How Internal Audit Tests SAP Application Controls, SOC 1 Reports, and CUEC 內部稽核如何測試 SAP 應用程式控制、SOC 1 報告與 CUEC

on

Demystifying the Cloud Audit: How Internal Audit Tests SAP Application Controls, SOC 1 Reports, and CUEC

1. Introduction: The Changing Reality of the Internal Auditor

In a traditional on-premise environment, testing Information Technology Application Controls (ITACs) within SAP was relatively straightforward. Auditors examined system configurations, verified the three-way match, and reviewed user access rights. However, as organizations migrate to cloud-based environments such as SAP S/4HANA Cloud, the boundaries of Internal Audit (IA) responsibilities have shifted significantly. Many financial and operational auditors mistakenly believe that cloud compliance is fully covered by the vendor’s third-party assurance reports. To audit effectively in today’s environment, we must bridge the gap between third-party assurance and our own hands-on internal audit responsibilities.

2. Clearing the Confusion: What are SOC 1 Type I and Type II Reports?

A common point of confusion in internal audit is mixing up SOX compliance with SOC reports. SAP provides SOC reports to assist your company in achieving SOX compliance. When requesting audit documentation from SAP, you will typically encounter two types of SOC 1 reports:

  • SOC 1 Type I (Design Effectiveness): This report evaluates whether SAP’s controls are suitably designed to achieve specific control objectives at a particular point in time (for example, as of December 31). It confirms the lock exists, but does not prove it was used consistently.
  • SOC 1 Type II (Operating Effectiveness): This is the gold standard for auditors. The report evaluates whether SAP’s controls operated effectively over a specified period (usually 6 to 12 months). It proves the lock worked reliably every single day.

Most companies rely primarily on SAP’s SOC 1 Type II report for SOX-related assurance.

3. The Missing Link: What is CUEC?

Even with a perfect SOC 1 Type II report, your organization’s internal control framework can still fail. The reason is CUEC, or Complementary User Entity Controls.

Think of SAP as a high-security apartment building. SAP’s SOC 1 report proves that the building’s main gate, security cameras, and structural integrity are flawless. However, the building management expects you, the tenant (the user entity), to lock your own apartment door and manage who receives spare keys. These responsibilities are your CUECs.

SAP SOC reports commonly list CUECs such as periodic user access reviews, maintenance of segregation of duties, change management for custom configurations, and timely resolution of interface exceptions. If your organization fails to implement these controls properly, even the strongest vendor SOC report cannot protect you from fraud or material errors.

4. How to Execute ITAC in Normal Internal Audit Duties (Using SAP)

As an internal auditor, you cannot simply tick the box when management provides SAP’s SOC report. You must actively verify how your organization fulfills its CUECs and configures its ITACs. Here’s how to embed this into standard audit workflows:

A. Audit the Mapping of CUECs to Internal Controls

Review the CUEC section in SAP’s SOC 1 report. Verify that management has mapped every CUEC to an existing, effective internal control in the company’s risk and control matrix. Also confirm that both design and operating effectiveness are periodically tested.

B. Test Segregation of Duties (SoD) and Critical Roles

Extract user access logs and analyze roles in the production environment. Ensure no business users have powerful standard profiles such as SAP_ALL or SAP_NEW. Verify that conflicting duties (for example, creating a vendor and approving payments) are properly segregated through customized roles. Also review emergency firefighter access accounts and their usage logs.

C. Verify the Configuration of Automated Tolerances and System Settings

For procure-to-pay (P2P) audits, request system configuration screenshots or reports for tolerance limits (such as price, quantity, and invoice tolerances). Test whether the system automatically blocks or flags transactions that exceed defined thresholds. Additionally, validate three-way match settings and payment release workflows.

5. Conclusion: Modernizing the IA Playbook

Cloud systems like SAP shift infrastructure maintenance to the vendor, but compliance ownership remains firmly with the user entity. As internal auditors, our value lies in looking beyond third-party certificates to test the specific configurations, thresholds, and access rights that our organizations actually control. By mastering SOC 1 reports, properly addressing CUECs, and actively evaluating SAP configurations, we help ensure that our company’s cloud digital transformation is built on a truly compliant and resilient foundation.

In the cloud era, excellent internal auditors no longer just review third-party reports. They verify whether the organization is properly exercising its own set of keys.





