For SAP-using organizations, regulatory compliance is not an option. It’s crucial to find an effective way to comply with the increasing number of standards from Sarbanes-Oxley (SOX) to FDA 21CFR Part 11, and other government and industry mandates. Non-compliance can result in hefty fines and sanctions, bad press, and even jail time for executives and board members.
The challenge is that the regulations and requirements are highly diverse, can change frequently, and often need to give clear guidelines on what organizations must do to comply. Adopting the mandates require stringent access controls, well-defined and consistent processes, and greater visibility across your organization.
Yet, it can be a smooth process for SAP IT teams to comply with regulatory requirements. A flexible and automated SAP change workflow is a practical way to overcome complex and evolving standards and guarantee compliance. By customizing and automating workflows, you can ensure all necessary steps happen, occur in the proper order, are documented, and are auditable.
How Rev-Trac can help
Rev-Trac Platinum, our automated SAP change management platform, allows you to build regulatory requirements into your workflow, ensuring compliance and consistent processes across an application’s lifestyle.
For each type of work, configure Rev-Trac to define:
- What statuses a request should pass through
- Who should approve each status
- Where do changes migrate to
You can use request completion rules to ensure each step of the process is enforced. For instance, you can set up rules to force users to add relevant information to a Rev-Trac request before the request reaches a certain status.
Process assignment is fundamental to creating a workflow. This is where companies tie in the strategy and organization structure to a project/ request type combination. You can also define the appropriate migration methods and target groups for the statuses to fulfil their requirements.
Keep on top of what is introduced into production
With Rev-Trac, you can continuously monitor all transportable changes in your SAP landscape. Rev-Trac intercepts every transportable change and requires it to be associated with a Rev-Trac request.
Once assigned to a request, Rev-Trac automatically progresses the change using a predefined approval and migration process. This gives an organization control over what is imported into production. These migration features include:
- Technical capabilities, including automated safety checks to ensure, for example, no accidental migrations occur.
- Administrative functionality, such as providing an audit of who approved each migration rather than who migrated the transport.
SOX compliance
Knowing who approves each change to migrate to the next step in a pre-defined workflow is essential when complying with SOX, for example. This concept underpins segregation of duties (SOD) which is fundamental to guaranteeing SOX compliance.
SOD prevents single users from migrating a change to production without others having visibility and approval. Rev-Trac helps organizations to avoid SOD conflicts by ensuring that the person who has made the change is not approving the change.
Companies can also implement conditional statuses where and authorized team member approves a certain status while another person approves a different status. With Rev-Trac, you can also remove approval types based on the objects in the transport when modifying a workflow.
FDA 21 CFR Part 11 Compliance
The ability to customize and automate an end-to-end workflow is also critical when considering CFR Part 11. In some ways, CFR Part 11 is like SOX but deals more specifically with companies using electronic records and signatures, particularly pharmaceutical companies.
The regulation makes electronic records and signatures as valid and trustworthy as paper records, which is crucial for pharmaceuticals and other organizations operating in highly regulated environments. Rev-Trac’s two component approvals help organizations satisfy CFR Part 11 regulations. This feature requires users to enter their SAP User ID and a password to approve requests complying with security controls for user identification requirements.
Just as important from a compliance perspective is a transparent auditable trail of all SAP changes and transports across an SAP landscape. Rev-Trac provides various reports documenting in real-time progression across a pre-defined workflow that can be used for audit trails. These reports include:
- Workflow approval Report: Provides approval details on regular and migration statuses of Rev-Trac requests.
- Rev-Trac System Log: Changes to organization structure are logged into system logs.
- Migration Report: Rev-Trac provides migration-related reports, which include Propagation, Chronological, System/Client Comparison,Plan vs Reality, Migration Log, and Acceptable Return C These reports are generated from data stored in the transport movement history database in every system in the Rev-Trac landscape.
Bottom Line
A constantly evolving regulatory landscape is forcing organizations to address compliance. It can be a challenge for SAP organizations still relying on traditional manual change management. A flexible workflow combined with the capability to automate your SAP change management processes with a solution like Rev-Trac can guarantee compliance and successful, stress-free audits.
For more information on how to customize and automate your workflows with Rev-Trac, please reach out to our SAP change management experts.
