# Access risk and segregation-of-duties review

Synthetic business case

Connect access requests with users, roles, risk rules and emergency-access records to review conflicts and mitigating-control proposals.

## Business question

A user can maintain suppliers and release payments. How should that conflict be reviewed?

## Who it is for

Internal control, IT access management and audit teams

## Business objects

- Users
- Roles and permissions
- Access requests
- Segregation-of-duties rules
- Emergency accounts

## Try the workflow

1. Inspect linked business records — Select sample U-FIN-023 and inspect users, roles and permissions, access requests and their linked records.
2. Analyze risk and source evidence — Analyze the supplier-maintenance/payment-release conflict against job responsibilities, risk rules and mitigating evidence.
3. Edit source data and recalculate — Edit a source record in the sample segregation-of-duties rule table and analyze again to compare review evidence; this does not change live account permissions.
4. Review and track the current response — Review the response as guided and inspect risk tasks; actions on demo business records do not grant live system access.

## Adapt to your business

- Map users, jobs, roles and authorization objects.
- Have control owners define conflicts, emergency-access time limits and mitigation responsibilities.
- Use existing enterprise roles and resource permissions. This package is a synthetic business example; live SAP connections and updates require separate integration and validation.

## Case package

Version: 0.1.0 · 240 rows · 43 resources · 67566 bytes

Package language: Chinese

SHA256: 5cf7191d0ab2e2c85dbbde39cf239f3b1f5555db4dfc5d1226b54bd066c520ec

Import checks the required capabilities and your account permissions.

[ZIP](/case-packages/sap-grc-access-demo/0.1.0/case.zip)

[Import guide](/en/cases/import)

Required capabilities: sap-domain-case-workflow v1

This synthetic case is not a customer success story.