SAP SoD Remediation & MCA Rule 11(g) Compliance for a Listed Manufacturer
Sector
Manufacturing — Listed BSE/NSE Company
Engagement Type
SAP SoD Analysis + SAP Audit Trail Review (Rule 11g) + IFC Testing
Duration
10 weeks
SEO Keywords
SAP SoD remediation India, MCA Rule 11g SAP, IFC testing listed company, SAP audit India
The challenge
A large listed manufacturing company had received an adverse comment from their statutory auditors on the SAP audit trail — noting that audit trail features were not consistently enabled across all modules, raising concerns under MCA Rule 11(g). Additionally, the statutory auditors had flagged SAP SoD conflicts as a material weakness in IFC. The company’s previous IT audit firm had not been able to provide granular SAP-level remediation guidance.
What Zorixx Did
- Conducted a comprehensive SAP access review across 600+ active SAP users
- Performed granular SoD analysis using Zorixx’s SoD conflict matrix — identified 47 high-risk and 120 medium-risk conflicts
- Designed role remediation plan — rebuilt 12 critical SAP roles to eliminate SoD conflicts
- Reviewed SAP audit trail configuration across all FI, CO, MM, SD, and HR modules
- Identified 3 modules where audit trail was disabled — worked with SAP Basis team to activate
- Verified tamper-evidence of audit logs — reviewed backup procedures for logs
- Prepared Rule 11(g) compliance evidence package for statutory auditors
- Updated the IFC Risk Control Matrix to reflect SAP-level controls
Outcomes
SoD Conflicts
Reduced from 47 high-risk conflicts to 3 (residual, with compensating controls)
Rule 11(g)
Statutory auditors cleared the audit trail finding — compliance confirmed
IFC
Material weakness remediated — statutory auditors removed SAP SoD finding from management letter
Role Redesign
12 SAP roles rebuilt — reducing access footprint by 35%
Ongoing
Engaged Zorixx for annual SAP access review and audit trail health check