Benefits of Automated security and Performance Testing of SAP HCM applications

Benefits of Automated security and Performance Testing of SAP HCM applications Case Study from Infosys Abhinav.G Independent Validation Solutions Infosys Technologies Limited Houston, USA Chandrashekar.S Independent Validation Solutions Infosys Technologies Limited Bangalore, India Abstract - An organization with a Global presence needs to transform its processes and systems to keep pace with the changing external and internal environments. SAP Human Capital Management (HCM) system implemented in such an organization must also undergo changes to meet evolving workforce needs. Security Testing of SAP HCM presents new challenges when the workforce is spread across geographies. Another development in SAP HCM has been the increasing adoption of portal based ESS (Employee Self Service) / MSS (Manager Self Service) application, a self service tool that provides access to the employees to maintain their own data. In a large organization, where many users access the ESS/MSS application concurrently, Performance Testing becomes imperative to prevent high response time and system crashes. This paper discusses the strategy of using Automation for Security Testing in a typical HCM Reimplementation scenario and Performance Testing of ESS/ MSS application. It is based on experience from the project undertaken for an organization spread across ninety countries. Index Terms Benefits of Automated Testing, Case study, Performance Testing, SAP ESS/MSS/HCM Implementation, SAP Security Roles, Security Testing, Types of Testing INTRODUCTION Shahbaz.A Independent Validation Solutions Infosys Technologies Limited Houston, USA Sharitapriya.C Independent Validation Solutions Infosys Technologies Limited Bangalore, India by the employees, in a large organization, Performance Testing becomes paramount. This paper discusses the benefits derived from Automating the Security Testing and Performance Testing. It is based on a real life project experience which involved Re-implementation of core HR processes in SAP HCM, along with green field implementation of the SAP Employee Self Service (ESS) and Manager Self Service (MSS) applications. SAP ERP HUMAN CAPITAL MANAGEMENT A. Introduction The SAP ERP Human Capital Management (HCM) solution offers a complete and integrated set of tools to help an organization effectively manage its employees. The solution supports hiring, developing, rewarding, and retaining talent. The Key Business Activities Supported by SAP ERP HCM are shown in Fig. 1. O rganizations aiming to automate the Workforce Planning and Administration activities make use of ERP Human Resource packages which are customized to map the company specific processes. One such ERP solution is the SAP ERP Human Capital Management (HCM). An organization that may have implemented SAP HCM earlier should make changes in the existing system (Reimplementation) in order to keep the system in synch with the evolving needs of the organization. In addition, it may also feel the need for implementing new features/ modules that might have been introduced in the HCM solution since the last implementation. Reimplementation of HCM solution in a company may lead to redefining the existing security roles and addition of new roles. In such a scenario Security Testing gains importance to check for proper authorizations. Recently, many companies have also started to implement the SAP Employee Self Service (ESS) and Manager Self Service (MSS) applications, which allow the employees to manage their own data. Since these applications are directly accessed Fig. 1. Key Business Activities Supported by SAP HCM 14

B. Core HR and Payroll Processes One can standardize and consolidate all workforce-related core processes and data onto a single platform while adhering to local regulations and laws. The processes supported are: Employee Administration: Supports all of the basic processes for managing personnel and handling employee information. Organizational Management: Manages organizational structure and policy information. Access to the reporting structure helps to easily establish authorizations and enables more effective management of workflow. Organizational Charts: With the SAP Organizational Visualization application by Nakisa, the workforce engages with the right SAP ERP HCM information based on roles. Employees connect and collaborate with colleagues by navigating dynamic organizational charts and managing communities that integrate with popular social media sites. Global Employment: Supports all processes involved in international employee assignments from planning and executing global assignments to personnel administration and payroll for global employees. Benefits Management: Provides a flexible framework for creating and managing tailor-made benefits packages. Support for self-services enables employees to view and change their benefit selections online. Time and Attendance: Enables recording, tracking, monitoring, and evaluating employees working times and activities. Payroll and Legal Reporting: SAP ERP HCM can handle complex payroll processes in compliance with current legal regulations in 48 countries. Predefined reports help address various legal and compliance issues, increase the visibility and transparency of HR processes, and simplify overall management of compliance related concerns. HCM Processes and Forms: Offers an efficient way to manage cross-role processes that involve HR master data. A flexible framework helps easily tailor HR processes to specific needs. SAP Interactive Forms software by Adobe transforms paper-based HR tasks into streamlined, automated processes while maintaining a familiar look and feel for managers, executives, and other casual users. Employee File Management: All organizations that manage employee processes, such as paying employees or contractors, are required to manage documents related to those people. C. HCM Service Delivery This involves a set of modules which provide the workforce the tools to inform and serve themselves anywhere, anytime. Some of the key business processes supported are: Shared HR Services center Employee self-services Manager self-services Employee Self-Service (ESS): Provides employees worldwide with Web-based access to their own personal data and HR information. By automating many HR administrative tasks such as changing addresses or submitting leave requests, it helps the companies to reduce their total cost of ownership and obtain a higher ROI. In addition, employee productivity can be increased and processes can be optimized by empowering employees and managers to collaborate and better manage their work-life balance and take more responsibility for their jobs and development. Manager Self Service (MSS): Provides managers with people-centric tools that help them accomplish the following goals: Attract stellar candidates and motivate employees Plan, measure, and influence business outcomes Identify and reward top performers Reduce costs Make business processes more efficient Empower managers with the right information at the right time Turn administrative tasks into productive processes The manager portal works with tools such as the SAP Interactive Forms software by Adobe, which automates paperbased processes, such as requests for master data changes, new equipment, or performance appraisals. These tools allow organizations to adapt and deploy end-to-end business processes with forms that are familiar to the user. NEED FOR MORDERNIZING THE HR APPLICATIONS IN AN ORGANIZATION With time, the business processes and components for which a company had customized its ERP system at implementation are not necessarily the same processes and components it needs to track today. Companies grow and change, acquiring new business lines and divesting themselves of others. They open new facilities or consolidate operations, add partners or outsource functions, centralize or decentralize the back office. Reporting requirements increase as regulatory bodies heighten oversight and as companies expand across borders. In short, businesses change, and as they do, so do management s information needs. Both Internal and External Environments may influence the changes in an existing HR Application like 15

SAP HCM Solution. to simulate various possible scenarios and tune the SAP and interfaced applications accordingly. Fig. 2.Internal and External Factors affecting change in existing SAP HCM Solution TYPES OF TESTING REQUIRED IN SAP HCM INITIATIVES Functional & Integration Testing: Functional Testing is required to test the SAP functionality and the underlying business processes that have undergone modifications or have been newly added. Integration Testing is carried out to perform end-to-end business process validation. For example, a typical Hire-To-Pay business process would be consisting of various activities like an applicant is recruited, a position is created, the person is hired, benefits added, training and events recorded, time entered, payroll is run and posted, checks cut and cleared, travel expenses paid, vendors paid and reports/extracts contain the correct data. Security Testing: Authorization and User Profile Testing is designed to ensure that SAP security profiles have been created to the specification of the role mapping and to ensure that the profiles are appropriate to the business processes being delivered. In a reimplementation project, security roles may change or created according to new divisions / regions that may have been created due to a company-wide reorganization. Performance Testing: Performance Testing is conducted to evaluate the compliance of the system with specified performance requirements. Performance testing measures the response time of key business processes and transactions, uncovering end-to-end performance problems. This is typically performed using an automated test tool like HP LoadRunner, HP WinRunner etc. to simulate large number of users and voluminous data. The SAP technical architecture depicted in the figure below entails end users of certain modules like ESS & MSS to be accessed over a LAN or WAN or from various network locations with varied bandwidths and latencies. Also there could be varying load on the SAP application from different geographies during the 24 hour global work day. This necessitates an extensive performance testing to be conducted Fig. 3.SAP HCM Technical Architecture Regression Testing: Testing needs to done for those business processes that have not undergone changes. This ensures that the changes carried out have not affected the SAP functionality that was not in scope for change. SECURITY TESTING REQUIREMENTS OF SAP HCM SOLUTION A. Introduction In SAP systems, roles provide a convenient way to structure a user s daily tasks into groups of services