Workflow application - Automated Sox-Compliant User Maintenance

1. A General Mills Workflow Application: Automated, SOx-Compliant User Maintenance Bijay Shrestha / Luis Martins Nov. 7–10, 2004

4. Some of our best known brands

6. SAP landscape at General Mills

9. Old Form (Word doc)

15. Integration with CUA Role assignments are triggered in the CUA child/component systems and committed in the central system via standard SU01 BAPIs/function modules. CALL FUNCTION 'BAPI_USER_CREATE1‘ DESTINATION V_CONNDEST… … CALL FUNCTION 'BAPI_USER_LOCACTGROUPS_ASSIGN' DESTINATION V_CONNDEST…

16. Request type CREATE Proposed role assignments What-if analysis for proposed role assignments Job Roles automatically enter the corresponding security roles in the request.

17. Job Role selection Each job role is composed of two or more security roles. Requestors do not need to know the PFCG role name when setting up user access.

18. Request type UPDATE Current role assignments CANCELLED or REJECTED requests can be copied and re-submitted after correction. Requests can have a NORMAL or CRITICAL priority

19. Real-time detection of SOD conflicts Real-time alert regarding SOD conflicts caused by proposed role assignments.

20. SOD conflicts in submitted request Requestor can SUBMIT or CANCEL the request.

21. SOD conflicts at authorization object level

22. Confirmation for email & workflow routing Confirmation triggers Outlook email and work item to higher level approvers.

23. Email to Role Owner/Approver List of security roles that require approval from Role Owner(s).

24. Approver’s inbox in Universal Work List (UWL) Pending requests from multiple SAP systems.

25. Approver’s inbox in Business Workplace (SBWP) Execution of work item opens screen with security request data.

26. APPROVED request – Role Owner Request in APPROVED status with pending SOD conflicts triggers Outlook email and work item to higher level approver – Assertion Coordinator.

27. Email to Assertion Coordinator (SOD Approver) List of SOD conflicts that require approval from Business Assertion Coordinator/SOD Approver.

28. SOD Approval – Assertion Coordinator Request can be APPROVED or REJECTED.

29. COMPLETED request – Assertion Coordinator Confirmation of completed request.

30. Confirmation email to initiator ( COMPLETED )

31. Request type DELETE Requestor must provide reason for deleting a user ID.

32. Substitution rule in request type DELETE Substitution user ID required for users with pending work items.

33. Reporting & system-based tracking/auditing Requests can be tracked using several search criteria.

34. Reporting & system-based tracking/auditing (cont.)

37. 312 Session Code: