Interface Review

SAP R/3 Interfaces

# Control Related Controls Control Step Test Script Actual Results Ctrl WP Report
Adequ Ref
Objectives Type No. Ref
ate?

Interfaces
IF1 Procedures for Procedures for performing data transmissions Manual 1 Determine if adequate
processing data between SAP and legacy systems should be procedures have been
interfaces are formally documented and should include at least documented and appropriately
documented. the following: communicated.
 when to transmit;
 what to transmit;
 how to transmit;
 who can transmit;
 monitoring of transmissions;
 verification/reconciliation of transmissions;
 problem resolution (including problem log);
 re-transmission, if required;
 contact information.

IF2 Standards are used Ensure that standards, such as naming Manual 2 Determine whether standards
when designing conventions for programs, files, and the data being used are consistent with
interfaces, e.g., dictionary are being used. Standards will help to the established SAP ABAP/4
naming conventions facilitate future maintenance activities. Development Standards and
for programs, files, Guidelines.
data dictionary.
Ensure that both the sender and receiver systems
should have header records/control records Determine whether standards
which include at a minimum, date, record count, being used are consistent with
and hash totals. the established COBOL
programming standards.
IF3 Procedures are in Ensure that program change control procedures Manual 3 Review program change
place to control are in place to control interface program control procedures to ensure
production program maintenance. they follow established Client
(interface) changes. change control procedures.

1
 Interface Review
SAP R/3 Interfaces

# Control Related Controls Control Step Test Script Actual Results Ctrl WP Report
Adequ Ref
Objectives Type No. Ref
ate?

IF4 Changes to legacy Where the legacy and SAP processes parallel, a Manual 4 Discuss procedures for
and SAP systems logical link or manual maintenance procedure maintaining synchronization
should be should be enabled between the systems to ensure regarding legacy system
coordinated, as the master file remains in sync. changes which impact SAP.
necessary.
IF5 SAP is properly Prior to extracting data from the legacy SAP 5 Determine the methods used to
configured to receive applications, the information needs (e.g., key Configurable “map” legacy data to SAP to
legacy system data. information fields, ID fields, and cross-reference ensure the maps are accurate
fields) of SAP should be fully understood by and approved.
downloading the relevant transactions from SAP
using the data dictionary and mapping the legacy
data to the SAP fields.

Data mapping/cross reference tables should be

reviewed and approved by the business owners
to ensure they are accurate prior to being used
for converting data.

Prior to exporting data from legacy systems, all

relevant SAP customizing should be completed,
e.g., mapping, field status, edit checks, etc. Once
significant interface development activities are
started, changes to configuration settings should
be kept to a minimum and immediately
communicated to the interface team.

The condition of the legacy data should be

known; data should reside in the legacy
applications in a manner that is easily interfaced
into SAP. The integrity of the donor system
should be assessed to ensure the information is
available, accurate, and at the appropriate level
of detail.

2
 Interface Review
SAP R/3 Interfaces

# Control Related Controls Control Step Test Script Actual Results Ctrl WP Report
Adequ Ref
Objectives Type No. Ref
ate?

IF6 Changes to Ensure that change control procedures are in Manual 6 Review change control
mapping/cross- place to control changes to data mapping and procedures to ensure they
reference tables are cross-reference tables. follow established Client
controlled. control procedures.
Changes should be reviewed and approved by
the business owners to ensure they are accurate
prior to being used for converting data.

Documentation supporting modifications to the

data mapping/cross reference tables should be
maintained as an audit trail.

IF7 Appropriate system If mapping tables are not used, ensure that Manual 7 If applicable, determine what
edits and validations appropriate edits and validations are present in procedures are in place to
exist where mapping the legacy systems to ensure that data is ensure legacy data can be easily
is not used. formatted to be able to be uploaded completely, imported into SAP.
accurately, and only once into SAP.

IF8 Changes to Access to automated production schedules and Manual 8 Review change control
production schedules production control language should be strictly procedures to ensure they
and production limited to only authorized personnel. Access to follow established Client
control language are interface processing, batch scheduling, and BDC change control procedures.
controlled. error correction (SM35, SM36, SM37) should be
restricted to authorized personnel, including
proper segregation of duties.

3
 Interface Review
SAP R/3 Interfaces

# Control Related Controls Control Step Test Script Actual Results Ctrl WP Report
Adequ Ref
Objectives Type No. Ref
ate?

IF9 Procedures are in Production schedules (manual or automatic Manual 9 Review production schedules
place to control scheduling) and user authorizations should and user authorizations to
execution of ensure that production (interface) programs are determine whether controls
production (interface) being submitted in the proper order and on a over execution of production
programs. timely basis by only authorized personnel. programs are adequate.

Operations activity should be regularly reviewed

by management.

IF Interfaces are Interfaces should be processed into the proper Manual 10 Discuss procedures for
10 processed in the period. Posting periods should be open for all ensuring that interface data is
proper period. periods for which data will be loaded into SAP. posted in the proper period.

Data processing should be “cut-off” as of a

certain time to ensure only and all transactions
are extracted for the proper period.
IF Capture, identify, and Procedures should be in place to ensure that Manual 11 Review procedures for
11 correct rejected data rejected data is captured, identified, and monitoring and logging data
in a timely manner. corrected in a timely manner. transmissions to ensure that
rejected data can be captured,
identified, and corrected in a
timely manner.

Controls should be in place to prevent duplicate Determine what procedures are

batch file processing. Potential solutions should in place to prevent duplicate
include time schedules, date/time stamp tracking, data transmissions.
and batch sequence numbers.

Review procedures for logging

All problems should be properly logged and problems.
documented.

Responsibility for monitoring the interfaces and

correcting errors should be clearly defined. For Responsibility for monitoring
all interfaces, both technical and end-user and logging transmissions

4
 Interface Review
SAP R/3 Interfaces

# Control Related Controls Control Step Test Script Actual Results Ctrl WP Report
Adequ Ref
Objectives Type No. Ref
ate?

responsibilities should be defined. Procedures should be clearly defined and

should be clearly defined for monitoring the communicated.
interface jobs and/or receiving notification and
taking corrective action.

Procedures should be in place to ensure that data

errors are corrected at the source, versus at the Review procedures for
target. If errors are not corrected at the source, correcting data errors.
the risk exists that duplicate errors will occur,
and consequently impact the production
schedule.
IF Data in legacy Reconciliation between legacy and SAP systems Manual 12 Review reconciliation
12 systems and SAP is should be performed in a timely manner. procedures to ensure that data
reconciled in a timely is balanced at the completion of
manner. each transmission.
A positive acknowledgment scheme should be
used to ensure files sent from a source system are
received by the target system by using a
"handshake"”between the systems so that files
are not skipped or lost and a review of key
control totals is performed. Control
records/totals should exist for both the donor and
receiver systems and include:
 the date;
 label;
 record count;
 value or hash total.
Any differences should be identified and
corrected in a timely manner.

Data should be reconciled between the source Determine whether reports are
and target systems. Sufficient reports should be reviewed on a regular basis by
available to ensure all data extracted is properly appropriate personnel to ensure
migrated into the consolidation environment, data transmissions are complete
merged/separated, and uploaded into SAP. and accurate.

5
 Interface Review
SAP R/3 Interfaces

# Control Related Controls Control Step Test Script Actual Results Ctrl WP Report
Adequ Ref
Objectives Type No. Ref
ate?

Reconciliations should be prepared between Determine whether the level of

legacy systems and SAP to help ensure all reconciliation has been defined
transactions have been processed. The level of and approved by the data
reconciliation should be agreed by the end-users. owners.
For instance, should data be reconciled in total,
by key categories, at the line item level, etc.

All problems should be properly logged and

documented to ensure all configuration changes Verify that a problem log is
are appropriately reflected. maintained and reviewed.
IF “Cleanse”, verify, Legacy and/or source system data should be Manual 13 Review procedures for
13 and prioritize legacy “cleansed”, verified, and prioritized prior to “cleansing”, verifying, and
and/or source system transmission to SAP. prioritizing data to be
data prior to transmitted to SAP.
transmission.

6
 Interface Review
SAP R/3 Interfaces

# Control Related Controls Control Step Test Script Actual Results Ctrl WP Report
Adequ Ref
Objectives Type No. Ref
ate?

IF Backup/recovery of Backup/recovery procedures should exist to Manual 14 Review procedures for backup
14 interface programs. ensure that interface programs and data are and recovery of interface
available in the event of a disaster or prolonged programs and data, especially
outage. conversion data which may be
stored on PC hard drives.
IF Test plans and results Unit, string, and integration test plans should be Manual 15 Review test plans and results.
15 are documented. properly documented. Test results should be Plans should include unit,
available. Test plans should include: string, and integration testing.
 test objectives;
 start conditions (settings, validation of files
used, etc.);
 test conditions;
 test data specifications;
 test steps;
 expected results of each test step (e.g., file
exists, program ran successfully, etc.);
 input/output file names and locations;
 user involvement;
 inclusion of special processing runs, e.g.,
month-end, quarter-end, year-end.

Stress testing should be performed to ensure the

interface can handle the volume of
transactions/data elements being interfaced.
IF An audit trail of Verify that production program changes and job Manual 16 Discuss audit trail to determine
16 production activity submissions can be adequately traced to the whether interface activity can
exists. responsible user. be properly traced.
IF Interface and conver- Verify that interface/conversion processes are Manual 17 Discuss procedures for
17 sion data should be properly documented and maintained in order to documenting and maintaining
consistently and facilitate future reference and maintenance interface/conversion activities.
completely efforts.
documented.