and transactions, making them accessible from a personalized menu. It is critical that the right user is accessing the right information both for the user and as a matter of SAP system security. For that reason, users need to have the required role authorizations before they can access Financials, HR, SCM, and other information and functions from SAP systems. The SAP authorization concept protects transactions, programs, and services in SAP systems from unauthorized access. The Redesign of HCM processes entails setting up of new user roles aligning with the new requirements. Security Roles consist of Composite and Single Roles. A Composite Role is built by assigning a number of Single Roles to a particular Composite Role. For example, Role Composite for Corporate Benefits (Technical name: E.HR_SEN.CORP_BENEFITS_XXX:C) following Single Roles: may consist of the View OM Data and Run OM Reports View Executive Information View Sensitive Master Data View Compensation Data View Benefits Information Benefits Administrator (Global) 16

Fig. 6. Security Testing at T Code and Infotype Levels Fig. 4.Roles- Composite and Single B. Security Testing Requirements Security Testing has to take place at two levels - T Code Level - Infotype Level C. Types of Tesing Required Positive Testing: To validate that the specified Role has access to particular T Codes and Infotypes. Negative Testing: To validate that the specified Role does not have access to particular T Codes and Infotypes. Table I - Types of security testing For example, the Single Role Maintain OM Positions may have access to the following - T Code Level PO13, PO13D - Infotype Level Infotype 1000 (Object) Infotype 1001 (Relationship) Infotype 1002 (Description) Infotype 1007 (Vacancy ) Infotype 1008 (Account Assignment) Infotype 1013 (Employee Group/ Subgroup) VALIDATION POSITIVE T Code Infotype NEGATIVE T Code Infotype The Security Roles are also defined according to various regions, so validation needs to be done in order to check that a particular Role has access to employee data that falls under his/ her Region. PERFORMANCE TESTING REQUIREMENTS OF SAP HCM SOLUTION A. Introduction Performance Testing is a process by which software is tested and tuned with the intent of realizing the required QoS requirements. This process aims to optimize the application performance for key performance indicators like response time, throughput, system threshold limits, etc. Fig. 5.T Code and Infotype access to a Role B. Types of Performance Testing Load Testing: Subjects the SAP system to realistic production loads as per the average usage patterns during a 24 hour global work day. Workload models need to be built as per the overall SAP solution being designed for the organization, to simulate different load patterns. The Test Scenarios simulate production- like loads on identified scenarios concurrently. Results from the test are compared with system performance requirements collected during the requirements analysis phase of the project. 17

Stress Testing: Determines scalability and limits of the SAP system. Stress Test scenarios include testing of identified business scenarios concurrently as well as individually. Identified business scenarios based on the workload are subjected to incremental load till the response time of the SAP application increases drastically. Volume Testing: Targets testing of SAP batch interfaces with large data volumes. SAP Batch jobs identified is subjected to high data volume operations. The test is executed to determine how the SAP system performs when there is large volume of data. Endurance Testing: Aims to determine SAP system stability and performance under prolonged load. Business Scenarios based on 24 hour global work day are subjected to more or less a constant workload for an extended period of time. The test scenarios are executed at average realistic production loads. maximize rollout of SAP off-the-shelf ESS and MSS functionality. Reduce the overall HR cost by enabling the employees to manage their data. This resulted in the implementation of ESS & MSS applications for 20,000+ Employees across globe Ensure high availability with optimized SAP system performance to ensure the success of the implementation across globe. Challenges Increased Complexity in Security Testing as validation had to be done at multiple levels (T Code and Infotype). Achieving High Test Coverage in limited time. 27 Composite and 37 Single Security Roles had to be validated in 40 days. 3750 Test Cases to be executed in a span of 40 days at an average of 93 TCs per day. In addition, for Negative Testing of T Codes, 8426 T Codes had to be tested for 27 Composite Roles at an average of 312 T Codes per Role. Ensure the availability of the performance testing infrastructure for a 24 hour global work day. Performance Testing environment and Production Environment were not similar leading to the creation of a scaled down version of the work load and extrapolation of the results to match the production environment configuration. Limitation of HP LoadRunner 8.1 functionality in Designing the controller scenarios per business requirements INFOSYS CASE STUDY Client Context The Client implemented Human Capital Management (HCM) module of SAP in 1999. The primary objective of the initial implementation was to support US payroll and benefits administration. The project implemented and deployed functionality to the organization