Case Study
Samancor
How Samancor Chrome achieved full system reliance from its external auditors with Soterion.
The Samancor Chrome Story
Samancor Chrome is one of the largest integrated ferrochrome producers in the world. Its core business is the mining and smelting of chrome ore, producing three grades of ferrochrome — charge chrome, intermediate carbon ferrochrome and low carbon ferrochrome — each used in different areas of the stainless steel smelting process.
The corporate office is in Sandton, Johannesburg, and three ferrochrome plants and two chrome ore mining complexes operate as separate business units across the North West, Limpopo and Mpumalanga provinces of South Africa.
A Rule Set That Didn't Fit the Business
Samancor Chrome’s original tool had a Segregation of Duties (SoD) rule set that was not comprehensive or relevant to the business, and it could not track users’ transaction usage and frequency. There was no way to simulate SoD risks when creating users or changing authorisations offline, and mitigating controls could not be linked to SoD risks.
Data synchronisation from SAP was an extremely time-consuming and technical process — and the tool’s annual renewal and licensing fees were becoming extremely costly.
Getting Business Specific
Samancor Chrome needed an affordable solution with quick, easy synchronisation with SAP, offline user access simulation, an approvals workflow, and an applicable SoD rule set linked to mitigating controls. It chose Soterion for SAP. The technical set-up took only a few hours with the help of Soterion's implementation and maintenance teams. Administrator training, which usually takes three days, was completed in one day because the system is so user friendly.
Why Samancor Chrome Chose Soterion
A cost-effective alternative to a tool whose renewal and licensing fees were becoming extremely costly.
An applicable SoD rule set that links risks to mitigating controls.
SoD risks of new users and authorisation changes are simulated, and mitigations approved, before changes reach production.
Set-up took a few hours and administrator training was completed in a single day.
“Soterion's unique functionality of Dynamic Authorisation Management provides a new level of visibility into our SAP Authorisation solution. In addition, the simplicity and practicality of the software has allowed for a rapid reduction in Segregation of Duty risks with minimal business interruption.”
Cuan Kloppers, CIO of Samancor Chrome
Key Lessons from Samancor Chrome's Implementation
- A rule set that reflects your business is key to audit reliance.
- Simulate before you change: approve mitigating controls before access changes are made in production.
- Make transaction usage visible — all user transaction frequencies are now available to Samancor Chrome's management.
- A user-friendly tool shortens onboarding: administrator training took one day instead of three.
With the help of Soterion's SoD risk rule set, Samancor Chrome achieved full system reliance from its external auditors for the first time in three years. Proactive, quick identification of SoD risks and implementation of mitigating controls also minimise fraud risk to the company.
Soterion continuously monitors and adjusts user access so the SAP authorisation solution stays aligned with what users actually do in SAP — separating real access risk from potential risk, with business-friendly reporting. Samancor Chrome now plans to roll out user access workflow for all SAP Authorisation Managers, along with internal audit checks and Firefighter functionality.
Ready to take control of your SAP access risk?
Talk to a Soterion solutions expert.