Вы находитесь на странице: 1из 92

A udit

I nformation
S ystem
Peter Schiwek
Solution Management Financials, SAP AG
A udit
I nformation
S ystem

Peter Schiwek
Solution Management Financials, SAP AG
Overview

Evolution of Auditing

AIS – The Tool

Evaluation Methods

Implementation

Contacts

SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 3
Evolution of Modern Auditing

Sarbanes
Rating Oxley Act
Basel II
Every individual
sees their
IAS environment
from their own
personal point of
US-GAAP view.
The auditor‘s
GoB duty is to make
GoBS an objective
judgment.
GDPdU
Continuous
Audit

SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 4
Corporate Governance

Sarbanes Software
Rating Oxley Act Certificate Parallel
Basel II Valuation

IAS SEM
Risk Mgmt, Consolidation,
Bal. Scorecard, Man.Cockpit
US-GAAP
AS / DRB
GoB Archive Information
System
GoBS
MIC
GDPdU / DART
Management of
Continuous Internal Controls
Audit Information
Audit System

SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 5
Digital Audit

A result-oriented audit view is


- in an environment of mass transactions -
only possible with
computer-supported audit or control procedures

Au d i t
I nformation
S ystem
SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 6
Overview

Evolution of Auditing

AIS – The Tool

Evaluation Methods

Implementation

Contacts

SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 7
Audit - Information - System

Collection,
structure,
presetting
of standard SAP Reporting

Improvement
of the audit process
and of audit quality

Individual selection and


preparation of data

Data export
-document data
-account balances
-financial statement data

Reconciled with:
- ACL
- IDEA
- AuditAgent
...
SAP DB
SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 8
Audit Environment – External audit
Prüfungsumgebung – Externes Audit

Own Software SAP environment


(auditing approach)
Audit planning BKPF

BSEG(..A)
Work program
- System Audit •Online controls GSEG
- Business Audit on the SAP database SKA1/SKAT

Export interface
Analysis software -System information SKB1

( ACL / IDEA / … ) Line items SKC1A


-Reconciliation
-Balance sheet/P+L KNA1
-Balances KNB1
Reporting software Balances -Accounts
KNC1
-Documents
...
Work Paper •Data export
...
-Line items
Report ...
-Account balances

SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 9
Audit Environment – Internal audit

SAP environment

Audit Management
BKPF

Planning BSEG(..A)

GSEG
•Online controls
Auditing
on the SAP database SKA1/SKAT

Export interface
Reporting -System information SKB1

SKC1A
-Reconciliation
Corrective Action -Balance sheet/P+L KNA1
-Balances KNB1
Documentation -Accounts
KNC1
-Documents
Analysis ...
•Data export
...
Analysis software -Line items
Line items
( ACL / IDEA / … ) -Account balances ...

SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 10
Audit Environment

Audit
Documentation / Maintenance

Step n
Step 1

Step 2

Step 3

Step 4

Step 5

Step 6
Enterprise Process

Risk Assessment
Audit Measure
... ... Audit Result ... ...

SAP standard roles Individual auditor menu

G/L accnts Customers Vendors Inventory


Vendors Receivables
Financial
Receivables Cash Payables Inventory Revenue Data export
Instruments

Personal Data Customers


Revenue ...
expense export

SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 11
Authors

Bansbach Schübel Brösztl & Partner

Deloitte & Touche

Ernst & Young Deutsche Allgemeine Treuhand AG

KPMG Deutsche Treuhand-Gesellschaft

Price Waterhouse Coopers

SAP User Groups

Internal auditors from various companies


SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 12
AIS, Views / Target Groups

System Audit Business Audit Tax Audit

Internal
Auditors

External
Auditors

Data Security
Officers

Tax Auditors

Audit-specific documentation + training

SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 13
The Audit Information System

The Audit Information System


facilitates smoother and better
quality audits.
It consists of a number of single
roles and is a
- Collection,
- Structure, and
- Default setup
of SAP standard programs

The AIS is the Toolbox


of the auditor
in SAP-Environment.

SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 14
Structure and Operation

For a specified organization,


the auditor receives
a selection of evaluation programs
with preset control data
for each audit area to be checked.

SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 15
Structure and Use

Control data which occurs in


multiple variants is defined as a
variable
- TableTVARVc
- Arg. AUDI*

This data is updated at the


beginning of an audit with the
function "Customizing AIS".

This ensures proper control for all


evaluations run during the course of
the audit process.

SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 16
Documentation in the Reporting Tree

AIS Documentation
Information on audit steps

SAP Library
Selected chapters

IMG Documentation
selected table areas

Internet Links
selected WEB Addresses

SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 17
System Audit

Information retrieval using


System Audit existing programs sorted by
component
Audit- Development-IS
IS Benutzer-IS
Users and Authorizations

Repository / Tables
ADM950
ADM960
Security
guide
CA940
-----------
SAP

SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 18
System Audit

SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 19
Business Audit

The closing operation view for a


Business Audit single company is possible
Audit- G/L IS
Customer IS Top Down View:
IS
Vendor IS Balance sheet / P&L
Assets IS Accounts Vouchers
Procedures

AC900/
Internationally deployable
Audit FIN900
guideline
----------
User group

SD FI
MM CO
PP AM
SAP
QA PS
PM
R/3 WF
HR IS

SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 20
Business Audit

SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 21
Tax Audit

Tax-Role
Tax Audit Direct (Z1) and
indirect (Z2)
Data file Direct /
provided indirect access to tax-relevant data.
data access
Data file analysis (Z3)

D A R T (Data Retention Tool)


WDE680 Extraction and storage of
DART tax-relevant data.
Source Extract

Transaction data
Transaction data
...
Master data
Master data
Metadata
Views
Data provided (Z3)
- SAP Audit Format -

SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 22
Tax Audit

SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 23
SAP Education Offerings – Corporate Governance

Knowledge is Power, Knowledge is Productivity

SAP FIN: mySAP ERP Financials Overview


Gain an overview of the mySAP Financials solution,
including data analysis

FIN900: Auditing with SAP


Understanding configuration for SAP system security and
authorizations, including the Audit Information System

FIN910: Management of Internal Controls


Focus on configuration of the SAP MIC application suited
for SOX / internal controls teams

WDE680*: GDPdU in SAP Systemen


Using the SAP DART tool to comply with German
Steuersenkungsgesetz

* this course is offered only in German

SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 24
Overview

Evolution of Auditing

AIS – The Tool

Evaluation Methods

Implementation

Contacts

SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 25
Evaluation Methods, ABAP

List
SAP - DB

Dialog

ABAP
Drill-
down
Allgemeiner Berichts- und AufbereitungsProzessor
or
Advanced Business Application Programming Extract
(flat file)

ABAP is the programming language used in R/3.

SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 26
ABAP Reporting / Calling Up Reports

Calling up reports Report selection w/ GL


using the Legal requirements
application menu Account
G/L account balances

Calling up reports System


directly using the Services
system menu Reporting

Program: RFSSLD00

G/L Acct.balances
RFSSLD00

SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 27
ABAP Reporting / Using Variants

Call report
G/L Account balances/RFSSLD00 Variants for RFSSLD00

VAR1 :
with variant (1) Chart of accounts INT
G/L Account 1-999
Company code T-BUK
Fiscal year T-GJAHR
G/L Account balances
VAR2 :
Chart of Accts. INT Chart of accounts INT
G/L Account 1-999 Company code T-BUK
Company code 0001
Fiscal year 2999 VARn :

Table of variables

T-BILANZ INT
G/L Acct.balances T-BUK 0001
provided by program T-GJAHR2999
RFSSLD00 T-from/to 0100 - 0999

SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 28
Evaluation Methods, Query

List
SAP - DB

Dialog

Query
Drill-
down
SAP Query

The application SAP Query is used to create lists


not already contained in the SAP standard. Extract
(flat file)
It has been designed for users with little or no knowledge
of the SAP programming language ABAP.

SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 29
Query = Individual DB Inquiries

Individual inquiries for information


from the SAP database are solved
with
Query.
Audit relevant data fields are setup
in InfoSets.
The auditor defines the record
structure, selection and sort criteria,
Query summaries, statistics, ranking list,
processing
and the layout of an evaluation.

Definition of individual lists The export of a flat-file enables


continued, problem-free processing.
Record
Selections
Download

Starting lists

SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 30
Query

SQ02 InfoSets SQ03 User groups

Selection of a Assignment of users


logical database to functional areas
Grouping fields Benutzer und InfoSets
zuordnen
Definition of help fields

Administrative level
Operational level

SQ01 Queries

Definition of lists

Starting lists

SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 31
ABAP Reporting / Query

Logical database Report List

Reporting
e.g. SD F (ABAP)
ABAP-

(Selection +
SAP
SAP- DB
DB formatting)

Reportgenerator
Query
•List
Query

InfoSet definition
•Execute

Create a list with


Report: Instructions of a programming language (ABAP)
Query: Description of a desired result

SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 32
SAP Data Organization

Administrative Master data /


view Documents / ... Master Documents

SKA1
Physical Database SKB1 BS I S BKPF
view tables:
GLT0* BSEG

Logical Logical SKA1 (Chart of accts.)


view database:
(e.g. SD F)
SKB1 SKB1 (Company code)

S K C 1* S K C 1* (Fiscal year)

BS I S

BKPF

BSEG GSEG

SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 33
Logical database, Data Retrieval, Output

