1. MIS 5121: Exam 3 – Review Sheet
Edward Beaver ff

2. ISC framework in the ERP environment
Other Reg’s
Organization’s Objectives & Policies
External Financial Reporting regulations
Balance Sheet
P & L
Notes
FDA etc.
Performance & Policies
Arise through
Must be observed / achieved in
Business Processes
_____ ______ ______
______ ___ _______
___________ __________
______ __ _____
_______ _
________ __ …
Contain
Risks
___________
___________
Assertions
Value / Benefits
Errors & Fraud
Minimized by
ISC framework in the ERP environment
Entity level controls
Automated application controls
Manual and semi-automated business process controls
Authorizations and access protection (confidentiality, integrity)
IT General controls (change management, operation, security)
Automated testing and monitoring of business processes, KPIs, etc.

3. Procurement at GBI Marketing / Sales Customers Suppliers Supply Chain
Finance / HR
Payment

4. Procure to Pay Process
Common Risks
Common Controls

5. Order to Cash at GBI Marketing / Sales Customers Suppliers
Supply Chain
Finance / HR

6. Order to Cash Process
Common Risks
Common Controls

7. Environment Favorable to Fraud Framework for spotting high-risk situations
_________________________ (____________________ _________)
_____________________
________________________ (____________________ _________)
______________________ (____________________ _________)
Fraud
__________
____________
________ / _________
Fraud Triangle

8. Inventory: Record Accuracy
Does ______________-- Match __________________ Check:
_______________
Physical Counting
Cycle Counting

9. Typical SAP Landscape Development System Type of Users: -
Type of Work:
Quality-Assurance System
Type of Users: -
Type of Work:
Production System
Type of Users: -
Type of Work:

10. Client Dependent vs. Independent
System/Instance
Client Dependent
Dev 100
Master (Gold)
________ Data
Dev 110
Dev Test … ….
Dev 180
Data Conversion … ….
Dev 900
Sandbox … ….
Client Independent
_____________ > Repository Objects (Client Independent Config
_____________ - _____________, _____________
_____________ - _____________
_____________ > _____________

11. SAP Change Management
SAP Transports are: ____________________________________________ They Contain: _________________________________________________ SAP Change Management Recommendations
Risk: _____________________________________________ Control: _____________________________________________

12. System (Server) / Client Parameters
Risk: _____________________________________________ Control: _____________________________________________

13. Table Security Tables are Integral part of SAP Application
Different Types of Tables
_________________
SAP is customized using thousands of ____________ tables through the _________________ (SPRO)
Class Exercise: SE16N - T000, T001, MARA, TDAT (Auth groups)

14. Table and Information Security
Risk: _____________________________________________ Control: _____________________________________________

15. Program & Development Security
Good Development Practices
_________________________________________
Control Concerns: Development, Data Dictionary

16. Powerful ID’s and Profiles
List few SAP Supplied Powerful ID’s and Profiles that need ‘caged’
_________________________________________
Risks and Control Recommendations for Powerful ID’s / Profiles
Risk: _____________________________________________ Control: _____________________________________________

17. Firefighter / Emergency User
Valid Scenarios, Situations for Firefighter Use
_________________________________________
Key differences of Firefighter vs. Regular ECC access:
Audit of reason and transactions used
Emergency vs. routine use
Firefighter Best Practices

18. GRC & Other SAP Module Security
GRC (G___________, R____, & C__________________ Module
Beyond ERP / ECC and GRC: What is another SAP module
What is another SAP module: _________________________________________
What does the module do: _______________________________________ ______________________________________________________________
How is Security Administered: ____________________________________ ______________________________________________________________
GRC v 10.0 Module
Function / Reason for Being

19. Segregation of Duties Goal: __________________ Definition
‘__________________________________’
Person who ______________ should not be the person who ______________ .
An Individual should only have 1 of following Responsibilities / Privileges:
A_____________
R_____________
C_____________

20. Finance
Common Risks
Common Controls

21. Inventory Control
Common Risks
Common Controls