INV-05

Control Description

Access to assign ABC cycle count indicator or "CC Fixed" flags in the material master via tcodes such as MIBC or MM02 is restricted.

Risk

Inaccurate inventory valuation and financial statement misstatement due to the failure to perform timely physical inventory cycle counts for high-value or high-velocity materials, or unauthorized modification of ABC cycle counting classification parameters in SAP S/4HANA

Implementation Details

Implementation Details
• Scope Entry Points: Restrict core cycle counting and material master modification transactions, specifically MIBC (ABC Analysis), MM01, and MM02 (Material Master creation/change), alongside EWM product master equivalents like /SCWM/MAT1, to prevent unauthorized modification of cycle count indicators and "CC Fixed" flags.

• Control Authorization Objects: Restrict authorization objects such as M_MATE_WRK (Plant authorization) and M_MATE_MAT (Material Master views/activities) in PFCG roles so that users can only view or maintain logistics/inventory data for authorized plants and organizational units.

• Map Fiori Catalogs: Restrict Fiori equivalents for managing physical inventory and product master records (such as apps for Perform ABC Analysis or Manage Product Master) to ensure users cannot bypass backend GUI restrictions via the Fiori Launchpad.

• Monitor via SAP GRC: Build a custom GRC ruleset to detect and audit users holding combined access to inventory batch processing/analysis tools (MIBC) and core material master update rights.

• Execute Sensitive Access Analysis: Run periodic sensitive access reviews via SAP GRC to validate that cycle count indicator configuration access remains strictly restricted to authorized inventory management personnel.

Test Procedures

Test of Design (ToD)
• Inspect the SAP GRC Access Risk Analysis (ARA) ruleset configuration to verify it contains a custom or standard rule checking for sensitive inventory and material master cycle counting access.

• Confirm the rule explicitly flags the combination of core cycle count and material maintenance transactions (MIBC, MM01, MM02, /SCWM/MAT1) when paired with authorization objects like M_MATE_WRK and activity values for modifying material master inventory and cycle counting parameters.

Test of Operating Effectiveness (ToE)
Inspect periodic User Access Review (UAR) sign-off logs or Access Request workflows to verify that management regularly reviews and validates who holds cycle count indicator update access.