BASIS - SAP Basis
Audit users roles and authorization objects
Running broad queries without filters
Goal: secure and least-privilege system access.
Typical stakeholders: security admin, basis consultant, process owner.
KPIs to watch: critical auth findings, access request lead time, segregation-of-duties conflicts.
Audit asks who can release blocked invoices and who can post outgoing payments.
Consultant note: Use SUIM reports to identify users/roles and compare against SoD policy before go-live.
Problem: Audit cannot quickly identify who can release blocked invoices or run payments.
Diagnosis: Run user-to-role and role-to-auth reports for critical transactions and auth objects.
Resolution: Publish recurring access evidence report and close unauthorized assignments with owners.