Customer
4711 1 4712 8
KNA1
CoCd
0001 2 0002 5 0001 9
KNB1
Year
1996 3 1997 4 1996 6 1997 7 1995 10 1996 11
KNC1

1 8

4711 4712
t
0001 0002
2 5
1996 1997 1996 1997
3 4 6 7

printline 1 1
printline 2 3
printline 2 4
printline 2 6
printline 2 7

SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 34
Logical database, InfoSet, Query

A/R : DD F (Doc. index) Docs : BR F


KNA1 BSID (..EXT) BKPF

KNB1 BSIK (..EXT) BSEG(..A)

KNC1 BSIS (..EXT) GSEG(..A)

A/P : KD F
Logical database DD F KD F SD F BR F
LFA1
InfoSet FI DD FI KD FI SD FI BR
LFB1 Queries
LFC1
Data export / ED EK ES EB
Document analysis:

Offsett.acct.analysis: OD OK OS
G/L : SD F
SKA1 / SKAT Variance analysis DD DK
inc./outg. payments:
SKB1
Compare payment terms: P D PK
SKC1A
Document Journal: JB

SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 35
Log. Database, BR_F or DD_F, KD_F, SD_F

DocNo
DocNo010123
010123 02.01.00
02.01.00 CB
CB 01
01 Cust1
Cust1
Cust1 Debit
Debit
Debit 1.000
1.000 Total volume
50
50 Sales1
Sales1 Credit
Credit 950
950
50
50 Tax
Tax
Tax Credit
Credit
Credit 50
50

DocNo
DocNo010124
010124 04.01.00
04.01.00 CB
CB 01
01 Cust2
Cust2
Cust2 Debit
Debit
Debit 2.000
2.000
50
50 Sales1
Sales1 Credit
Credit 1.500
1.500
50
50 Sales2
Sales2
Sales2 Credit
Credit
Credit 400
400
50
50 Tax
Tax
Tax Credit
Credit
Credit 100
100

DocNo
DocNo 010123
010123 02.01.00
02.01.00 CB
CB 01
01 Cust1
Cust1 Debit
Debit 1.000
1.000 Export out of BR_F
DocNo
DocNo 010123
010123 02.01.00
02.01.00 CB
CB 50
50 Sales1
Sales1 Credit
Credit 950
950
DocNo
DocNo 010123
010123 02.01.00
02.01.00 CB
CB 50
50 Tax
Tax Credit
Credit 50
50 from DocNo 010123
to DocNo 010124
DocNo
DocNo 010124
010124 04.01.00
04.01.00 CB
CB 01
01 Cust2
Cust2 Debit
Debit 2.000
2.000
DocNo
DocNo 010124
010124 04.01.00
04.01.00 CB
CB 50
50 Sales1
Sales1 Credit
Credit 1.500
1.500
DocNo
DocNo 010124
010124 04.01.00
04.01.00 CB
CB 50
50 Sales2
Sales2 Credit
Credit 400
400
DocNo
DocNo 010124
010124 04.01.00
04.01.00 CB
CB 50
50 Tax
Tax Credit
Credit 100
100

DocNo
DocNo 010123
010123 02.01.00
02.01.00 CB
CB 50
50 Sales1
Sales1 Credit
Credit 950
950 Export out of SD_F,
DocNo
DocNo 010124
010124 04.01.00
04.01.00 CB
CB 50
50 Sales1
Sales1 Credit
Credit 1.500
1.500
G/L account: Sales1

DocNo 010123 02.01.00 CB 01 Cust1 Debit 1.000


Export out of DD_F,
Account: Cust1

SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 36
Query, Output format

Online list Interactive list

Export general Export -SAP Audit Format-

•Query-User Exit, Private Storage


•AIS - Include module, RXQUEU00

SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 37
Online-Controls: Special Queries for AIS

Document analysis
• Documents in general
• A/P A/R G/L line items
flexible selection for the data retrieval
flexible analysis of the data deemed critical
using ALV functions

Dubious Documents
• Document Journal
(with holiday calendar)
Posted on Sunday or holidays?
Posted at unusual times? ...

Account Analysis
• A/R
• A/P
• G/L accounts
Offsetting account analysis
Even distribution of postings? (in Days/Months/Year)
Unusual document origin? (manual, SD, MM, HR, ...)
Posted in timely manner? (BUDAT – CPUDAT)
Documents with the greatest volume (+/-)

SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 38
Online-Controls: Special Queries for AIS

Comparison of Terms
• A/R
• A/P
Terms and conditions, base date, days 1, %, days 2, %, net
Values in document
- Values in master data
=Variance (shows manual changes)

Variance Analysis
• A/R (Payments received)
• A/P (Payments sent)

Payments out of the norm


- Standard condition per master data (days / %)
- Condition taken as found in document
- Variance (shows payment tendency)

Critical Clearing Processes


• A/R

Clearing of a non-payment-related transaction ?


Clearing via reversal ?

SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 39
Account Analysis G/L A/P A/R (Query – ABAP list)

Offsetting
Accounts

Buchungs-
volumen

Daily
Volume

Timely
Update

Business
Transact.

Documents

SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 40
AIS – Export of Data

G/L Account Balances


Document Data
Document Items
- G/L Account
- Customer
- Vendor
OI‘s per Key Date
- Customer
SAP Audit
- Vendor Format
Master Data Records and
Document Data from Archive
Balance Audit Trail
- G/L Account
- Customer
- Vendor
Tax-relevant Data

SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 41
AIS – Export of Data

SAP DB

Download
Single audit

Stochastic auditing methods


(statistical sampling algorithms)

ACL IDEA ...

SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 42
AIS – Export of Data
(Defined Output Record)
SAP- ABAP Reporting
(Several exp. reports)
SAP- ABAP Query (Download
SAP DB (Individually formatted) )

(Download)

- ASC
- BIN Company Mister & Sons
- DBF Balance list per 12/31/YYYY
- IBM
- WK1 Acct. Name/Location Amount
- DAT 4715 Anthony
Oregon 100.00
4899 Karl
Liverpool 23.50

Total 123.50
- SAP Audit Format -

SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 43
AIS – Export of Data

SAP Audit Format

SAP - DB Established
Batch

analysis software
for auditing

Data retrieval
User-Exit
TemSe
Online

Download
- SAP Audit Format -

Pfad (DIR_DATA):
D:\usr\sap\U9C\D60\data

SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 44
AIS – Export of Data (Query – Private file)

SAP - DB

SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 45
AIS – Export of Data, Meta data

Field catalog

Field documentation
+ current table content

Download

- SAP Audit Format -


1.Header line | Field name Field name Field name Field . . .
2.Header line | Description Description Description Desc. .
3.Header line | Field label Field label Field label Field. . .
4.Header line | Data type Datentyp Datentyp Datentyp
5.Header line | Field length Field length Field length Field. . .
6.Header line | Decimals Decimals Decimals Deci. . .
7.Header line | Currency Currency Currency Curr. . .
8.Header line | Special type Special type Special type Speci . .

9.Data record | Field 1 Field 2 Field 3 Field n

SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 46
SAP Audit Format: as easy as it gets

SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 47
SAP Program with archive access (FI example)

Archive files
R/3 Online-
Online-DB
Archive Development Kit (ADK)
Archive Information System (AS)
Document Relationship Browser (DRB)

sequential read
of archive files:

• Logical Database BRF Index access


to a single data object:
- RFBELJ00 Compact Document Journal
- RFBELJ10 Document Journal • FB03 Display Document
- RFEPOJ00 Line Item Journal
-...
- Query EB *** AIS *** Export/analysis from document database

SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 48
Online Evaluation Although Data is Archived

R/3 Online-
Online-DB

Master records Document index Documents


:
Customer1 Cust.1| 4711 | 100 :
100 : 4710 | 01 | Cust.5 | 350 |...
| 02 | Sales | 300 |...
| 02 | Shipping | 50 |...
4711 | 01 | Cust. 1 | 100 |...
Sales | 02 | Sales | 100 |...
100 :

Line Item Journal


OI / AP Lists
Queries (AIS)

SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 49
Account Update, a Database for Auditors?

SAP Online - DB Archive files

KL_F
Master
Documents
records

Classical account
KL_F
update

- SAP Audit Format -

SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 50
Query: Authorization Checks

Function: Object class: Basis development environment

Object: Field: Value:

S_Query Activity '23'

S_Query Activity '02'

S_Program P_Group “nnnnnnnn”


P_Action “Submit”

Application authorizations
SAP DB Activity '03'

SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 51
Evaluation Methods, Drilldown Reporting

List
SAP - DB

Dialog
Drilldown
Reporting
Drill-
down
SAP drilldown reporting

With drilldown reporting, SAP provides you


with an interactive information system
Extract
(flat file)
to let you evaluate the data
collected in your application.

SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 52
Data Recall Facility

Fin.Statmnt Vers.
from/to
• Assets Acct.No.
• Liabilities GLT0
• P&L

| Reporting Year | RY-1 | RY-2 | ... RY-n |

Column | 1/12 | 1/4 | 1/2 | 1/1 |

Row | Calculation column(s) |


x
| Financial stmnt ratios|
| Financial Statement

|
| calculation row(s) |

| Balance display

Cell
analysis

y
SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 53
Data Recall Facility

Report Method

• 0SAPBLNCE-01 Comparison of actual values between


years A GLT0

• 0SAPAUDIT-01 Financial statement key figures F

• 0SAPAUDIT-40 Export G/L balances D


• 0SAPAUDIT-41 Compare year-end balances (absolute,%) D
• 0SAPAUDIT-42 Compare balance carried forward with
balance brought forward D

A=Financial statement analysis F=Fin. stmnt key figures D=Balance display

SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 54
Drilldown Reporting (Data recall facility)

SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 55
Balance Sheet Ratios (Data Recall Facility)

Standardization of annual report


ratios.
The use of financial statement ratios
created in the Audit Information
System and their publication in
annual reports is designed to
smooth the transition to
comparative investment, financial
and profitability analysis.
Economic performance is measured
using period comparisons (in this
instance, of up to five years in
length).

SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 56
Transferring Balance Sheet Data (Data Recall Facility)

G/L Account info system

Balances
Financial
statement
SAP DB
data

Interface

External analysis tools


( ACL / IDEA / ... )

• Audit
• Report preparation

SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 57
Balance Transfer (Data recall facility)

G / L : SD F
SKA1 / SKAT

SKB1

SKC1A

SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 58
Balance transfer (Data recall facility)

SAP - DB

SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 59
Evaluation Methods, Information Systems

List
SAP - DB

Dialog
Information
Systems Drill-
down
Component-specific information tools:
General Ledger Information System
Accounts Receivable Information System Extract
Accounts Payable Information System (flat file)
Logistics Information System
Repository Information System
...

SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 60
Customer / Vendor Information System

SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 61
Evaluation Methods, DART

List
SAP - DB

Dialog

DART
Drill-
down
Data Retention Tool ( D A R T ):
Data retention and evaluation of
Tax-relevant data. Extract
(flat file)
Data extraction and storage
View query
Export function (SAP-Audit-Format)

SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 62
Export of Tax Relevant Data (DART)

SAP Online - DB

DART
Source Extract

Transaction data
Transaction data Assessment: „ Tax-relevant data“
...
Master data
Master data
Metadata
Views
Consistent data, Data provided (Z3)
prepared to meet - SAP Audit Format -
the requirements
of a tax auditor.
SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 63
DART - Audit Track – Outgoing from FI

DART extracts documents from financial accounting with the


associated preceding and follow-on documents.

Starting point:
Company code Financial accounting
Fiscal year FI ...
Periods

Valuation area CO
Cost accounting
AM SD

Asset accounting Sales and distribution


MM documents

Material documents
SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 64
DART – Extraction (example)
ANEK Valuation conditions
AM document
Valuation area header Asset value fields Cost center
GLT0 ANEP
AM document item
Asset assignments Internal order
Company code G/L account
balance
WBS element
years, periods ANEA
KNC1 Proportional values
Customer balances Profit center

LFC1 Asset
Supplier balances
VBRK Customer
SD billing header
BKPF
FI document header
Supplier
VBRP
Billing item Plant
BSEG
KONV FI document item
Pricing conditions Product

PAYR
VBAK FI payment transfer Address
SD document

VBAP MKPF
Sales document item MM document header

VBPA MSEG
Sales document MM document item Key
partner
Selection criteria
EKKO Transaction data
COBK MM purchasing document
LIKP CO document header Master data
SD delivery EKPO
header
COEP Purchasing document
item
LIPS CO document item
Delivery item

COFIS
SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 65 FI/CO reconciliation posting
DART - View Definition

> 1.200
Join-Bedingungen abrufbar
(Tabelle TXW_C_RELA )

für eventuelle
manulle
Join-Pflege
SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 66
DART – Output options

DART
Source Extract
SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 67
Further Processing in an Evaluation Tool

SAP Audit Format enables a very easy transfer to evaluation programs such as ACL and IDEA.
SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 68
Tools Used for Online and Batch Controls

ABAP

Query

Drilldown
Reporting

Information
Systems

DART
SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 69
Overview

Evolution of Auditing

AIS – The Tool

Evaluation Methods

Implementation

Contacts

SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 70
User Master Data and Authorizations

To facilitate working with the AIS, the


auditor needs a user in the SAP System.
This user master record requires a wide
range of display authorizations.

Several single roles have been defined


Auditor for the AIS. These single roles are divided
into two groups:
- Transaction roles
- Authorization roles

For a better overview, all single roles are


combined to a composite role
(SAP_AUDITOR).

