In any SAP application or module, auditors expect you to implement numerous application controls. Having these controls in place is important not only from an audit perspective, but also for risk management and mitigation. Each enterprise has a set of application controls that are most critical to its operational well-being and efficiencies.

Of the myriad financial processes that an enterprise runs, one of the most important ones is the financial closing process. If your enterprise uses SAP as its financial system of record, you are almost certain to be running your financial closing in your SAP system. It goes without saying that you want adequate controls to be in place for this most critical activity. While there are numerous risks and accompanying controls in the financial closing process, I will discuss only five specific control risks that every enterprise faces in the financial closing area, their potential impact, and what you can do to mitigate such risks. I have chosen these five risk scenarios because of the high frequency of their occurrences in my experience with SAP financials modules and sub-modules.

Risk Scenarios

Scenario 1: Sometimes, a period is not manually closed in the SAP system, thereby causing postings to take place in a prior period. This results in various accounting errors such as amounts being posted to wrong periods, which could lead to revenues and expenses being recorded in the wrong period.

Mitigation: Include a regular period closure activity as part of your SAP operational procedures. As a best practice, at any given time no more than two periods should be open for the various account types. You should also review the period closing activity logs to ensure that periods are being closed per your enterprise's schedule. A regular review of this log helps you take timely corrective action.

Use transaction OB52 or follow menu path: IMG > Financial Accounting (New) > Financial Accounting Global Settings (New) > Ledgers > Fiscal Year and Posting Period > Posting Periods > Open and Close Posting Period. Click the Utilities menu and then the Change Logs menu item. Click the Logging: Display Status button to display a pop-up window (Figure 1). The check box that enables or disables logging is circled in the figure. You need to make sure that it is turned on to mitigate this risk. You can check the logs by entering appropriate selection criteria such as start date, end date, start time, and end time in the respective fields of the first screen in Figure 1. You can also control the display features of the log output by checking or unchecking one or more check boxes in the Output Options section.

Figure 1

Set logging of changes to posting periods

Scenario 2: Enterprises widely use the park document functionality wherein you hold a document in a temporary state without actually posting it. In other words, a parked document has no accounting impact in the system in which it is parked. Often, due to a lack of a standard operating procedure around review of parked documents, the parked document list becomes a long one. This could lead to such documents not being posted to your SAP system in the correct accounting period — or not posted at all.

Mitigation: Include a review process for parked documents in your standard operating procedures. This particular activity should occur at least once prior to each period-end closing. Because you can enter parked documents in several FI modules such as AP, AR, and the SAP General Ledger in each of the document maintenance transactions such as FBL1N, FBV3, and FBL5N, you can indicate that you want to view all parked documents. Ultimately, they invoke report RFPUEB00. This report has numerous selection parameters that help narrow your search. Figure 2 shows you the selection screen of this report. You can reach this screen by using transaction FBV3 and clicking the list icon, or by running report RFPUEB00 in transaction SE38, if you have access.

Figure 2

Selection screen for parked documents report

After you identify these parked documents, go to the document maintenance of each document by double-clicking the document number and take the necessary action such as posting the document (assuming you indeed want to post it).

Scenario 3: The global settings in your SAP system for a particular company code may be set erroneously, thereby affecting your financial data. The impact can include inaccurate financial data and misstatements. These global settings include (but are not limited to) the correct entry of country, chart of accounts, and several other processing parameters.

Mitigation: Configure these global settings based on information that's correct for the company code in question. Enter the settings in the IMG by using transaction OBY6 or by following menu path Financial Accounting (New) > Financial Accounting Global Settings (New) > Global Parameters for Company Code > Enter Global Parameters. Highlight the relevant question code and double-click (Figure 3).

Figure 3

Maintaining global data for company code

Here are suggestions for the minimum information that should be entered and what the respective values should be assuming that this is a productive company code:

• Chart of Accts: Enter the chart of accounts in use for this company code
• Company: Its value should be the ID assigned to this company
• Credit control area: Set this to the credit control area that's being used
• Fiscal Year Variant: Its value should specify the company's fiscal year, number of posting periods, and number of special periods. Therefore, you should set it to the identifier that encapsulates your company's posting period framework.
• Company code is productive:  Check this check box when the company code is in production
• Document entry screen variant: This should be set accordingly depending on whether the company deals with withholding taxes
• Max. exchange rate deviation: This is the percentage of exchange rate difference that you are willing to tolerate for documents entered in a foreign currency for this particular company code. When you enter the exchange rate in a document (header), the system checks the tolerance percentage against the exchange rate value in your currency tables and the system displays a warning if you exceed the tolerance level. You should therefore enter an appropriate value in this field.

In Figure 3, you can see the settings for company code 1000, which is not currently productive. One of the settings that stands out is the chart of accounts selected for a US company code: CANO. This chart of accounts is for Norway and in all likelihood this was an erroneous selection because in the standard SAP-delivered charts of accounts, this one immediately follows the one for North America (CANA).

Scenario 4: During the document posting process, users might receive an update termination message. While the reasons that lead to this message are technical in nature and beyond the scope of this article, the manifestation of this error can lead to misleading conclusions. The system tells you that the document is posted with a particular document number. When you try to view the document, you get the update termination message. The implication of this situation is that this document has not really been posted and therefore can lead to financial misstatements and inaccuracies. I have been in many situations in which a review of such errors has not taken place or no troubleshooting has been done, which produces serious repercussions.

Mitigation: Troubleshoot this error immediately. This starts off as a technical analysis in transaction SM13. An end user is highly unlikely to have access to this transaction code so it is his or her responsibility to notify the technical support team as soon as he or she encounters this error. If you are an end user or part of the management team, you should review the results of report RFVBER00 (technical name) on a regular basis. This report produces a list of FI documents that have had update termination errors. Even if you do not inform your technical support team, carrying out this activity on a regular basis provides you with a list of documents that have encountered this error and therefore need troubleshooting and resolution. Figure 4 shows the selection screen of this report.

Figure 4

Selection screen of report RFVBER00

Scenario 5: Sometimes posted financial documents are reversed in the SAP system without the proper reversal document type being assigned to them. This omission may lead to financial misstatements.

Mitigation: Make sure that you have assigned a reversal document type for each document type in your system. Obviously, before you assign a reversal document type you should understand why you are assigning this document type. If the reversal document type is unassigned, the system assigns the original document type as the reversal document type when a reversal document is posted. This is inaccurate. To assign a reversal document type to the original document type, use transaction OBA7 or follow IMG menu path Financial Accounting (New) > Financial Accounting Global Settings (New) > Document > Document Types > Define Document Types for Entry View. Double-click on the desired document type (KR in this example) and enter the reversal document type (KA in this example) as shown in Figure 5.

Figure 5

ntering the reversal document type for a particular document type

Anurag Barua

Anurag Barua is an independent SAP advisor. He has 23 years of experience in conceiving, designing, managing, and implementing complex software solutions, including more than 17 years of experience with SAP applications. He has been associated with several SAP implementations in various capacities. His core SAP competencies include FI and Controlling FI/CO, logistics, SAP BW, SAP BusinessObjects, Enterprise Performance Management, SAP Solution Manager, Governance, Risk, and Compliance (GRC), and project management. He is a frequent speaker at SAPinsider conferences and contributes to several publications. He holds a BS in computer science and an MBA in finance. He is a PMI-certified PMP, a Certified Scrum Master (CSM), and is ITIL V3F certified.

You may contact the author at Anurag.barua@gmail.com.

If you have comments about this article or publication, or would like to submit an article idea, please contact the editor.