Bots are Better: Improving SAP Compliance Testing Processes…and More

In this two-part series, we explore how organizations can leverage robotic process automation (RPA) and other automation techniques for IT Sarbanes-Oxley (SOX) testing within SAP environments. Today, we review the business need for RPA. Part 2 covers advancements and future use-cases for RPA-based solutions.

Robotic Process Automation (RPA), when deployed correctly, can significantly expedite what would otherwise be heavily time-consuming tasks. When applied to SAP Basis testing, almost the entire data extraction aspect of the testing process can be automated. Not only does deploying an automated solution for testing increase efficiency and quality, it also frees up time for employees to focus on value-add tasks rather than redundant, repetitive activities.

Protiviti’s Enterprise Applications Solutions (EAS) team often supports clients in performing IT Sarbanes-Oxley (SOX) testing of their Enterprise Resource Planning (ERP) systems. Due to the criticality of system security risks, we spend significant time combing through client records of system users with elevated authorization outside their function or with access to sensitive information to test logical access as part of the IT General Control (ITGC) component within IT SOX. Because of the replicable nature of this work, our team discovered how using an automated solution adds significant value during IT SOX testing.

Business Need 

Many times, Protiviti’s standard IT SOX work program for SAP requires a significant focus on identifying users who have access that is either above what is needed for their current job responsibilities or deemed too powerful for any user to have. Whether these users receive unwarranted administrator access, can see sensitive financial information or have inappropriate access due to a job change, it is important for clients to understand what user access rights exist in their financial systemsAny inappropriate user access within the system can increase the possibility for fraudulent activities to occur. 

Access in SAP is controlled through individual transaction codes. To determine which SAP users have access to sensitive transaction codesan analysis of over 80 different access queries must be performed. Previously, it was necessary to either run each of these system queries manually or request the client to provide all documentation for the queries. For each query, a user listing screenshot had to be taken to evidence completeness and accuracy of the workthe corresponding listing would then be downloaded to excel for validationThen, a manual count would determine the number of active users with sensitive access to each transaction codeWhen performed manually, this involved a significant amount of time, drawing our team’s focus away from contributing more valuable insights to each project. While understanding the users with elevated abilities in the system is extremely important to help our clients secure their financial environments, the process to obtain this information has been tedious and repetitive, serving as a perfect opportunity for automation.  

Bot Development 

To create the bot, Protiviti leveraged UiPaththe leading provider in the RPA industry. The bot is considered to be attendedas the actions it takes are reflected on the user’s screen, rather than running in the background. 

The bot first navigates to the SAP screen where query criteria are entered to generate a specific user access listing. After automatically filling in the necessary criteria, the bot records a screenshot of the full screen, complete with a date and time stamp for audit compliance. Once the user listing is generated, the bot saves the criteria screenshots and user listing and downloads an Excel file of the output. The bot then returns to the query criteria screen, where screenshots and user listings are pulled for each subsequent query.  

Once the bot has cycled through all the pre-coded queries, it uses the Excel output to determine a count of the active dialog users for each query to show true end-user access. The bot then creates a word document outlining the parameters of each query, the active users that meet the specified criteria and screenshots of the criteria and user listing output. This document, as well as the Excel output files, are ready to be turned over to the client almost immediately after the bot finishes running. 

Client Spotlight 

By leveraging an internal SAP application instance, the team was able to conduct rigorous testing on the bot to ensure the solution was ready to be deployed in client environmentsThe EAS team identified a potential client to pilot the bot with — a $750 million machine manufacturing company ready to conduct a review of IT SOX compliance on their SAP system 

After a discussion with the client about using an attended bot in their system, the team identified two separate SAP environments where this bot could be leveraged. The only client environment adjustment required to allow the bot to be run was changing a low-risk configuration setting. Once that setting was enabled, the team simply signed in through the Protiviti SAP profile, ran the bot, reviewed the results and passed the deliverables to the client. Leveraging this automation technology freed up our team from time-consuming, redundant work, allowed us to spend additional time reviewing the results with the client, creating more opportunities to deliver exceptional value 

Evolution of Bots 

As with any technology, the automation Protiviti has developed to accelerate IT SOX audits are evolving as the team continues to add enhancements. Not only are further improvements possible with the core functionality, but there are also other processes in the IT SOX audit work program to automate.  

One step is to develop dynamic functionality where the bot can search different criterion based on client need. This allows us to be more flexible in testing the customized environments of each of our individual clients. While Protiviti’s standard SAP IT SOX program includes robust sensitive access validations, clients may have different custom transactions or developments that would lend themselves well to dynamic functionality. This additional functionality also positions us to adapt quickly to the ever-evolving audit requirements, saving our clients additional rework. While SAP is a significant focus of this iteration of the testing bot, it is not the only enterprise application on which we continue to focus. The organization has evolved to other processes, applications, product versions and areas of focuses depending on our ever-growing client demands.  

To drive further value across clients’ ITGC work programs, we have also had success creating bots to confirm password parameter compliance and in automating population extractionto complement the work in the user access space. These bots will continue to be developed, with the ultimate goal of end-to-end automation of the data extraction, testing and documentation requirements of the SAP IT SOX work program. As Protiviti continues to develop in the process automation space, not only do our consultants benefit from more time to contribute value-adding work, but clients will continue to see more efficient, accurate products and cost-effective deliverables through leveraging RPA tools 

To learn more about our SAP capabilities, contact us or visit Protiviti’s SAP consulting services. 

Kristine Meyer

Senior Manager
Business Application Solutions

Brendan Campbell

Technology Consulting

Subscribe to Topics

Generative #AI is set to revolutionize the field of enterprise architecture. Get a comprehensive overview of the impact of #GenAI on EA activities, plus challenges, risks and limitations in the latest Technology Insights blog post. #ProtivitiTech

Protiviti’s @KonstantHacker will join a panel to speak on “Quantum Leap: Securing Manufacturing's Next Frontier with Post Quantum Cryptography” on July 18 in Chicago, IL. Register today for this in-person event. #ProtivitiTech #Quantum

Protiviti’s Kim Bozzella explains why it’s crucial for businesses to establish trust through transparent and secure data practices: “Losing trust means losing business.” Learn how to take action now. #ProtivitiTech #DataPrivacy

Protiviti’s Mark Carson discusses the importance of measuring analytics capabilities, the importance of taking an agile approach to analytics assessment, and the future of analytics maturity. Read more in TechTarget: #ProtivitiTech

Protiviti’s @KonstantHacker and guest Benedikt Fauseweh, of TU Dortmund University, discuss Richard Feynman’s 1981 quantum simulator idea, its relevance today and whether this work has anything to do with ‘The Three-Body Problem’ novel and Netflix show.

Load More