When we start Application Controls Tetsing or System Audit for a client using SAP, we nned to provide client with list of Tcodes which we shall be need to Check Configuration and Extract Data.

General

• SE16N
• SPRO
• SQVI
• SUIM

P2P Process

• OBYC

O2C Process

• OVA8

FSCP (Financial Statement Close Process)

• OB52
• OBA7

While performing application controls testing, we don’t just check configuration, we also perform walkthrough for the controls which we will be testing. The Tcodes required to perform walkthrough is huge and may be client and control specific. In this post, we shall only discuss the Tcodes which will be used to check configuration & data extraction.

SE16N is used to extract data from SAP Tables. Old versionof the same Tcode is SE16. I would recommend, using SE16N, as it is easy to use and you get to see all the fields which can be used to extract and Filter.

Background: All the configurations, Master Data, Transaction Data are stored in one or another SAP Table.

Features of SE16N

• Filter data (Useful for Scoping. eg. Date Filter for seleting audit period, Company Code Filter for selecting any those company which we are auditing)
• Select Column to display (SAP tables will have tons of column, but we need only select fe columns for auditing. Selecting few columns will make data extraction faster)
• Values in column (Many a times, data are stored in coded format in SAP columns. eg. “S” stands for “Standard Pricing”. To know what the character stands for, SE16N provides a quick lookup.

SPRO is used to view and edit many configurations in SAP. As this is a sensitive Tcode, a client may be reluctant provider access of SPRO. Access to SPRO can be restricted to “View Only”.

Plethora of configurations which can be done. Hence the to reach to a particular config screen, you need to navigate through the drop down menus. To reach to this menu of configuration, click on “SAP Reference IMG” after executing SPRO.

SQVI is used to create Query in SAP to extract Data. There is no need to code. Everthing is managed through GUI. This is helpful when you wnat to extract data uing SE16N but scope fields are avaiable in more than 1 table. Thus SQVI can help you to join these tables and let you speciyfilter options from 2 or more tables.

Watch a video below to get a view of how SQVI is used.

SUIM is used to extract/find users in SAP. The main use od SUIM in Application Controls testing is to get a list of users having access to a particular Tcode.

SUIM will take you to list of forums which can be used to find users, roles, profile, authorization, authorization object, transaction, etc. For the purpose of System Audit, we are only concerned with “Users with Complex Selection Criteria” form.

The above screenshot is for SAP 6.

The above screen shot is for SAP 7. The functionality is not very different. Just now the screen is divided into tabs for better parameter inputs.

OBYC is used to Configure Automatic Postings.

Background: When we enter a transaction for the Inventory Management and Invoice Verification it simultaneously creates an accounting document by means of G/L accounts. eg. when we post MIGO Transaction and accounting entry is automatically created. In brief the Postings are made to G/L accounts automatically in the case of Invoice Verification and Inventory Management where the transactions are relevant to Financial and Cost Accounting. We need to specify which GL accounts needs to be Debited and Which GL Accoun needs to be credited. To configure GL Accounts, we use OBYC.

VKOA is similar to OBYC in MM. VKOA is used to integrate SD Module with FI Module. In VKOA we configure which GL Account to be debited and credited at the time of creation of sales documents. The Configuration of GL can be done at various levels. Hence, we need to first select the Level at which we need to configure GL and then select GL Number.

OVA8 is used to check configuration relating to Credit Control.

OB52 is used to configure open periods. Document posting is only allowed in open periods in SAP.

OBA7 is used to define Document Types. Document types are used to control and segregate transactions based on the business processes. By default, SAP comes with plenty of standard document types. We also use this TCode to check number range configuration.