General Controls
Business Continuity Planning (BCP)
Application Change Management
Logical Access Control
System Administration
Application Controls
controls which are part of the application itself
are configurable (Implementation Guide: IMG)
preventive in nature
missing application controls can be compensated by user controls (and vice versa)
SAP Control Environment
User Controls
Organisational internal control measures
which are part of procedures and working instructions
replace or supplement application controls
How can SAP Security Audit Log be used?