AuditNet^® Audit-library::Auditnet-sap-peoplesoft-resources-for-auditors

There are many auditors working for organizations that use SAP, an enterprise resource planning (ERP) system. Enterprise Resource Planning or ERP is an industry term for integrated, multi-module application software packages that are designed to serve and support multiple business functions. The purpose of the SAP AuditNet page is to provide a clearinghouse of information and an opportunity to share resources to facilitate audits of SAP. If you have resources including audit programs, checklists, internal control questionnaires (ICQ) or anything else that will help other auditors please send them to editor@auditnet.org

ERP GENERAL (SAP, BaaN, Oracle, PeopleSoft) 

ITtoolbox a knowledge network and support environment for the IT industry containing a section on ERP with links to SAP, BaaN, Oracle, PeopleSoft and more.

Audit and Security Strategies for PeopleSoft Implementation

Layer Seven Security  -Layer Seven Security specialize in SAP security. The company serves customers across the globe to protect SAP systems against internal and external threats and comply with industry and statutory reporting requirements. We fuse technical expertise with business acumen to deliver unparalleled implementation, consulting & audit services targeted at managing risks in contemporary SAP systems.

The following documents were shared by Larry Hanson ISACA-LA Chapter) and are available to subscribers from the audit programs section of AuditNet.

BaaN Business Process Controls

BaaN Security

ERP Systems: Audit and Control Risks

Introduction to ERP: Overview of ERP Systems

PeopleSoft Business Process Controls

PeopleSoft Security

SAP Business Process Controls and AIS

AUDIT PROGRAMS

1. Oracle Application Audit

2. Oracle Database Auditing

3. Oracle DB Technical Audit Program  

4. Oracle Financials Security Checklist

5. Oracle Infrastructure Audit

6. Oracle Inventory Audit

7. Oracle Security Guide

8. PeopleSoft Audit Review

9. PeopleSoft Audit Program 

10. PeopleSoft Audit Release 7.X 

11. SAP Accounts Payable Audit Program
12. SAP Audit Info. Approach 
13. SAP Audit Program (Word)

14. SAP Audit Program 

15. SAP Fixed Assets
16. SAP-HR Audit Program
17. SAP Materials Management

18. SAP Process Controls Audit Program

19. SAP Security 

20. SAP Systems Parameters Review
21. SAP Transaction Codes

AUDIT GUIDES

1. Auditing SAP R/3

2. Auditing SAP Basis

3. Auditing in an SAP Environment presentation by Phil Moulton

4. SAP R3 Auditing Manual 

5. SAP R3 Auditing Guidelines

6. Introduction to the SAP/R3 System Focusing on Audit Aspects

BEST PRACTICES

Better Practice Guide - Security and Control for SAP R/3  from the Australian National Audit Office.