Installation
recommendation:
SAP - DB SAP Note 451 960

SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 71
Installation recommendation :

SAP User

AIS – Single roles Copy / Modification composite roles


SAP_AUDITOR_ADMIN AUDITOR_ADMIN
A I S Administrator
SAP_AUDITOR_BA_ORGA Z_AUDITOR_BA_ORGA

SAP_AUDITOR_BA_FI_GL Z_AUDITOR_BA_FI_GL AUDITOR_INTERNAL_SA


System Auditor
SAP_AUDITOR_BA_FI_AA

SAP_AUDITOR_BA_FI_AR AUDITOR_INTERNAL_BA
Business Auditor
SAP_AUDITOR_BA_FI_AP

...
AUDITOR_EXTERNAL
External Auditor
SAP_AUDITOR_ADMIN_A

SAP_AUDITOR_BA_A Z_AUDITOR_BA_A
AUDITOR_EXTERNAL_TAX
Tax Auditor
...
SAP_AUDITOR_TAX_FI
...
SAP_AUDITOR_TAX_FI_A

SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 72
Installation recommendation :

1. Copy composite role SAP_AUDITOR


into the customer specific name space

2. Copy single roles as well

SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 73
Installation recommendation :

3. Maintain and generate AIS authorization roles

SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 74
Installation recommendation :

4. Assign AIS composite role Z_AUDITOR to the audit user

A user menu is only


visible if a role with
a menu is assigned to
the user.

SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 75
Installation Recommendation

5. Activate the user menu


The user menu can be
activated or deactivated generally
using a Customizing switch:

Table SSM_CUST
Switch ALL_USER_MENUS_OFF = YES
ALL_USER_MENUS_OFF = NO

Other required switch settings:

Switch DELETE_DOUBLE_TCODES = NO

Switch SORT_USER_MENU = NO

The user menu and/or SAP Menu can also be


activated or deactivated for specific users
with the setting: ALL_USER_MENUS_OFF = YES.

Table USERS_SSM
Switch User Menu
Switch SAP Menu

SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 76
SAP single roles (System Audit - Business Audit)

Meaning Transaction roles Authorization roles

Composite role „SAP_AUDITOR“ AIS - Audit Information System

Central Authorizations SAP_AUDITOR_A

Administration SAP_AUDITOR_ADMIN SAP_AUDITOR_ADMIN_A

System Audit SAP_AUDITOR_SA SAP_CA_AUDITOR_SYSTEM


( SAP_CA_AUDITOR_SYSTEM_DISPLAY )

Repository / Tables SAP_AUDITOR_SA_CUS_TOL SAP_CA_AUDITOR_SYSTEM

Users and Authorizations SAP_AUDITOR_SA_CCM_USR SAP_CA_AUDITOR_SYSTEM

Business Audit
- Individual Financial Statements
Organizational Overview SAP_AUDITOR_BA_ORGA SAP_AUDITOR_BA_A

Financial Statements - General

• Closing (GLTO) SAP_AUDITOR_BA_FI_GL SAP_AUDITOR_BA_A


• Data Export SAP_AUDITOR_BA_EXPORT_DATA SAP_AUDITOR_BA_A

• Special Ledger SAP_AUDITOR_BA_FI_SL SAP_AUDITOR_BA_FI_SL_A

Beginning with the following support packages, the System Audit is available in the SAP_BASIS component:
6.20 SAPKB62043 6.40 SAPKB64005 (see also note 754273)
SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 77
SAP single roles (System Audit - Business Audit)

Meaning Transaction roles Authorization roles

Business Audit
- Individual Financial Statements
Balance Sheet - Assets

• Fixed Assets SAP_AUDITOR_BA_FI_AA SAP_AUDITOR_BA_FI_AA_A

• Real Estate SAP_AUDITOR_BA_RE SAP_AUDITOR_BA_RE_A

• Material Inventories SAP_AUDITOR_BA_MM_IM SAP_AUDITOR_BA_MM_IM_A

• Accounts Receivable

• • Customers - Master Data SAP_AUDITOR_BA_FI_ARMD SAP_AUDITOR_BA_FI_ARMD_A

• • Accounts Receivable SAP_AUDITOR_BA_FI_AR SAP_AUDITOR_BA_A


• Treasury SAP_AUDITOR_BA_CFM SAP_AUDITOR_BA_CFM_A

• Cash Journal SAP_AUDITOR_BA_FI_CJ SAP_AUDITOR_BA_FI_CJ_A

Balance Sheet - Liabilities and Equity


• Accounts Payable

• • Vendors - Master Data SAP_AUDITOR_BA_FI_APMD SAP_AUDITOR_BA_FI_APMD_A


• • Accounts Payable SAP_AUDITOR_BA_FI_AP SAP_AUDITOR_BA_A

SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 78
SAP single roles (System Audit - Business Audit)

