sap系统审计清单与程序

SAPAuditProgramI.General1.Obtainacompanyorganizationalchart.2.Obtainacopyofallsecuritypoliciesandprocedures.3.ObtainadiagramoftheSAPapplicationarchitecture.4.Obtainacopyof“problemtracking”or“incidentreport”fortheapplicationbeingaudited.5.Obtainacopyofallsystemenhancementsthatarequeuedupforimplementation.6.Obtainacopyoftheapplication’sdocumentation.7.Obtainacopyofthedevelopmentmethodologyusedtocompletethesystem.(BusinessandDesignRequirementsProcesses)8.Obtainacopyofanyservicelevelagreementsestablishedfortheapplication.9.Obtainacopyofthecontingency/backupplanfortheapplication10.ObtainacopyoftheCorporateDisasterPlan11.DeterminewhichreleaseofSAPisinstalled12.Identifythemodulesinstalled.13.Determinetheinterfacestotheproductionsystem14.Determinethenumberofclientsystemsrunning.15.DeterminewhichgeographicallocationsarerunningSAP16.Determinewhatlevelofcustomprogramminginon-goingABAP/4programsDataentryscreens17.EvaluatetheoverallSAPsecurityarchitecture18.Determinetheoperatingsystemsanddatabasemanagementsystemsrunningwithintheenvironment19.ObtainalistingofallSAPclientsTableT000hastheSAPclientsPath:SYSTEM-SERVICES-TABLEMAINTENANCESE16orSE17TableT001hasthecompaniesPath:TOOLS-ABAP/4WORKBENCH-OVERVIEW-DATABROWSER-TABLECONTENTS20.ObtainalistingofallgroupcompaniesListtableT042G21.ObtainalistingofallbusinessareasListtableTGSBandTGSBT22.ObtainalistingofallcreditcontrolareasListtableT014andT014T23.ObtainalistofallchartsofaccountsListtableT004andT004T24.ObtainalistingofallplantsListtablesT001WandTVKWZ25.ObtainalistingofstoragelocationsListtableT001L26.ObtainalistingofallpurchasingorganizationsListtableT024W27.ObtainalistingofallpurchasinggroupsListtableT02428.ObtainalistingofallsalesorganizationsListtableTVKOandTVKOT29.ObtainalistingofdistributionchannelsListtableTVTW,TVTWT,andTVKOV30.ObtainalistingofalldivisionsListtablesTSPA,TSPAT,andTVKOS31.ObtainalistingofsalesareasListtableTVTA32.ObtainalistingofsalesofficesListtablesTVBUR,TVKBT,andTVKBZ33.ObtainalistingofsalesgroupsListtablesTVKGR,TVBVK,andTVGRTII.DesignAndImplementation1.DetermineifproperplanninghasbeenformalizedHasaclearlyestablishedfunctionalorgeographicalapproachbeenestablished?Hasastructuremethodologybeenadopted?Hasatop-downplanbeendevelopedtoaddresssystemintegrationissues?HaveSAPreleasedatesbeentakenintoconsiderationaspartoftheplan?Doestheplanconsiderthetimetoperformapost-implementationreview?2.Determineiftheproperorganizationandstaffingfortheteamhasbeencompleted.HasaSteeringCommitteebeenorganizedtoincludeallfunctionalbusinessareas?Haveenterprise-widestandardsbeenestablished?Areusersassignedtokeyprojectmanagementpositions?Hasanintegrationteambeenestablishedwithmembersfromallfunctionalareas?Hasatechnicalteambeenestablishedseparatefromthefunctionalteamtosharetechnicalresponsibilityandtoensurestandardtechniquesareemployed?Isthestaffsizeappropriateforthescopeoftheimplementation?5-7membersforeachcoremodule.3.Determineifadequatetrainingisconducted.Reviewthetrainingprogramtoensurethatitisadequateandaddressesallfunctionalareas.Ensurethatthetrainingapproachisintegratedintotheprojectmethodology.Ensurethatadequatetimeforalllevelsoftrainingisscheduled.4.Determineiftheprojectisproperlycontrolledthroughbudget,quality,andschedule.Arestandardprojectcontroltoolsanddocumentationformatsusedacrossteamstoensureconsistentcommunicationandminimizeimpactofteamturnover?Areweeklyorevendailycross-teamprogressmeetingsheldalongwithmonthlysteeringcommitteemeetingstocommunicatestatusandresolveissues?Areissueslogsusedtoresolveprojectdelays?Ensurethataconsistentimplementationmethodologyacrossallteamsisbeingemployed.Istheprojectmeasuredbyworkplantasksanddeliverablesratherthanhoursspent?AresupportsystemssuchasLotusNotesore-mailestablishedatthebeginningoftheproject.5.Determinetowhatextentre-engineeringisbeingemployed.Iftheprojectteamisgoingthroughalargere-engineeringeffort,ensurethatitiscompletedpriortothebeginningtheSAPimplementationprocess.Otherwise,thechangescanbeincorporatedduringtheanalysisanddesignphases.Ensurethatallre-engineeringprocessesareformallysigned-off.6.Determineifaadequateglobaldesigniscompleted.HavepracticesandprocessesgloballybeenharmonizedalongwithSAPfunctionality?HaveworldwiderepresentativesontheprojectbeenpresentduringtheprototypingandJoinApplicationDevelop(JAD)sessionstoensurethatsystemdecisionsareproperlyconducted.Arekeysystemcheckpointsmappedtotheglobaldesigntoensurethesystemmeetstheneedsofeachregion?Aretheuseofprototypingandplaybacksusedtovalidatethedesign?Havekeydataitemssuchasmaterialnumber,customernumber,chartofaccounts,andcompanycodesbeenstandardized?7.Determineifproperintegrationhasbeendesignedintothesystem.Determineifanoverallintegrationplanhasbeendevelopedandreviewedbytheintegrationteam?Hastheintegrationteambeeninvolvedthroughouttheproject?Aretheintegrationpointstestedthroughouttheproject?8.DetermineiftheSAPsoftwareisproperlyconfigured.HastheorganizationalhierarchybeenproperlyestablishedwithinSAPasaninitialstep?Havea