SoD-Matrix

At its core, an SoD matrix is a two-dimensional table in which individual people or roles are plotted against the various tasks and authorities within a process.

Using this form of overview, it is possible to quickly determine whether the segregation of duties has been neatly executed for all tasks or whether there is an accumulation of rights that gives an employee or a particular role too much authority. Where are there violations of the dual control principle? Is it necessary to revoke authorizations at individual points or to introduce new control mechanisms?

By appropriately dividing up the various tasks and functions and marking possible risks, it is also possible to illustrate the extent of the problems of possible compliance conflicts that exist in each case.

An SoD matrix is ultimately primarily a tool for making possible segregation of duties conflicts visible, addressing them, and, at the same time, being able to search for visually comprehensible solutions.

By using such a matrix, you can identify SoD conflicts, possible compliance violations in your company at an early stage. The overview gives you a basis for clarifying authorizations and cleaning up the mess of rights assignment.

This benefits you as a company first and foremost and protects you from misuse of authorizations, but also gives you security vis-à-vis auditors and audits.

In our working practice, we use SoD matrices as field-tested and ready-to-use templates for SAP compliance audits. Our matrix is based on 515 pre-built queries that can identify potential compliance risks.

SAP compliance queries can always be customized to your company's needs, so that the content of the matrix is based on what is really relevant for your company, your industry and your work.

In this way, your critical processes can be checked and secured very quickly, so that you are spared from audit violations and possible fines. With automated compliance checks in your system, we also offer you the opportunity to significantly reduce compliance management costs:

• Fixed integration of the compliance check in workflows for authorization assignment with subsequent documentation
• Automatic checks and warnings in the event of potential SoD conflicts
• Additional authorizations can be approved or rejected

Integrating compliance checks into Identity & Access Management (IAM) has clear advantages: You can document and control all rights, roles and accesses in a central location.

Of course, you retain full control over everything: If your own assessment of the risk should turn out to be different, you can still assign individual rights and have this immediately documented automatically. This gives you the option of resolving or mitigating individual violations manually and with a sense of proportion - and still have solid security regulations that largely rule out accidental compliance violations.