SAP R/3 for Auditors: Controls, Security, and Compliance Training Course

Session 1 (4 hours)

Module 1 – R/3 Fundamentals for Auditors (2 hours)

• Basic architecture, including the ABAP stack, SAP GUI, and client concept.
• Key differences from legacy systems, focusing on modular design such as FI, MM, and SD.
• Classic transactions and navigation techniques for audit purposes.

Module 2 – Access, Roles, and Essential SoD (2 hours)

• User management and authorizations using PFCG, SU01, SUIM, SU53, and SU24.
• Role design and common audit-relevant functions for government systems.
• Basic Segregation of Duties (SoD) matrix and typical findings, such as the same role performing both invoice creation and approval.

Session 2 (4 hours)

Module 3 – Security Logs and Traces (3 hours)

• Security Audit Log (SM19/SM20): activation, filters, and reporting for government audits.
• Usage of STAD and ST03N for analyzing usage statistics, sessions, and workload in a governmental context.
• Best practices for evidence retention and export to support audit requirements for government.

Module 4 – Configuration Changes and Sensitive Data (1 hour)

• SCU3 (change documents) and SCC4 (client settings) for tracking configuration changes in government systems.
• Critical system parameters (RZ10/RZ11): identification and monitoring to ensure compliance for government operations.

Session 3 (4 hours)

Module 5 – Process Controls (FI/MM/SD) in R/3 (4 hours)

• Financial Accounting (FI): tolerances, OB52 (posting periods), and journal entry approvals for government financial processes.
• Materials Management (MM): release strategies, purchase order limits, and single supplier controls to ensure procurement integrity for government.
• Sales and Distribution (SD): credit limits, pricing changes, and conditions monitoring to support transparent sales operations for government.
• Audit sampling techniques for process testing in a governmental context.

Session 4 (4 hours)

Module 6 – Comprehensive Laboratory + Reporting (3 hours)

• Review roles and authorizations for a critical user in government systems.
• Trace operations, such as purchases and sales, and obtain audit evidence using SM20 and SCU3 for government audits.
• Document findings with screenshots and exports to support audit requirements for government.
• Preparation of working papers and ensuring traceability in a governmental context.

Module 7 – Closure and Action Plan (1 hour)

• Internal control checklist specific to R/3 systems for government operations.
• Prioritization of findings and recommendations for enhancing internal controls in government systems.

Deliverables:

• Checklist of 20+ controls for FI, MM, and SD modules, tailored for government audits.
• Quick guide to using SM19/SM20, SUIM, SCU3, STAD, and ST03N for government audit purposes.

Summary and Next Steps