RTR-02

Control Description

SAP S/4HANA utilizes configured validation rules (via transaction OB28) and custom user exits to automatically enforce segregation of duties for manual journal entries, forcing entries to be parked and ensuring that the user who parks the journal cannot be the same user who posts it.

Risk

A single user acting alone could create and post unauthorized or fraudulent manual journal entries directly to the general ledger without independent review.

Implementation Details

Validation Framework (OB28)
• Financial Accounting validation rules are configured via transaction OB28
• The validation rule is to intercept manual journal posting transactions (such as FB50, FB01 etc) before data is written to the database and typically enforces two steps:

Step 1: Mandatory Parking: The system prevents users from directly posting manual journal entries on the fly; all manual entries must first be saved as a draft (parked).

Step 2: Segregation of Duties: When that parked document is ready to be finalized, the system automatically checks who created it and blocks that same person from posting it, forcing an independent user to review and approve the final posting.

Test Procedures

A) Test of Design
• Navigate to transaction OB28
• Filter for the relevant company code(s)
• Inspect the configuration design document or rule parameters to verify that the logic explicitly enforces:
◘ Step 1: Blocking direct posting for standard manual entry transactions (e.g., FB50, FB01), requiring them to be parked instead.
◘Step 2: Comparing the original parking user (BKPF-USNAM) against the current posting user session (sy-uname) during transaction execution (e.g., FBV0).

B) Test of Operating Effectiveness
3. Perform Live Negative Tests (System Enforcement Checks in Copy of Production)

• Test Step 1 (Mandatory Parking Block):
◘ Log into an SAP copy-of-production environment using a test user account and open transaction FB50 (Manual General Ledger Entry).
◘ Attempt to click Post directly without parking the entry first.
◘ Capture a screenshot of the system error message.
◘ Confirm that the system successfully intercepts the attempt, triggers a hard error message, and forces the user to save the entry as parked instead.

Test Step 2 (Segregation of Duties Posting Block):

◘ Using the same or a different test user account, successfully park a manual journal entry (e.g., via FV50, FB50, FB01 etc).
◘ Attempt to post that exact same parked document using that same user account (via FBV0).
◘ Capture a screenshot of the system error message.
Confirm that the system successfully intercepts the attempt, triggers a hard error message, and blocks the transaction from being posted by the creator.