CHECKLISTS & ICQs

1. Oracle Audit Checklist

SAP PRESENTATIONS

Auditing in an SAP Environment   Phil Moulton

Fraud Auditing in an SAP Environment Phil Moulton

REPORTS

SECURITY

SAP Security Administration SANS Institute Information Security Reading Room

TRANSACTION CODES 

SAP Transaction Codes

SAP Transaction Codes with Report and Description

---

General SAP R/3 Security Administration

Topic	File	Description
Designing Roles	Security Design Concepts	A presentation on responsibility of Security provided by Pandya, Snehal , nice system risk matrix.
Designing Roles	Authorization Design	A presentation provided by Pandya, Snehal  on role design.
Upgrade	SAP Security Upgrade White Paper	Upgrading to Role Based Profiles
SOD	Segregation of Duties Matrix	This was written by SAP and is based on transactions level authorizations
Business Warehouse	bwauthconcepts_JUDI_1204.pdf	Business Warehouse Security Overview
Business Warehouse	Training Document for Learning BW Security	I am writing this document as I have time. Gary Morris
HR Structural Authorizations	Structural Authorizations Step By Step	HR Security Doc by Norm and Carl provided by Amy Sue Lambermont.  Thanks Amy!
Security Setup	System Parameters	System Parameters related to security
Training Ids	Creating Users Script	Step by Step Guide to setting up Training IDs and setting same password, Woo Hoo!!
RBE	Using the RBE Tool for Security	A document from Larry Justice on How to use the RBE tool for Security
Controls	Configurable Controls.ppt	A ppt on configurable controls
ESS	Security for ESS.ppt	a ppt on Security for Employee Self Service and Manager's Desktop
R/3 Security Overview	SAP Audit Information	foundational R/3 security information
R/3 Security Overview	SAP Security
Security Tools	Toolstocontrolrisk.ppt	A PPT on tools to mitigate Risks in R/3
Security Administration	UserSecurityDelta.ppt	A ppt on User & Security Administration for e-Procurement at Delta Air Lines
Security Administration	Authorizations made easy 45A/B	The Authorization Made Easy Guide for 45A/B
Workplace	DWorkplacesecurity.ppt	A ppt on Workplace Security
	SAP_System_Parameters.pdf
Workplace	WorkplaceSSO.ppt	A ppt on Workplace Single Sign On
User Buffers	auth/new_buffering	Info on auth/new_buffering
Authorization Objects	User Administration Authorizations	Critical Authorization Objects that control User administration access
Third Party Tools	BindviewSAPControl overview.ppt	Overview of the Bindview Control product
Third Party Tools	bv_sap_sample_reports.ppt	Sample Bindview Control Reports
Third Party Tools	bv-ControlSAPds1.pdf	Bindview Information
Third Party Tools	bvcvsSAP.doc	Bindview Information
Third Party Tools	SAPCaseStudy.pdf	Bindview Information
CUA	CentralUserAdmin.ppt	A ppt on Central User Administration
CUA	Quick run through of how to setup	A quick list of  how to setup CUA
CUA	Central User Administration	A ppt on Central User Administration management
CUA	Delta Central User Admin.ppt	A ppt of Central User Administration at Delta Airlines
CUA	personeldevcua.pdf	A pdf by P.M.V. Subba Rao
RBE	STEPS TO GENERATE RBE EXTRACT FILE	Document on using the RBE tool to analyze transaction usage.
Security Audit Logs	Format of Security Audit Log Files
Security Audit Logs	SECAUDLOGONLINE_EN.pdf	SAP Manual on Security Audit Logs
Security Audit Logs	sec_audit_log_param.txt	Setup Security Audit Logs
SAP Security Guide Ver 3	secguide.zip (unzip and use index as starting page)	The Official SAP Security Guide Version 3
Security Audit Logs	Security Audit Logging with SM19	All the steps needed to setup Security Audit Logging
Security Audit Logs	Security Audit Log Filters SM19	SM19 Enabling Dynamic Filters for Security Audit Logs Example
Security Audit Logs	Analyzing Security Audit Logs	SM20 Analyzing Security Audit Logs Examples
Security Audit Logs	sap_note_135210_secAudLog.txt	Why the Security Audit Logs lose their Settings when system reboots
Tips	Resetting SAP*	ABAP Code for resetting SAP* password across all clients
SAP Security Guide Ver 3	sapsecurityguidever3.pdf
SAP Security Guide Ver 2	securtyguidever2vol3checklists.pdf	SAP Security Checklists
Security Administration	business_user_adm_mysap.pdf
Workplace	Roles workplace.ppt
CRM	CRM_AUTH_20C.pdf
All Activities	tact.xls	Table TACT
Security Adminsitration	Users_and_Roles_620.pdf
Designing Roles	Security Naming Convention
Secure OS	SECUREOSSEN.pdf
Security Overview	System Security Overview.ppt

SAP PRODUCT VENDORS

Realtime North America - vendor of BioLock, SAP certified biometric identity management system.