解密雲端審計：內部稽核如何測試 SAP 應用程式控制、SOC 1 報告與 CUEC

1. 前言：內部稽核人員面臨的現實轉變

在傳統的本地端（On-premise）環境中，測試 SAP 內部的資訊技術應用程式控制（ITAC）相對直觀。我們審查系統配置、驗證三方比對，並檢查用戶存取權限。然而，隨著企業紛紛遷移至 SAP S/4HANA Cloud 等雲端環境，內部稽核（IA）的職責邊界已發生重大變化。許多財務與營運稽核人員誤以為雲端合規風險已完全由廠商的第三方認證所涵蓋。要在當今環境中進行有效審計，我們必須在第三方稽核報告與自身內部稽核職責之間建立橋樑。

2. 釐清觀念：什麼是 SOC 1 Type I 與 Type II 報告？

內部稽核中最常見的混淆之一，就是把 SOX 合規與 SOC 報告混為一談。SAP 提供 SOC 報告，目的是協助企業達成 SOX 合規。當您向 SAP 索取審計文件時，通常會遇到兩種 SOC 1 報告：

  • SOC 1 Type I（設計有效性）： 這份報告評估 SAP 的控制措施在特定時間點（例如 12 月 31 日）的設計是否適當，以達成特定控制目標。它證明了鎖確實存在，本質上無法證明它被持續有效地使用。
  • SOC 1 Type II（執行有效性）： 這是稽核人員的黃金標準。這份報告評估 SAP 的控制措施在特定期間內（通常為 6 至 12 個月）是否有效運作。它證明了這把鎖在每一天都可靠地發揮作用。

大多數企業在 SOX 專案中，主要仰賴的是 SAP 提供的 SOC 1 Type II 報告。

3. 缺失的環節：什麼是 CUEC？

即便 SAP 提供了完美無瑕的 SOC 1 Type II 報告，貴公司的內部控制框架依然可能失效。原因就在於 CUEC，也就是用戶實體配合控制事項（Complementary User Entity Controls）。

把 SAP 想像成一棟高保全的公寓大樓。SAP 的 SOC 1 報告證明了大門、監視器與建築結構都無懈可擊（這是廠商的責任）。然而，大樓管委會預設身為租客的您（即用戶實體），必須鎖好自己房間的門，並妥善管理備用鑰匙。這些就是貴公司的 CUECs。

SAP SOC 報告中常見的 CUEC 包括：定期用戶存取權限審查、職責分離維護、客製化設定的變更管理，以及介面例外的即時處理。若貴公司未能妥善履行這些控制，即使廠商的 SOC 報告再完美，也無法保護組織免於舞弊或重大錯誤。

4. 如何在日常內部稽核工作中執行 ITAC（以 SAP 為例）

身為執行日常實地稽核的內部稽核人員，當管理階層提供 SAP SOC 報告時，您不能僅流於形式地勾選通過。您必須主動稽核組織如何履行 CUEC 並正確配置 ITAC。以下是融入標準稽核工作流的具體做法：

A. 稽核 CUEC 與內部控制的對應情況

翻閱 SAP SOC 1 報告後段的 CUEC 章節，驗證管理階層是否已將每一項配合要求明確對應到公司風險控制矩陣中的有效控制程序，並確認這些控制已定期進行設計與執行有效性測試。

B. 測試職責分離（SoD）與關鍵權限

匯出生產環境的用戶存取權限日誌，檢查是否有人被授予 SAP_ALL 或 SAP_NEW 等全能型權限。驗證相互衝突的職責（例如建立供應商與批准付款）是否已透過客製化角色進行有效分離，同時審查緊急權限（Firefighter ID）的使用紀錄與審核機制。

C. 驗證自動化容差與系統配置

在採購到付款（P2P）循環稽核中，不要只看紙本簽核。要求查看 SAP 容差限制的系統設定報表或截圖（價格、數量、發票容差等），並實際測試當交易超過閾值時，系統是否會自動阻擋或警示。同時驗證三方比對設定與付款釋放流程。

5. 結論：全面升級內部稽核工具箱

如 SAP 等雲端系統雖然將基礎設施維護交給廠商，但合規的最終責任仍牢牢掌握在用戶實體手中。身為內部稽核人員，我們的價值在於看透第三方認證的表象，深入測試公司實際掌控的系統配置、門檻與存取權限。透過精通 SOC 1 報告、妥善對接 CUEC，並主動評估 SAP 核心配置，我們才能確保組織的雲端數位轉型是建立在合規且具備韌性的穩固基石之上。

在雲端時代，優秀的內部稽核人員不再只是檢查第三方報告，而是驗證企業是否真正負責地管理好自己那把鎖。

Comments

Post a Comment