Personalized Data Analysis with PBS SE16/SA38_PERSONAL

Personalized Data Analysis with PBS SE16/SA38_PERSONAL

Contents Introduction... 3 Data Analysis Requirements from the User s or Auditor s Perspective... 3 Table Analysis with SAP SE16... 4 Personalized Table Analysis with PBS SE16_PERSONAL... 4 PBS SE16_PERSONAL and Nearline Analytic Infrastructure (PBS NAI)... 7 Program Execution with SAP SA38... 8 Personalized Program Execution with PBS SA38_PERSONAL... 8 Features and Advantages of PBS SE16/SA38_PERSONAL... 11 compared to the SAP Standard Supported SAP Systems, PBS Licensing... 11 2

Introduction Legal requirements and in particular accounting compliance are of extreme importance for the operating of productive SAP systems. Compliance is ensured with the help of internal and external checks with which business transactions are analyzed and evaluated. Elements that are subject to such data analyses include, for example, customizing settings, table contents, customer-specific enhancements (Z tables), and customer-specific programs (Z reports). Tables are looked at and their contents accessed within the scope of data analysis. As the SAP standard transactions used for this are not indented to be transactions for the end user or the internal/external auditor, PBS Software provides SE16_PER- SONAL, a proven tool for performing personalized, table-related data analysis. Since real-life business transactions are executed in an SAP system via transactions that have a direct reference to ABAP programs, a detailed data analysis must also include knowledge of ABAP programs and their execution. Because SAP standard transaction SA38 that is used for this should not be accessed by every end user and internal or external auditor, PBS provides SA38_ PERSONAL as a new tool for performing personalized, program-related data analyses. The PBS SE16/SA38_PERSON- AL product that integrates the SE16_ PERSONAL and SA38_PERSONAL tools enables the end user and/or the auditor to perform a comprehensive, personalized data analysis that includes both tables as well as programs. Data Analysis Requirements from the user s or auditor s perspective Data analyses take place as an essential component of operative daily business or during finishing works, internal, and external audits. Special end user transactions are required for executing data analyses that should have the following features: A user or auditor gets access to exactly the information that is necessary for his/her work. Access to table contents should be defined clearly via authorization checks. The table contents view can be adapted to the auditor s or user s tasks. Access to ABAP programs can be defined specifically per task and per user. Reporting can be set up for auditors or users in such a way that the execution of ABAP programs can be restricted both to individual variants as well as to a type of processing (for example, only in the background). Access to table contents is only supported in read mode. 3

Table Analysis with SAP SE16 The use of the SAP standard transactions SE16 (SE16N, SE17) that enable a flexible and generic representation of table contents is handled in a very restricted manner in the majority of SAP systems. These transactions are no classic end user transactions and do not perform sufficient authorization checks during access to configuration and application data. A preconfiguration of selection fields or views for the end user or auditor is not possible in the SAP standard. Furthermore, if these transactions were made available in a productive environment, they would enable uncontrollable changes to be made to tables such as T004 (Chart of Accounts), T007A (Control Keys), or T030 (Standard Account Table). As a result, the SAP standard transactions do not fulfill the requirements for table-related data analysis as specified by users and auditors. Personalized Table Analysis with PBS SE16_PERSONAL Figure 1 User Menu of PBS SE16_ PERSONAL You can assign a user to a user group according to the organization to which he/she belongs with the tool PBS SE16_PERSONAL. Members of a user group automatically receive access to the transaction data of their respective organizational unit. Authorizations that they have based on the tasks they perform ensure that only relevant data is displayed. By controlling the output fields it is possible to assign the information that is individually required to a user-specific view. The PBS SE16_PER- SONAL menu is different as regards its administration and application, see figure 1. Pre-configuration of the restrictions and the user view during table evaluation is reserved for the administrator. After pre-configuration has been completed, users can perform table evaluations specifically according to their tasks. 4

