APP-12

Control Description

Critical SAP batch jobs are monitored via SAP Solution Manager with automated alerts to notify job owners of failures. Failed jobs are investigated and remediated the same business day, with results documented and reviewed by management.

Risk

Failure to timely detect and remediate critical SAP batch job failures may result in incomplete transaction posting, inaccurate period-end balances, or unexecuted payments, leading to inaccurate financial reporting and compromised data integrity

Implementation Details

Pragmatic Scope Definition (Avoiding the "Rabbit Hole"):
• Pragmatic Scope Definition & Iterative Walkthrough Discovery (Avoiding the "Rabbit Hole"): Rather than attempting an exhaustive upfront analysis of all thousands of background jobs in SAP, IT management, Basis teams, Finance, and Internal Audit collaborate to define an initial risk-based inventory. Furthermore, as part of periodic process walkthroughs and annual control testing, teams actively flag and add newly identified SOX-relevant jobs (such as specialized foreign exchange valuation routines, custom interface loads, or subsidiary-specific clearing programs). Scoping focuses strictly on automated routines that directly impact financial reporting, subledger-to-general ledger reconciliation, or core IT General Controls (ITGCs).

Expected Core Job Categories to Include in the Register:

• Record-to-Report (Financial Closing): Asset depreciation runs (AFAB), foreign currency revaluation (FAGL_FC_VALUATION), automatic account clearing (F.13), and recurring entry postings.

• Order-to-Cash (Revenue/Billing): Background billing generation (VF04) and billing-to-accounting transfer jobs (V.30 / RV61BZA1).

• Procure-to-Pay & Inventory (MM/PP): Material Ledger settlement (CKMLCP) and automated inventory/invoice clearing jobs.

• IT General Controls (ITGCs) & Governance: Automated user termination/lifecycle sync jobs, system backup verification routines, user authorization comparison programs (RSPPFUD), and GRC firefighter log synchronization jobs (GRAC_REPOSITORY_SYNC).

Log Retention & Purge Protection:
• Background job log retention policies (configured via programs like RSPO0041 or background job clean-up variants) must be configured to ensure that execution logs, job histories, and application error logs associated with the critical job register are preserved for a duration aligned with corporate compliance standards (typically at least 180 days or through the annual audit cycle), preventing premature log purging

Centralized Monitoring & Alerting: The scoped register of critical jobs is configured within an enterprise monitoring tool (e.g., SAP Solution Manager /SAP ALM to trigger automated alerts for aborted runs, severe processing delays, or application-level error logs.

Test Procedures

Test of Design (ToD):

• Inquire of IT management, Basis administration, and finance leadership to understand the methodology used to curate and dynamically update the critical job register, confirming that cross-functional walkthroughs and ongoing collaboration (including Internal Audit or Finance) are used to capture newly identified jobs (like FX tasks). Inspect the documented job register to verify coverage of core financial cycles and key ITGC automated routines.

Test of Operating Effectiveness (ToE):

• Inspect Solution Manager or monitoring tool configurations to verify that active alert rules match the approved critical job register.

• Log Retention Verification: For the sampled job failures, check the historical logs in SAP (via SM37 or SLG1) to confirm that the detailed execution logs remain intact and accessible for review, proving they were not prematurely purged.

• Sample a selection of alerts triggered during the audit period to confirm that job failures were investigated, remediated within the defined operational timeframe (e.g., same business day), and reviewed by management.