Meaning Transaction roles Authorization roles

Business Audit
- Individual Financial Statements
P&L

• Sales Revenue SAP_AUDITOR_BA_SD SAP_AUDITOR_BA_SD_A

• Raw Materials Consumed


• • Purchasing SAP_AUDITOR_BA_MM_PUR SAP_AUDITOR_BA_MM_PUR_A

• • Eingangsrechnung SAP_AUDITOR_BA_MM_IV SAP_AUDITOR_BA_MM_IV_A

• Personnel Expenses
• • Human Resources SAP_AUDITOR_BA_HR SAP_AUDITOR_BA_HR_A

Segment Reporting

• Profit Center Accounting SAP_AUDITOR_BA_EC_PCA SAP_AUDITOR_BA_EC_PCA_A

Internal Activity Allocation SAP_AUDITOR_BA_CO SAP_AUDITOR_BA_CO_A

- Consolidated Financial Statements


Consolidation SAP_AUDITOR_BA_EC_CS SAP_AUDITOR_BA_EC_CS_A

- Data Privacy Protection


Data Protection SAP_AUDITOR_DS SAP_AUDITOR_DS_A

SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 79
SAP single roles ( Tax Audit )

Meaning Transaction roles Authorization roles

Composite role „SAP_AUDITOR_TAX“

Central Authorizations SAP_AUDITOR_TAX_A

Tax Audit, Asset Accounting SAP_AUDITOR_TAX_AA SAP_AUDITOR_TAX_AA_A

Tax Audit, Controlling/Project System SAP_AUDITOR_TAX_COPS SAP_AUDITOR_TAX_COPS_A

Tax Audit, Financials SAP_AUDITOR_TAX_FI SAP_AUDITOR_TAX_FI_A

Tax Audit, Materials Management SAP_AUDITOR_TAX_MM SAP_AUDITOR_TAX_MM_A

Tax Audit, Sales and Distribution SAP_AUDITOR_TAX_SD SAP_AUDITOR_TAX_SD_A

Tax Audit, Treasury SAP_AUDITOR_TAX_TR SAP_AUDITOR_TAX_TR_A

SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 80
Preparatory Work

In order to work with the AIS, the


following needs to first be
completed:
- Maintain the AIS Roles
- Set up user master records
Set up the online help
Maintain the selection variables
Import recherche reports
Activate user exit
„SQUE0001, ABAP/4-Query:
Private storage of data“
All additional maintenance steps are
optional and merely serve to
optimize the use of the AIS
functions.
SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 81
Quick Links
http://service.sap.com/ais Audit Information System
http://service.sap.com/dart Data Retention Tool
http://service.sap.com/gdpdu Tax Reduction Law
http://service.sap.com/qm Audit Management

SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 82
AIS in SAP Demo System IDES R/3

A I S has been set up in the SAP I D E S Demo System.

Log on with user AUDITOR_FIN (Rel. 4.70).

welcom
e

SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 83
AIS in SAP Demo System IDES R/3

AUDITOR_FIN
welcome

Please note:
In the IDES System, the authorizations for user AUDITOR_FIN
are assigned via the IDES profile R3_BASIC.
The AIS authorization roles are not considered.
SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 84
The Development History of AIS

Until SAP Release 4.6C, AIS was


realized using a menu technique
(transaction SECR).

As of SAP Release 4.6, AIS is part of


the SAP Standard System

As of SAP Release 4.6C (Support


Package SAPKH46C27), the
technical implementation of AIS in
the program has been changed to a
role-based maintenance
environment (transaction PFCG).
Additional development of AIS will
only be carried out in this new
environment.

SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 85
Vision: Audit Framework
Primary data Audit Warehouse Auditing
(SAP BW)
Defined structures • Local Audit
SAP R/3 in a standard audit format • Collaborative Audit

Requests Offers
Condi- Auditor-Workplace
tions
Material FI CO
- Extractors -
docs docs docs
Doc
...
history - View -