Before a user can evaluate a table using SE16_PERSONAL, the administrator must have pre-configured the table. When doing this, he defines one or more views. The end user can then evaluate the tables that are available to him in a user-specific manner via their work list, the Customizing Pool, see figure 2. Administrator End user SAP Database Layout Definition: Table Range Values set Authorizations Selection Fields Output Fields SE16_PERSONAL User-specific Customizing Pool User Master Assignment Layout User Master Data Transaction Data Customizing Data Customer Tables / Table Views Figure 2 Evaluation of Tables using Layouts Let us take, for example, an internal auditor who is assigned to a particular company code, and whose task it is to check the tax on sales. As his job is limited to a business area, his authorization simply relates to this business area. In order to accomplish his task, only the key figures Sales Revenue and Tax Amount in Local Currency are of importance to him. Figure 3 shows the configuration of the variant PBSDEMO by the administrator ADMIN. The following settings were made when doing this for the display and selection of the fields: the company code is defaulted and cannot be selected. The general ledger account, the fiscal year, and the period can be selected, whereby a value is defaulted for the general ledger account. Display is only intended for the following fields: Currency, Document Type, Business Area, Tax Code, Local Currency Amount and Tax Amount. An authorization check is provided for the business area, in which the authorization object F_BKPF_GSB with the authorization field GSBER is checked. 5

Figure 3 Configuration of Variant PBSDEMO for the Table BSIS by the Administrator ADMIN First, the administrator selects the selection and display fields. When doing this, the selection fields can be assigned default values. The administrator defines for each default value whether the user may change the default values during table evaluation (dynamic selection) or whether they may not be changed (fixed selection). In this way, particularly in audit situations, it is possible to restrict the available data to the area that is being audited. In a similar way, it is also possible to configure the output layout of the tables that are used. For example, fields with sensitive information can be locked for the user. Different views can be configured and saved as separate variants for each table. In this way it is possible, for example, to split table contents by business area and then assign them to individual users or user groups. In addition, it is possible to pre-configure whether the selected data can be downloaded. Figure 4 shows the view of user John Doe on table BSIS. The company code is a fixed value for him; he can only make entries for General Ledger Account, Fiscal Year and Period. These fields were defined as selection fields. 6

Ten fields are available to him in total as output fields, as provided by the administrator. Figure 4 Start of SE16_ PERSONAL with Variant PBSDEMO for the User John Doe Executing with F8 provides a list that displays the revenue and sales revenue in Local Currency, see figure 5. The user only sees the fields that are intended for him. Evaluation of database views is equally possible. Figure 5 Output of SE16_PERSONAL PBS SE16_PERSONAL and Nearline Analytic Infrastructure (PBS NAI) PBS SE16_PERSONAL can also be used for the data analysis of tables and database views that are saved with the help of PBS NAI on a nearline database. You can find more detailed information on this in our Nearline Analytic Infrastructure White Paper. 7

Program Execution with SAP SA38 The execution of ABAP programs can be extremely helpful within the context of data analysis because ABAP programs are linked directly via their processing logic with the transactions for executing business processes. This means that, for example, customer-specific programs can contribute towards making tax-related matters transparent. Authorization to use the SAP standard transaction SA38 that enables a search for and the execution of ABAP programs is only reluctantly given to users and auditors in the majority of SAP systems because it does not provide sufficient protection when accessing and executing programs. For example, it is not possible to restrict the execution of programs to individual variants or to execution in the background. The SAP standard transaction does not therefore fulfill the requirements of program-related data analysis, as specified by users and auditors. Personalized Program Execution with PBS SA38_PERSONAL PBS provides the possibility to restrict access to and the execution of programs with their new tool, SA38_PERSONAL. A user can only access and execute a report once it has been assigned to him, see figure 6. SAP User SAP Reporting Library Mapping Mapping Mapping Figure 6 Assignment of Reports and Users with SA38_PERSONAL With the PBS SA38_PERSONAL tool, users can be assigned to a user group according to where they belong organizationally. In this way, each user is automatically only given access to the programs that they require in order to do their tasks. When executing programs, a user may only be authorized to execute specific variants. 8

The PBS SA38_PERSONAL menu is split from a functional perspective into Administration and Application, see figure 7. Figure 7 User Menu of PBS SA38_PERSONAL Before a user can access a program using SA38_PERSONAL, the administrator must first create a reporting group and assign the required programs to it. When doing this, he can define how the program may be executed, see figure 8. Figure 8 Assignment of Programs to a Reporting Group In the example mentioned, the programs RFKEPL00, RFDEPL00 and RFSOPO00 are assigned, not the program SAPF070. The assignment of the programs differs as follows: Whilst no restriction is intended when executing program RFSOPO00, program RFDEPL00 can only be executed via a variant (flag under Variant is set). Program RFKEPL00 may only be started in the background (flag under Batch is set). In the case where program RFDEPL00 should only be executed via a special variant PBS_DEMO, exclusively the variant PBS_DEMO can be assigned to the authorization object ZPBS_REPVA. 9

