In the fourth part of this series, you will learn how to further reduce the results from last post and find actual outliers. You will then be able to question the operating departments even more specifically.
Part IV of the series: “FI documents posted during weekend”
1. What postings during weekend have to do with the fraud triangle
2. How to identify postings during weekend
3. Postings during weekend you should definitely not ignore
4. Quick Guide: Reducing the identified amount of postings
The SAP batch input sessions
In one of our previous blog posts, we already mentioned the topic of SAP batch input sessions. The mentioned blog post was about super users and the suspicion of the misuse of batch input sessions. However, this post is about identifying a critical type of document and separate the batch input sessions from the results. In the last post, we already analyzed which types of documents are to be considered critical. Today, we would like to further reduce the number of results under these circumstances by taking out the SAP batch input sessions. As a result, we obtain all the postings in the SAP system that were not conducted automatically and therefore done manually.
Identifying the corresponding SAP batch input sessions
We already used SQL statements for the SAP table BKPF (Accounting document header) in the last blog post. Therefore, we need to slightly adapt the statement from the last part of this series to find out if the user’s batch input sessions have been performed during weekend. As already mentioned, the respective field is in the SAP table BKPF and is called: GRPID (Batch input session name). Thus, we simply integrate the parameter GRPID in the SELECT condition of the SQL statement:
SELECT BKPF.MANDT, BUKRS, GJAHR, BELNR, USNAM,USTYP,BLART, GRPID FROM…
Should the results of this request exclusively show values for the field GRPID, no manual postings were performed during the weekend. Then, if you haven’t done it already, you have the possibility to analyze the batch input sessions. Unfortunately, when I analyzed my practice data set, the results only showed “blanks”. Therefore, no automatic postings were conducted during weekend at this point, hence I discussed samples of the 40 results with the operating department. I was luckier with the batch input sessions in another practice data set. The result looks the following:
Did you miss the blog post with the instructions? You can download the step-by-step instructions including the relevant SQL statements right here:
