APP-07

Control Description

User termination records are processed in the HR system in a timely manner to initiate automated de-provisioning through the identity provider. Network and directory account deactivation automatically revokes primary authentication access, which is supplemented by automated scripts that systematically lock or expire downstream SAP user accounts.

Risk

Terminated users may retain access to critical applications and data, resulting in unauthorized or fraudulent transactions, inaccurate financial reporting, or loss of data

Implementation Details

HR System as System of Record: The human resources management system (e.g., Workday) serves as the authoritative system of record for employee lifecycle events, including terminations.

Multipronged De-provisioning Architecture: Suggest a multi-layered approach to eliminate orphaned access upon termination:

• SSO / Identity Provider Integration: Direct automated integration with the enterprise Single Sign-On (SSO) and Identity Provider (IdP) cuts off primary network and directory access immediately.

• Direct SAP Integration / Middleware: Automated API integrations or scheduled IDoc/provisioning scripts connect directly to SAP to systematically lock, expire, or disable downstream user accounts (USR02).

• Manual Ticketing & Security Team Intervention: Supplementing the automated layers, automated ticketing workflows route termination notices directly to SAP security teams to manually strip roles, invalidate dangerous authorizations, and review any residual access risks.

Test Procedures

A) Test of Design (ToD):

• Inquire of HR IT, Identity Management, and SAP Basis teams to understand the end-to-end offboarding architecture and interface configurations.

• Inspect the configuration and integration setup of any direct APIs or middleware connecting the HR system of record to SAP and the IdP, verifying error handling, alert monitoring for failed transmissions, and automated synchronization schedules.

Test of Operating Effectiveness (ToE):

• 100% Population Cross-Check: Extract the complete population of termination records from the HR system of record for the audit period. Perform a 100% data cross-check against SAP table USR02 to verify that every terminated user account was successfully locked or expired in SAP.

• Timing & Lock Verification: Inspect suim -> SAP change document for users, with the administrator lock flag set to determine the exact timestamp when the user account was locked relative to the official HR termination date, confirming compliance with defined service-level agreements (e.g., same-day de-provisioning).

• Interface Failure Monitoring: Inspect integration monitoring logs (e.g., middleware or PI/PO message monitors) to verify that any failed API provisioning attempts generated alerts that were investigated and remediated by IT administrators.