Figure 9 shows the work list called the reporting pool with the three assigned programs from a user s perspective. Figure 9 Reporting Pool from User s Perspective If the user selects program RFKEPL00, execution via variant and free data selection is deactivated as shown in figure 10. Figure 10 Personalized Execution of Programs: Execution only possible in the Background. If program RFDEPL00 is selected, execution is only possible via a selection variant. By protecting the selection variants, the execution of programs can be restricted in such a way that no entries can be made in the selection screen, see figure 11. Figure 11 Execution of a Program with a protected Selection Variant that does not allow any entries The user cannot make any entries during execution of the program. 10

Features and Advantages of PBS SE16/SA38_PERSONAL compared to the SAP Standard Designed for use by the end user. Used for internal and external audits as auditing tool. Effective protection against unauthorized data access and against unauthorized execution of application programs. Enables a general evaluation of all transparent SAP tables, customer tables, and database views and regulates access to and execution of SAP programs and customer-specific ABAPs. Enables exclusively read access to table contents and provides personalized access to application programs up to the level of individual programs. Enables controlled access to table contents incorporating standard SAP authorizations and regulates access to customer-specific programs (Z reports) without the creation of transactions and transaction authorizations. Provides each user with the tables designated for evaluation via a configured table pool and enables personalized access to SAP application reporting and to customer-specific programs. Presents an improved table display for end users enabling an individual table view with the possibility to freely define selection and display fields. Enables the execution of application programs to be restricted to the level of a selection variant and the execution of application programs to be restricted to background execution. Integrated in central Customizing via the SAP Transport System. Can be implemented in SAP systems such as ERP, BI, IS, CRM and others. Supported SAP Systems, PBS Licensing In principle, the product SE16/SA38_PERSONAL can be used in all SAP systems from Release 4.6C. The price model for PBS software is based on the number of users of the operative SAP application systems (ERP, CRM etc.), the so-called named users and/or on the number of contracts or contract accounts for SAP IS solutions. We provide Hotline Support to PBS customers with a maintenance contract. PBS focuses on software development. Our many consulting partners provide consultancy and project implementation support. PBS solutions can be purchased directly from PBS or via a correspondingly authorized partner. You can find more detailed information and a comprehensive list of partners on our website under Buy. 11

PBS Software GmbH PBS Software is a leading provider of add-on software for SAP solutions in the areas data archiving, extraction and storage as well as system closings and has been considered as an expert for complex, integrated data accesses to archived or nearline data in SAP applications for many years. In addition to the classical SAP data archiving the extensive PBS solutions also support the SAP BW-specific nearline storage concept that enables completely new ILM application scenarios together with the column-based analytics server Sybase IQ. PBS Software GmbH Schwanheimer Strasse 144 A 64625 Bensheim, Germany phone: +49 62 51 / 174-0 fax: +49 62 51 / 174-174 e-mail: info@pbs-software.com www.pbs-software.com PBS develops pragmatic ILM tools in close collaboration with SAP and supports the new SAP ILM solution as SAP SOFTWARE SOLUTION PARTNER. For more information: www.pbs-software.com Copyright 2011 PBS Software GmbH. All rights reserved. No part of this brochure may be reproduced or transmitted in any form or for any purpose without the written permission of PBS Software GmbH. The information contained herein may be changed without prior notice. Microsoft, Windows are registered trademarks of Microsoft Corporation. IBM, IBM DR550, IBM TSM and SSAM are trademarks or registered trademarks of IBM Corporation. Linux is a registered trademark of Linus Torvalds in the USA and other countries. UNIX is a registered trademark in the USA and other countries, licensed exclusively through X/Open Company Limited. HP, HP-UX11 Apache are trademarks or registered trademarks of Hewlett-Packard Company. EMC, EMC Centera are trademarks or registered trademarks of EMC Corporation. Hitachi, Hitachi HCAP are trademarks or registered trademarks of Hitachi Ltd. NetApp, NetApp Filer are trademarks or registered trademarks of NetApp Corporation. Sybase IQ is a registered trademark of Sybase, an SAP Company. PBS archive add ons is a registered trademark of PBS Software GmbH. SAP, R/3, SAP NetWeaver, SAP NetWeaver Business Warehouse, SAP Industry Solutions and other SAP products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of SAP AG in Germany and other countries. All other product and service names mentioned are the trademarks of their respective companies. Data contained in this document serves informational purposes only. PBS Software GmbH shall not be liable for errors or omissions with respect to the materials. The only warranties for products and services are those that are set forth in the express warranty statements accompanying such products and services, if any. Nothing herein should be construed as constituting an additional warranty.