G/L
Vendors Cust.
accts
CRM / SRM / ...
MM Asset
...
accts accts

- Extractors - Acct.
history

Table Table Table


000 001 005
Third-party software
Table Table
...
BSL history
- Extractors -

• Long term archive


• Auditable
SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 86
SAP Notes

SAP Release: 4.5 4.6A 4.6B 4.6C 4.70 5.00

0077503 Audit Information System (AIS) X X X X X X

0100609 Audit Information System (AIS) - installation X

0182699 Download of Query data (user exit) X X X X X X

0197137 Query Download from EBCDIC server X X X

0162971 AIS version history 3.x 4.0 4.5 X

0133914 Conversion of drill-down X

0190767 Collect note X

0202497 Collect note X

0376779 RSQUEU01: Missing FM "F4IF_INT_TABLE_..." X


0496534 Query export of large data X X X X X X

0202504 Collect note X

0328019 AIS Structure AUDIT_ALL does not exist X

0451960 AIS Role Concept X X X

0544650 Collect note X

0662882 Behavior of system variants for AIS X X

0751970 Collect note X

0754273 Availability of Systemaudit X X

SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 87
Overview

Evolution of Auditing

AIS – The Tool

Evaluation Methods

Implementation

Contacts

SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 88
Contacts Development

Project Management AIS


Business AUDIT
Tax-Audit

Peter Schiwek, SAP AG


FAX: +49 6227 78-16378
E-Mail: peter.schiwek@sap.com

System AUDIT

Product Management
SAP Security
E-Mail: security@sap.com

International Training (AC900) / Consulting


Fadi Naoum, SAP
Phone: +49-170-8555448
E-Mail: fadi.naoum@sap.com

SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 89
Contacts Rollout

Region BeNeLux Region Japan


Max Lamberts, SAP NEDERLAND Takashi Yamada, SAP JAPAN (Head)
FAX: +31 73/645 7 698 FAX: +81-3-3273-5697
E-Mail: max.lamberts@sap.com E-Mail: takashi.yamada@sap.com

Region Brazil Region Österreich


Sueli Nascimento, SAP BRASIL Jörg Hippa, SAP Österreich
FAX: +55 11550523072554 FAX: +43 1/28822-333
E-Mail: sueli.nascimento@sap.com E-Mail: joerg.hippa@sap.com

Region Deutschland Region Schweiz


Lars Gartenschläger, SAP DEUTSCHLAND Thomas Pfeifer, SAP SCHWEIZ
FAX: +49 6227 78-33090 FAX:
E-Mail: lars.gartenschlaeger@sap.com E-Mail: thomas.pfeifer@sap.com

Region Finland Region UK


Matti Halonen, SAP FINLAND Martin Wilson, SAP UK
FAX: +358 9/2536-4444 FAX: +44 20-89176465
E-Mail: matti.halonen@sap.com E-Mail: martin.wilson@sap.com

Region France Region USA, Canada, South America


Andre Streissel, SAP FRANCE David E. Nelson, SAP America
FAX: +49-6227-7-53848 FAX: +00-1-404 943-2950
E-Mail: andre.streissel@sap.com E-Mail: david.e.nelson@sap.com

SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 90
7 Key Points about SAP Audit Information System

1. SAP Audit Information System (AIS) is the auditor‘s toolbox


in the SAP environment.
2. It provides a structured, easy-to-learn access to audit-relevant
data in the SAP system.
3. AIS is being used by external auditors, internal auditors, tax
auditors and data security officers.
4. There are comprehensive online controls for system audit,
business audit, and tax audit.
5. AIS supports data export of master data, account balances,
and documents to 3rd party audit and analysis tools.
6. AIS can be implemented fast and with low effort, and easily
adjusted to the requirements of the customer.
7. AIS does only require few system resources.

SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 91
Copyright 2004 SAP AG. All Rights Reserved

No part of this publication may be reproduced or transmitted in any form or for any purpose without the express
permission of SAP AG. The information contained herein may be changed without prior notice.
Some software products marketed by SAP AG and its distributors contain proprietary software components of other
software vendors.
Microsoft®, WINDOWS®, NT®, EXCEL®, Word®, PowerPoint® and SQL Server® are registered trademarks of
Microsoft Corporation.
IBM®, DB2®, DB2 Universal Database, OS/2®, Parallel Sysplex®, MVS/ESA, AIX®, S/390®, AS/400®, OS/390®,
OS/400®, iSeries, pSeries, xSeries, zSeries, z/OS, AFP, Intelligent Miner, WebSphere®, Netfinity®, Tivoli®, Informix and
Informix® Dynamic ServerTM are trademarks of IBM Corporation in USA and/or other countries.
ORACLE® is a registered trademark of ORACLE Corporation.
UNIX®, X/Open®, OSF/1®, and Motif® are registered trademarks of the Open Group.
Citrix®, the Citrix logo, ICA®, Program Neighborhood®, MetaFrame®, WinFrame®, VideoFrame®, MultiWin® and other
Citrix product names referenced herein are trademarks of Citrix Systems, Inc.
HTML, DHTML, XML, XHTML are trademarks or registered trademarks of W3C®, World Wide Web Consortium,
Massachusetts Institute of Technology.
JAVA® is a registered trademark of Sun Microsystems, Inc.
JAVASCRIPT® is a registered trademark of Sun Microsystems, Inc., used under license for technology invented and
implemented by Netscape.
MarketSet and Enterprise Buyer are jointly owned trademarks of SAP AG and Commerce One.
SAP, R/3, mySAP, mySAP.com, xApps, xApp, SAP NetWeaver and other SAP products and services mentioned herein
as well as their respective logos are trademarks or registered trademarks of SAP AG in Germany and in several other
countries all over the world. All other product and service names mentioned are the trademarks of their respective
companies. Data contained in this document serves information purposes only. National product specifications may vary.

SAP AG 2004-10-13, Audit Information System, Rel. 4.6C / 4.70, Peter Schiwek 92

Вам также может понравиться