Case Study
Cashbuild
How Cashbuild upgraded from outsourced SAP authorisations to a GRC Managed Service with Soterion.
The Cashbuild Story
Cashbuild is South Africa’s largest retailer of building materials and associated products. Like many companies, it outsourced its SAP security and authorisations to a service provider.
How Does One Address the Audit Findings?
Companies that outsource SAP authorisations face a challenge of accountability. Instructing a provider to action access changes — and the provider complying — doesn’t answer who is responsible for whether those changes introduce access risk.
Like many others, Cashbuild assumed its outsource partner would flag potential access risks before implementing changes in SAP. In reality, without an SAP access risk tool, both the outsource partner and the company were flying blind.
From Outsourcing to a GRC Managed Service
Cashbuild looked for more than just an outsource solution. It needed the benefits of an on-premise access risk solution, together with access to GRC expertise, in a cost-effective way that matched its size and risk exposure. It found the right fit by upgrading its SAP authorisation outsourcing model to a GRC Managed Service model with Soterion.
Why Cashbuild Chose Soterion
On-premise GRC tools are prohibitively expensive, but the business still needs visibility of its SAP access risk exposure.
Overcomes limited in-house GRC expertise and the challenge of retaining GRC specialists.
GRC is complex and needs to be proactively managed, with clear accountability.
Limits exposure to fraud and addresses audit concerns in a way that is financially size-sensible.
“Having experienced Soterion's GRC Managed Service, we can now say that our GRC is not only well managed, but also well led. This allows us to focus on what we are good at – selling building supplies.”
Hennie Steenberg, IT Executive at Cashbuild
Key Lessons from Cashbuild's Implementation
- Outsourcing SAP authorisations doesn't outsource accountability for access risk.risk management.
- Without an access risk tool, both the company and its service provider are flying blind.
- See the risk impact of every access change before it is applied in SAP.
- GRC as a Managed Service lets the business focus on what it does best.
Using Soterion's GRC Managed Service, Cashbuild sees the risk impact of each SAP access change request performed by the service provider before it is applied in SAP. This visibility gives both Cashbuild and the service provider comfort that access risk is being effectively managed.
Where an outsourcing model simply takes orders, GRC as a Managed Service involves proactive risk management by the service provider. For Cashbuild, this means its SAP security is comprehensively taken care of, so it can focus on its business.
Ready to take control of your SAP access risk?
Talk to a Soterion solutions expert.