SOX requirements and WF-Batch SAP_ALL, SAP_NEW Profile

[Scheinoha, John]

Shadmani,

   I have also had this issue presented to me by external auditors and
our own internal SAP Security team.  What I used as documentation is the
documentation from the BC601 class (now BIT601) where it references
creating user WF-BATCH and assign this user the authorization profiles
"SAP_ALL" and "SAP_NEW". This is page 3-7 in the BC601 Participant
Handbook.

   If this doesn't work, try page 77-78 of the "Practical Workflow for
SAP" book.  This also describes how and why to set up WF-BATCH with
SAP_ALL and SAP_NEW.  

   If this doesn't work have the auditors discuss this with SAP America.

   If this doesn't work, use Jocelyn Dart's suggestion.

Good Luck,
  John
(414) 256 - 5136  

-----Original Message-----
From: shahram.shadmani at alcatel.com [mailto:shahram.shadmani at alcatel.com]

Sent: Friday, May 12, 2006 9:21 AM
To: sap-wug at mit.edu
Subject: SOX requirements and WF-Batch SAP_ALL, SAP_NEW Profile

Hi there,
 
Our SAP security team is attending to remove the SAP_ALL and SAP_NEW
profile from WF-Batch user due to SOX requirements.
We (SAP Workflow Team) know that this will cause lot of problems and are
pointing to the type of this user which is "system" and not a dialog
user. However, I was wondering if other people / companies have or had
the same problem and how they resolved it.
 
Thanks a lot for your response in advance,
 
Shahram Shadmani