by division. This division based approach, combined with a US centric focus has had a detrimental impact on the HCM configuration While SAP functionality had grown and improved, the Client s intended use also changed to the current requirement for having a fully functional global HCM and not just a payroll and benefits system for U.S. In 2009 a Technical Upgrade was done from 4.7C to ECC 6.0, which had a minimal impact on functionality Project Goals Re-design the SAP HCM system leveraging SAP Best Practices, streamlining and standardizing processes globally where possible. Account for unique local (country) processes during the implementation rollouts, i.e., accommodate divisional reporting and security requirements, but enforce SAP Best Practice methodology and standardize to global processes. Minimize customization to reduce total cost of ownership. Analyze and confirm the re-design decisions to Infosys Solution Automated test scripts were developed for Negative T Code Testing. This enabled elaborate testing and made sure that only the right access was provided to the users and prevented any misuse and business disruption because of the same. Positive T Code Role Testing was conducted as part of end-to-end integration testing and thus obviated the need to conduct separate round of testing. This resulted in substantial savings in time and effort. 18

A centralized testing team took ownership of setting up and maintenance of multiple controller machines and 30 load generators across different geographical locations. This ensured that the required infrastructure is always available for the testing team which worked on a 24 hour work day. Workshops were conducted with SAP ABAP development and SAP functional team to understand the test data requirements, which was needed as a prerequisite to run performance tests. As a result, a large chunk of data was created through automated test scripts that reduced the overall testing effort and also gave useful inputs for finalization of locations. After conducting workshops with Business Experts, 10 locations across the Globe were identified for evaluating ESS/MSS application Performance, which had varied Bandwidth and Latency. A workload model was prepared for each location depending upon the number of end users, different profile and environment limitations like server capacity, number of load balancers, and WEBSEAL servers. Interaction with the Business experts in Identification of Business critical transactions and the geographical locations that were critical from the Application Performance Perspective and design workload model based on the feedback collected from business users. Workload model was built according to the scaled down QA environment. For eg, there were 4 security servers in production compared to one in QA. Accordingly the number of concurrent users was determined for QA environment. The workload model then underwent a scrutiny of Business Users, UAT team, BASIS team, Infrastructure team and WEBSEAL team. A testing approach was made by Performance team to monitor the network, collecting various performance parameters like response time, throughput, Hits per second, Bandwidth utilization etc. A combination of WAN simulators, Physical Generators and WAN accelerators were used to test the application and a consolidated report was prepared to evaluate the comparison of the results from Different locations. Various rounds of testing were done consisting of Single user tests, Isolation tests, Different locations in overlapping time zone, at different times of day etc to get the real word experience. present and acquired the capabilities to test application using WAN accelerators like Cisco and Riverbed. HP LoadRunner 8.1 did not have the functionality to do a step up and step down ramping of the number of users, which was a requirement from the performance engineering group. Analysis was done to create a step up and step down ramping for the scenarios consisting of 500 users. The execution time and sequence with specific number of users of scripts. Load and Stress Testing were conducted for validating 3 ESS Forms (Pay Statement, Address, Educational Details) and 4 MSS Forms (New Hire, Transfer, Pay Change, Position/ Location Change) for finding Issues related to Memory Leaks and the load infrastructure could handle. The forms were selected based on business criticality and frequency of use. Various load and Stress tests were conducted for a maximum of 500 concurrent users to Benchmark response time and CPU utilization and Memory availability. Performance test reports were presented to the client in customized, simple reports through which it is easy to interpret the data and identify the transactions with degrading performance. Fig. 7: Comparison Graph of Bandwidth Consumption for different locations Setup a Central LAB for doing performance testing from locations where physical generators were not 19

