates
q Inspection Processing
QM q Planning Tools
q Quality Control
q Quality Notifications


Plant Maintenance

q Plant Maintenance
q Equipment and Technical

PM q
Objects
Preventive Maintenance
q Service Management
q Maintenance Order
Management


7

Human Resources

q Personnel
Administration
q Payroll, Benefits

HR q

q
Time Management
Planning and
Development
q Organization
Management

Human Resources. . . . . . . .


Cross Applications

q SAP Business Workflow
q SAP Office
q SAP ArchiveLink
WF q

q
EDI
Communication
q Application Link Enabled
(ALE)
q Others

Cross Applications. . . . . . . .


8

Industry Solutions

q Banks
q Hospitals
q Oil Companies

IS q

q
Publishing Sector
Telecommunications
q Retail
q Utilities
q Others
Industry Solutions. . . . . . . .



Basis Component Overview


9

Basis Component

q ABAP/4 Development
Workbench
q Computer Center
BC Management System
q Authorization Concept
q Transport System
q Database Administration

Basis Component. . . . . . . .



SAP Business Process Overview


10

SAP Business Processes

s Over 1200 business processes defined by SAP
– Highly flexible
– Customized to fit each company
– Companies choose the business processes that they
want to implement
s Every SAP installation is different
– It is important to have clear understanding of business
processes that are effected by the SAP implementation
– These business processes should be mapped to the
corresponding SAP modules that are implemented


Example Business Process - Sales

Product Profitability
Costing Analysis
Planning
MPS

Sales MRP Planned Production Customer
Delivery Billing
Order run Order Order Payment

Goods Goods Goods
Issue Receipt Issue

Purchase
Raw Finished
Requisition Goods
Receipt Modules
Vendor
s MM
Customer s PP
G/L Account Purchase Invoice Vendor s SD
Order Receipt Payment
Material s FI/CO


11


Linking SAP Modules, Business
Processes and Audit


Audit Challenges

s SAP Modules
– Three Main Functional Categories
– Multitude of Modules
– Multitude of Sub-Modules
s SAP Business Processes
– 1200+ Processes
s Audit Processes
– Business Process Cycles


12

Linking Audit Cycles to SAP Modules

Audit Business Cycles SAP Module Functional Category

Treasury
Financial Applications
Fixed Assets
Expenditure
Revenue
Logistics Applications
Inventory
Management
Payroll and
Personnel Human Resources

Basis Component
Cross Applications
Industry Solutions



Audit Information System (AIS)


13

AIS - History and Background

s Requested by
– Internal Auditors,
– External Auditors, and
– Company Management
s Designed by SAP in response to requirements for
a tool to find, evaluate and download information
from SAP easily
s Includes:
– Audit Report Tree (transaction code: SECR)
– Report tree includes Systems and Financial audit tasks, reports
and tests for additional modules are under development
– Evaluation and notes can be entered into the specific tasks to
monitor progress of tasks

AIS - History and Background

s To provide a mechanism and structure
for collection, and presentation of
standard SAP reporting

s The goal is improvement of audit quality
through real-time auditing

s To provide company specific, individual
selection and preparation of data needs
and requirements for reporting and
IS review
A
s To provide the ability to download data
into flat files for analysis with external
tools
– AuditAgent
– ACL
– IDEA
– Baetge
SAP - DB


14

What is AIS?

s A collection of SAP reports / queries based on a
reporting tree
s A tool for auditing an SAP system
s Utilizes existing SAP functionality
s Designed to rationalize and facilitate the audit
process
s Organizes all audit related activities under one
umbrella
s Aims to improve the quality of an audit


What does AIS do?

© 1998 SAP AG. All rights reserved.

15

What does AIS do?

© 1998 SAP AG. All rights reserved.

AIS Features and Functions

s Tool for performing both System and Business
Audits
s Provides auditors with the ability to document and
monitor the progress of an audit
s Reports and queries can be customized for each
user
s Allows auditors to evaluate information or
download data to be used by CAAT tools such as
ACL
s Different views allow external auditors (both
financial and systems auditors) and internal
auditors to use the system simultaneously

16

AIS - System Audits

s Using the AIS System Audit tree users can:
– Review system configuration settings
– Review parameters settings
– Monitor operations
– Review various logs
– Review background processing
– Review security settings
– Perform user security audits
– Review transport related activities
– Review print and spool administration


AIS - Business Audits

s Using the AIS Business Audit tree users can:
– Perform various audit related queries
– Produce various audit related reports
– Review organization structure
– Review document structure, ranges, posting keys etc.
– Review client setup (number of accounts, assets,
customers, vendors, materials etc.)
– Review chart of accounts
– Produce financial reports (balance sheets, P&L, ratio
analysis etc.)
– Review account balances


17

Audit Status Analysis

s AIS uses Status Analysis functionality to:
– Summarize, maintain and monitor details of the audit
progress of specific testing, and for audit management
– Easily and quickly identify problem areas
– Document results of tests offering drill-down
functionality
– Notes exist in SAP R/3 version 3.1G+



s Status Analysis functionality and capabilities
improves the ability of Audit management to track
tasks performed within SAP:
– Percentage of completed audit steps for an audit
objective via traffic lights:
– Creation of separate documentation for the node of
each separate user view
– Ability to identify the number of views a node is
assigned to, with the associated status of completion
for each view
– Tracking of changes made to the notes to a
responsible person


18



Audit Report Tree

s The audit report tree contains two standard views:
– Financial Audit (AUDIT_FI)
– Systems Audit (AUDIT_SECR)
s Each view contains:
– Auditing procedures and documentation tools
– Audit evaluations (including data and key controls
within the configuration)
– Data download tools through links to Data Analysis
Tools, such as ACL (automated) or IDEA (through
Monarch)


19

Audit Report Tree


AIS and SAP versions

s Versions 3.1I and 4.5B+
– An integral part of the SAP Basis Component
s Only works on certain releases of R/3
– 3.0D, 3.0E, 3.0F
– 3.1G, 3.1H, 3.1I
– 4.0A, 4.0B, 4.0C
– 4.5A, 4.5B, 4.6A
s Not all functions are available in each version, as
functionality is based on the release level


20

AIS - Relevant OSS Notes

s Online System Support (OSS) Notes:
– 13719 - Transport Files to load AIS onto SAP for
versions 3.0D on
– 41475 - Copying report variants between clients
– 77503 - AIS Overview, Auditor’s configuration of Views,
Variants and Ratios
– 85344 - Performance concerns when AIS is installed
– 100609 - Basis Installation Steps
– 128256 - Missing English Texts
– 129170 - Download of Query Data
– 133914 - Conversion of drill-down reports



AIS Business Case


21

AIS Advantages

s Centralized auditing
s Continuous auditing
s Teaming of internal and external audit efforts
s More efficient use of time
s One report tree
s Simplify data extraction
s Potential to have all SAP reports in AIS only
s Custom views
s AIS is free


AIS Disadvantages

s Variant review after every SAP upgrade
s Reports must be configured
s SAP knowledge required to interpret results
s Over auditing
s Under auditing
s Access to SAP
s Auditability of the Financial (FI) module Only
s Reliance on the SAP system is assumed
s AIS is not mature


22

Questions and Information

Presenter Information:
Jennifer Hahn
714-436-7171
Michael Juergens
714-436-7276


23

Erpsapbusproc

More Related Content

What's hot (19)

Similar to Erpsapbusproc (20)

Erpsapbusproc