SAP ERP security as part of financial audit in a large business environment

The aim of this diploma thesis is to present the methodology that is used, to test the design and implementation of internal application controls in environment of large companies using ERP systems, especially in the environment of companies using SAP ECC. This methodology is described in the thesis. Practical task which is aimed at verifying the security level of SAP ECC in real business environment is also part of the thesis. The practical part is composed of a detailed description of IT auditors individual steps of the testing procedure, a list of security elements, which are subject to an audit procedures and documents required for verification of the control effectiveness implemented in clients environment. Furthermore, there is a summary and evaluation of the risk level associated with identified deficiencies. Part of the evaluation is a list of recommendations, which the company should apply to increase the efficiency of internal controls and thus achieve the optimal security level of SAP ECC. In the final section of the diploma thesis there is an analysis of the deficiencies elaborated. These deficiencies have been identified during the audit season in 2016 in environment of 20 large companies using this ERP system. Identified findings are classified according to the risk level. Another part of analysis are comprehensive recommendations that IT auditors provide to their clients in order to increase the security level of IT environment, especially in connection with the management and other activities related to financial data.