Download - Role to Position Mapping
-
7/22/2019 Role to Position Mapping
1/21
Role to Position Mapping (RtPM)
101OCS Communications Teleconference
-
7/22/2019 Role to Position Mapping
2/21
2
Objectives
Provide OCS practitioners insight into the process of Role toPosition Mapping in ERP implementations
What is it?
How it works
Data sources used
Who is involved?
Timing
Discuss how the process of Role to Position Mapping impactsChange Management practitioners
Share Role to Position Mapping lessons learned from the DisneySAP BPS implementation project
-
7/22/2019 Role to Position Mapping
3/21
3
Definitions of Terms You Will Be
Hearing
RoleA group of related SAP or manual worksteps with a level ofauthority and a series of KSA (Knowledge, Skills, and Abilities)requirements. Multiple roles may be mapped to a position.
PositionThe unique combination of job and organization unit thatcreates an employees job title. Multiple positions may be mappedto a role.
Segregation of Duties (SOD)Those combinations of roles mappedto a single position with duties that are potentially conflicting in
nature that may cause internal or financial control issues.
-
7/22/2019 Role to Position Mapping
4/21
4
What is Role to Position Mapping?
Role to Position Mapping (RtPM) is the activity of assigning roles to
positions within an organization
RtPM is the determination of who can do what in an ERP
implementation
RtPM process is sensitive to the confidential nature of personnel
information
Access to salary information, social security numbers, job codes, union
data, etc. is not included
Roles mapped
to positions
Positions mapped
to people
People mapped to
courses and access
-
7/22/2019 Role to Position Mapping
5/21
5
Why is Role to Position Mapping
Critical?The outcome of the RtPM exercise is critical to implementation of ERP systems ...
Provides the Security team with the information to create accurate security profiles
...And also provides critical inputs for change management-related activities:
Identifies appropriate training for end users
Provides information about potential change implications and job impacts
Establishes defined audiences for targeted communications
Why is it important for a Change practitioner to lead or facilitate the RtPM process?
1. To kick start collaboration between change management practitioners and the rest of the project
2. To present a single face and single source to the client organization for information
3. To ensure that RtPM is not done in a vacuum but that key stakeholders (mappers) are educated on the
roles, impacts to jobs, and potential risks associated with the RtPM activities
-
7/22/2019 Role to Position Mapping
6/21
6
How Does RtPM Work?
Transaction:SAP worksteps
SAP Business ProcessesProcess
Sub-ProcessSub-Process
ActivityActivityActivity
WorkstepWorkstepWorkstep
RtPM Begins by linking SAP Business Processes to a Transaction
-
7/22/2019 Role to Position Mapping
7/21
7
and Maps that Transaction to
Positions and Employees
Transaction:
SAP worksteps
SAP Business Processes
Process
Sub-ProcessSub-Process
ActivityActivityActivity
WorkstepWorkstepWorkstep
xxx Organization
Position:performsone ormore roles
EmployeeName
RoleRole
Role:performsone or moretransactions
EmployeeName
-
7/22/2019 Role to Position Mapping
8/21
8
then RtPM Data is Used to Develop Change, Training
and Security Deliverables
Transaction:SAP worksteps
SAP Business ProcessesProcess
Sub-ProcessSub-Process
ActivityActivityActivity
WorkstepWorkstepWorkstep
Position:
performsone ormore roles
Employee
Name
RoleRole
Role:performsone or moretransactions
EmployeeName
Security:Enables Securityteam to createsecurity profiles
Change:Enables OR teamto create targetedcommunications tospecific audiences
Training:Enables OR teamto identify trainingcandidates,curriculum, etc.
xxx Organization
-
7/22/2019 Role to Position Mapping
9/21
9
RtPM Key Players and Activities
Gather Role and Position
Information
Role to Positions
Mapping processValidate Results
Project
Implementation
Map transactions to roles
Provision roles in the role
mapping database
Provide role requirements
and business justifications
Define roles
Provide employee data to
Security to load into role
mapping database
Provide job descriptions to
assist with mapping
Participate in role education
sessions
Define security restrictions
and discuss potential SODs
Participate in role education
sessions
Work with local SMEs to map
roles to positions
Facilitate role education
sessions
Coordinate with other project
teams to meet criticaldeadlines
Track and communicate
progress to key executives
Check for potential SODs
Document business process
controls
Work with key executives /
SMEs to ensure mapping
consistency
Update role mapping data in
the mapping database
Coordinate and facilitate role
validation meetings with
process teams, SMEs, and
client executives
Leverage initial mapping data
to obtain estimated user count
Build curriculum by mapping
roles to courses
Transport final role mapping
results into production
Test users mapping and security
access
Use mapping data to assess
change impacts and potential
job impacts (esp. union
employees) communicate change impacts to
end users
Include change impacts
Use mapping data to estimate
training audience count
Leverage role assignments to
schedule training
Security
Process/
functional
HR
Change Mgmt
&
Comms
Training
-
7/22/2019 Role to Position Mapping
10/21
10
Disney Forecast & Planning Project
RtPM Lessons Learned
Identify role mapping strategy (who, what, how, when) early in the project
Push for mapping to a position and not at the individual level to promote standardization
Manage the overall mapping process, timeline, and expectations to meet different teams deliverable needs while
keeping in mind mapper availability.
