OTC-05

Control Description

Access to release sales orders from credit blocks using SAP S/4HANA credit management tools is restricted to authorized credit management personnel.

Risk

Unauthorized employees could manually release credit-blocked sales orders without proper financial review, leading to shipments to high-risk or over-limit customers and potential bad debt write-offs.

Implementation Details

• Scope Entry Points: Restrict core credit release transaction UKM_CASE combined with authorization object F_UKM_SGMT to prevent unauthorized release of credit blocks. Include other custom tcodes as needed in analysis depending on specific set up

• Map Fiori Catalogs: Restrict Fiori equivalents for managing credit release to ensure users cannot bypass backend restrictions through the Fiori Launchpad.

• Monitor via SAP GRC: Build a custom GRC ruleset to detect and audit users with credit release rights

• Execute Sensitive Access Analysis: Run periodic sensitive access reviews via SAP GRC to validate that credit release access remains restricted.

Test Procedures

Test of Design (ToD):

• Inspect the SAP GRC Access Risk Analysis (ARA) ruleset configuration to verify it contains a custom or standard rule checking for monitoring credit block release accesses

• Confirm the rule explicitly flags users with core credit block release transaction UKM_CASE combined with authorization object F_UKM_SGMT to prevent unauthorized release of credit bloc

Test of Operating Effectiveness (ToE):

• Inspect periodic User Access Review (UAR) sign-off logs or Access Request workflows to verify that management regularly reviews and validates who holds credit block release access.