HP Quick Test Professional (QTP) HP Quick Test Professional software is advanced, automated testing software for building functional and regression test suites. It captures, verifies and replays user interactions automatically and helps testers quickly identify and report on application effects, while providing advanced functionality for tester collaboration. Fig. 8: Sample Percentage of Response Time Comparison Graph for different locations Benefits Use of Automated Test scripts helped in high coverage of Test Cases in the limited duration available for the testing team 60% of effort was saved in Negative T Code Testing by using Automated test scripts Resulted in overall cost savings of ~USD 24,000 Executing complete functionality for testing T Codes ensured high process coverage Ensured zero defects in production Various load and Stress tests were conducted for a maximum of 500 concurrent users to Benchmark response time and CPU utilization and Memory availability. Critical Performance bottlenecks were identified in one of the 7 forms subjected to performance testing. The innovative Central LAB solution helped in identifying the same. Issues related to Application Login were resolved which ensured the acceptance of the SAP HCM solution and resulted in end-user satisfaction. Testing Tools Used SAP Test Acceleration and Optimization (TAO) SAP Test Acceleration and Optimization tool is used to generate automatic tests during regression testing of SAP solutions, quickly. SAP Test Acceleration and Optimization creates components from the screens of a transaction and parameterizes them. These tests are for a single transaction and can be combined into a scenario test. HP Quality Center (QC) HP Quality Center Quality Center is a Test Management tool which helps organize and manage all phases of the application testing process, including defining releases, specifying requirements, planning tests, executing tests, and tracking defects. HP LoadRunner HP LoadRunner is an automated performance and load testing tool for examining system behavior and performance, while generating actual load. LoadRunner contains the following components: The Virtual User Generator captures end-user business processes and creates an automated performance testing script, also known as a virtual user script. The Controller organizes, drives, manages, and monitors the load test. The Load Generators create the load by running virtual users. The Analysis helps you view, dissect, and compare the performance results. The Launcher provides a single point of access for all of the LoadRunner components. CONCLUSION In an organization spread across geographies, Implementation/Reimplementation of SAP HCM solution may lead to changes in the existing security Roles and also addition of new ones. Security Testing at the T Code and Infotype level for these Roles becomes critical to avoid incorrect authorizations, especially when it involves sensitive employee data. Performance Testing of ESS & MSS applications in a large organization also gains importance as many employees access the same application concurrently. Automation of Security and Performance Testing can address various challenges posed by such SAP programs and can deliver substantial benefits. 20

REFERENCES AND ACKNOWLEDGEMENTS BIOGRAPHIES [1] SAP ERP Human Capital Management- At the Heart of Your Organization: www.sap.com Abhinav Gupta is a Technical Test Lead with Independent Validation Solution group at Infosys Technologies Ltd. He has 5.5 years of experience in Testing projects in manual and Performance Testing. He has handled multiple roles like Onsite Coordinator, Test Analyst and Technical Test Lead in various projects in Telecom and Oil and Gas domain. He has worked in the successful delivery of many end to end testing projects. [2] Empowering Employees with the Employee Portal in SAP ERP: www.sap.com [3] Empowering Managers with the Manager Portal in SAP ERP: www.sap.com SAP is a registered trademark of SAP AG SAP TAO is a registered trademark of SAP AG HP Quality Center is a registered trademark of HewlettPackard HP Quick Test Professional is a registered trademark of Hewlett- Packard HP LoadRunner is a registered trademark of Hewlett- Packard HP WinRunner is a registered trademark of Hewlett- Packard Any other trademarks referred in this document are the trademarks of their respective owners Chandrashekar.S is a Senior Project Manager with the Independent Validation Solutions group at Infosys Technologies Ltd. He has 16+ years of experience in ERP projects across all the lifecycle stages (from product evaluation to implementation, upgrade, support & maintenance). He has handled multiple roles like Onsite Project Manager, Offshore Project Manager, Quality Assurance Manager in these engagements with many organizations across North America, Europe & Asia. He is a Project Management Professional (PMP) and has presented papers related to Project Management, QA and ERP solutions in many conferences including STEPAUTO, Retail Oracle Users Group, Ignite Germany. Shahbaz Ali is a Consultant with the Independent Validation Solutions group at Infosys Technologies Ltd. He has an experience of 3.5 years in testing of SAP HCM module. He has handled the roles of Onsite Lead and Offshore Lead for Implementation, Reimplementation and Support projects. He is an MBA (Finance and Marketing) and has an overall work experience of 4.5 years. He is a SAP Certified Solution Consultant Human Resources- Management &Administration with SAP ERP 2005. Sharita Priya Castelino is an Associate Consultant with the Independent Validation Solutions group at Infosys Technologies Ltd. She has 5+ years of experience in ERP and CRM testing projects across all the lifecycle stages (like upgrade, Re-implementation). She has handled multiple roles like Onsite Consultant, Offshore Team lead, in these engagements with many organizations across North America. 21