Case Study
Saint-Gobain South Africa
How Saint-Gobain SA sealed the "leaky Chinese wall" between its divisions and prepared for audit success with Soterion.
The Saint-Gobain Story
The Saint-Gobain Group was founded in 1665 as one of 25 royal mirror-glass manufacturing companies and has a history of more than 350 years. Today it is present in 67 countries with more than 180,000 employees, designing, manufacturing and distributing materials and solutions used in buildings, transportation, infrastructure and many industrial applications.
Saint-Gobain South Africa consists of several business divisions. Four of them — Weber, Gyproc, ISOVER and PAM — access a single SAP ECC system.
The Case of the Leaky Chinese Wall
The four divisions must restrict cross-business activity access: an employee of one division should not have access to another division’s activities. Saint-Gobain’s group internal audit department performs surprise audits, typically with only one month’s notice, focusing on wide and cross-division access. Each company is graded from A (control in place, efficient and formalised) to E (no control).
Since adopting SAP in 2001, Saint-Gobain SA had consistently failed its access control audits. Job-based roles were too broad, and “authorisation creep” meant users kept access as they moved between jobs and business units — creating a leaky Chinese wall between the companies.
The Challenges of Outsourcing
Saint-Gobain SA used an outsourced SAP authorisation provider for technical functions such as role changes. The provider executed requests without guiding the business towards best practice, so risky practices became ingrained, and frequent changes of security resources led to inconsistent role methodologies. Without an access risk solution, there was no visibility of the risk impact of each SAP access change request. Saint-Gobain SA implemented Soterion in 2015 — but an access risk tool alone was not the silver bullet. Cross-division access continued to cause audit failures, so Saint-Gobain SA asked Soterion to help understand and fix the underlying problems.
Why Saint-Gobain SA Chose Soterion
A "task and value" role methodology balanced flexibility and control, with business roles assigned from user–transaction (SM20) logs and line manager approval.
Soterion's market-leading rule set was tailored to Saint-Gobain SA — an important step in securing business buy-in.
Existing controls were documented in a central repository and mapped to risks in the customised rule set.
Line managers and business unit heads were trained on the risks and controls in their areas, promoting ownership and a culture of risk awareness.
“Implementing an access risk tool on its own wasn’t the silver bullet we expected. Soterion helped us understand why we kept failing audits and fix the underlying problems, starting with how our roles were designed. Before, our outsourced provider simply did what we asked. Soterion guides us towards best practice. It feels less like outsourcing and more like a partnership”
Jeanette Law, Business Applications Manager at Saint-Gobain SA
Key Lessons from Saint-Gobain SA's Implementation
- An access risk tool alone is not a silver bullet — good role design is the foundation everything else is built on.
- Like a multi-storey building, a strong foundation of business and technical role design must be in place before the organisation benefits from GRC and Identity Access Management.
- Choose a partner that guides you towards best practice, not one that simply executes requests.
- Educate the business so ownership of access risk moves from IT to the process owners.
Saint-Gobain SA implemented Soterion's Elevated Rights Manager to manage sensitive and emergency access. Support and business users get access to sensitive functions when required, in a controlled manner, and Elevated Rights sessions are logged and sent to owners for review.
Saint-Gobain SA moved beyond outsourcing to GRC as a Managed Service — a partnership covering risk, controls and audit support. With growing internal expertise, role allocation is now handled in-house and only role content changes are outsourced, while a new internal controls department has moved ownership from IT to the business. Next steps include user access reviews and considering an identity access management solution.
Ready to take control of your SAP access risk?
Talk to a Soterion solutions expert.