Access Risk Manager
Access Risk Manager
(Identify Risk)
Analyse SAP systems and identify access risks that could potentially lead to fraud or security breaches. User-friendly dashboards display easy-to-consume information, making SAP access risk identification and remediation effortless. 
Access Risk Manager
(Get Clean)
Ensure SAP users have appropriate access using Soterion’s powerful risk remediation and role clean-up functionality and significantly reduce the effort required by business users to carry out user access reviews. 
Access Risk Manager
(Stay Clean)
Control the SAP access (change) request process with Soterion’s ‘What-If’ simulation functionality, allowing the organisation to determine the risk impact of any proposed role change prior to applying it in SAP. 
Access Risk Manager
(Stay in Control)
Document and monitor mitigating controls. Graphically track the mitigation status of identified risks and control compliance activities by prompting controllers to perform the controls. 
Key Benefits
Enhanced business accountability of
access risk
Reduce access
risk exposure
Efficiently support the
SAP authorisation
environment
Improve compliance
and reduce audit effort
Identify Risk
Get Clean
Stay Clean
Stay In ControlSAP Access Risk Analysis — Incorporating Transactional Usage
Soterion for SAP analyses users’ authorisations and incorporates the user’s historical transactional usage data to differentiate between the potential and the actual access risks. This allows business to focus on the real access risk in the SAP environment.
Business-friendly SAP Access Risk Reporting
Soterion for SAP allows data to be viewed from every angle using drag and drop functionality for grouping and filtering. Graphical overviews show the organisation’s access risk landscape, including high-risk areas, in relation to risk tolerance and appetite levels. Reporting on SAP access risks at department level enables business users to take ownership, and become accountable for access risk in their area of responsibility.
Business-Process Flows Reporting
Business process flow diagrams provide more context to the access risk, converting the technical GRC language into a business-friendly language to ensure better decision-making.
Resolution-driven Gap Analysis Reporting
Soterion performs a gap analysis between potential and actual SAP access risk in the authorisation solution, highlighting superfluous risk-bearing access. Removing this unused or inappropriate SAP user access significantly reduces the potential for fraud. Superfluous user access can then be remediated without business interruption and allows business to focus on the real access risk. Unused user access typically contributes to 80% of the access risks in an SAP environment.
SAP Access Risk Clean-up Projection
The risk clean-up projection estimates how much your SAP Authorisation solution can be cleaned up using Soterion for SAP’s methodology. The clean-up actions focus on the removal of unused access that contributes to risk, ensuring significant risk remediation with minimal impact on business.
Risk Clean-up Wizards
The Risk Clean-up Wizards provide clear, step-by-step suggestions on how to reduce access risk. Suggestions include the removal of superfluous allocations, as well as the splitting of roles based on role usage analytics.
User Risk Overview
The risk clean-up project reduces the potential for fraud through the removal of all unused risk-bearing access. This also significantly reduces the effort required by business users to carry out user access reviews. Soterion provides graphical tracking of clean-up progress.
Allocation Simulations and “What-If” Analysis
Soterion’s allocation simulator identifies whether SAP access change requests will introduce new access risk violations. Business users can review the impact and approve these changes using Soterion’s powerful workflow engine, ensuring only approved changes are applied in SAP. This entrenches business buy-in for new risk, and enhances the SAP user change management process through detailed audit logging.
Comprehensive Rule Set that is Fully Customisable to your needs
Soterion for SAP comes with an class-leading “out-the-box” access risk rule set based on best practice for all industries. The rule set covers segregation of duties (SOD), critical transactions and data privacy risks. The rule set is easily customisable to cater for an organisation’s specific needs.
Mitigating Controls
For access risk that are unavoidable, appropriate mitigating controls can be defined in Soterion for SAP. Business can graphically track the mitigation status of identified risks.
Control Execution
Soterion for SAP facilitates control compliance activities by prompting controllers to perform the controls within the prescribed frequency period.
