SAPFree worksheetPDF, Excel, Word exportSAP ECC and S/4HANA

SAP Segregation of Duties Conflict Matrix Worksheet With Risk Scoring

Segregation of duties means no single person can both start and conceal a risky action, such as creating a vendor and paying it. This worksheet is a practical conflict matrix: list the function pairs, the SAP transactions behind them, a risk score, and the control that makes the conflict acceptable.

Download:

Conflict ID	Function A	Transactions A	Function B	Transactions B	Likelihood (1-5)	Impact (1-5)	Risk score	Mitigating control	Status	Control owner
							15
							12
							8
							15
							10
							6

Highest risk score

Average conflict score

Compare the portfolio average between review cycles to see if conflict risk is falling.

Example conflicts reflect commonly cited SoD pairs. They are not a complete ruleset and not legal or audit advice. Check transaction codes against your own release and add custom transactions.

Test your conflicts on real data

Optional: we can discuss how to run a read-only conflict analysis over your own SAP role and user tables.

Optional. The tool and every export work without this. No spam.

How to use the matrix

Start with the processes that matter most to you: procure to pay, order to cash, record to report, and basis administration. For each, list pairs of functions that should not sit with one user. Write the transactions behind each function, since access is granted by transaction and authorization object, not by function name. Score likelihood and impact from 1 to 5. The risk score is the product. Then record the mitigating control, status and owner. Export to Excel for audit evidence or to load into your GRC tool as a basis for its ruleset.

Start with high-value processes first
List transactions, not only function names
Always name a control owner

The method behind the scoring

The approach follows the usual risk matrix: likelihood times impact. A score of 15 or more usually calls for redesigning roles so the conflict cannot occur. A middle score of around 6 to 12 can often be accepted with a detective control such as a review report. Low scores can be accepted with a documented reason. For this worksheet the thresholds are yours to set, and your internal audit function should agree them. The important part is that conflict, score, treatment and owner are all written down.

High score: redesign roles
Medium score: add a detective or preventive control
Low score: accept and document

Reading the sample rows

Take FI-01, maintaining vendors and running payments. If one user can create a vendor, enter bank details and release payment, they can pay themselves. A monthly vendor change report reviewed by the controller is a detective control. A stronger design splits the roles. MM-01 shows a classic procure to pay conflict: the buyer who raises the order also books the goods receipt. In small plants this split is hard to staff, so a compensating control is often what is practical. Record both the control and why the full split is not possible.

Prefer preventive controls where staffing allows
Compensating controls need evidence they ran
Re-score after a control or role change

Common mistakes

The common failures are checking only transactions and ignoring critical authorization objects, so a user without the transaction still has the table-level access. Another is analyzing roles instead of users: conflicts that appear only when two roles combine will be missed. Mitigating controls that exist on paper but are never evidenced are a third. Finally, firefighter or emergency access is often left outside the review. Include it in the matrix with a clear approval and log review process.

Analyze users, not roles alone
Include critical authorization objects
Evidence the mitigating control every cycle

Frequently Asked Questions

What is a segregation of duties conflict in SAP?

It is a combination of access that lets one user complete a risky process alone, such as maintaining vendor master data and releasing payments. In SAP it is detected by analyzing the transactions and authorization objects across all roles a user holds, not by looking at a single role.

How many SoD rules should an organization have?

There is no fixed number. Commercial rulesets contain hundreds of rules, but a smaller, well-understood set focused on your key processes is better than a large one nobody maintains. Start with the highest-value conflicts and expand as controls mature.

Can a mitigating control replace removing the access?

Sometimes. Where staffing makes a split impractical, a documented detective control such as a regular review report can reduce the risk to an acceptable level. Auditors will expect evidence that the control actually runs and that someone independent follows up on exceptions.

Do I need SAP GRC to use this worksheet?

No. The worksheet works with any approach, including manual review using SUIM reports. If you later adopt SAP GRC Access Control or another tool, the conflict list and scoring logic can be used as input for its ruleset.

If you want to test your conflict list against real user and role data, Netray can build a read-only analysis over your SAP tables, run privately in your environment.

Talk to an Expert Explore More Free Tools

Related Tools

SAP

More SAP tools

See all

Back to All Tools