Very difficult to do unless it is managed early and added in as part of each teams resource plan; including change management
Work closely with the Security team to design role mapping tool/database
Avoid using spreadsheets (high data error rate)
Push for automated mapping tool and reports to empower mappers to review and validate own work before due dates
Educate mappers on roles, transactions, and security model before the start of the role mapping exercise
Instill interim deadlines to review mapping results for consistency and adherence to project guidelines
Schedule reoccurring calls with the mappers, process and security teams to check progress This also works as a platform to discuss new information, raise questions, remove roadblocks
Obtain signoff on the mapping results from key client executives
Promotes participation in the process and ownership of the final product
-
7/22/2019 Role to Position Mapping
11/21
11
Summary
RtPM creates consistent ERP-enabled rights and responsibilities that are standardized within each Division
(and company-wide, where possible)
RtPM is critical because it forces the different project teams to work together and integrate
implementation efforts
Many different teams involved with many interdependencies
Change Management, HR, Security, Process, Training, Communication
RtPM helps put Change Management on the project teams map!
Effort needs to be planned, integrated, and started quickly
Estimated efforts required during peak RtPM times:
Change management: 50% of one FTE
Process: 25% of one FTEs time per process
Security: 50% of one FTE
HR: 25% of one HR rep per division/business unit
Caveat - Not all RtPM efforts are the same
Process, tools, and resources will vary depending on the type of system being implemented and
your clients unique requirements
However, fundamentally all RtPM efforts begin with collaboration between HR, Process, and
Security teams to deliver key outcomes that directly support the projects success.
-
7/22/2019 Role to Position Mapping
12/21
12
Sample RtPM Timeline
TASKS
Jan
Legend
Feb Mar Apr May Jun
3/1: Complete Role Descriptions and Segregation of DutiesSEC
Functional TeamFUNC
3/18-4/5: Conduct RtPM TrainingCH
Change Management//Communications TeamCH
3/5-3/11: Conduct Initial Mapping of Roles to Position TitlesFUNC
MappersMAP
3/20-5/3: Map Roles to PositionsMAP
5/3: Deliverable - RtPM MapRtPM
5/3: Provide mapping to Training and
SecurityCH
1/8-2/27: work with HR to identify Division-specific PositionsCH
Week of 3/11: Build Division-specific SpreadsheetsCH
SEC
4/19-5/3: Project Team Validates Mapping
CH
MAP
SEC
Security TeamSEC
5/3-Go Live: Maintenance
5/3: Implement change impacts in
end user communicationsCH
-
7/22/2019 Role to Position Mapping
13/21
Role Creation
-
7/22/2019 Role to Position Mapping
14/21
14
Organization Design is Different than Role to Position Mapping
SAP Role GroupSAP Role GroupSAP Role Group
SAPRole
SAPRole
SAPRole
SAPRole
SAPRole
SAPRole
SAPRole
TWDC
Position A
TWDC
Position B
TWDC
Position D
TWDC
Position C
TWDC
Position E
Division
Structure
Department
Structure
Department
Structure
TopDown
BottomU
p
-
7/22/2019 Role to Position Mapping
15/21
15
Baseline Role Development Process
1
SAP Txn. 1
Role 1
SAP Txn. 2
SAP Txn. 3
SAP Txn. 4
SAP Txn. 5
Activity
Starting Point:
Role defined at the Activity level of the Blueprintdocumentation and includes all SAP transactions.
2SAP Txn. 1
Role 1
SAP Txn. 2
SAP Txn. 3
SAP Txn. 4
SAP Txn. 5
It is determined that one of the transactions
is a Display transaction that will be madeavailable to a larger group of people.
3SAP Txn. 3 Role 2
The Display transaction is pulled out of
the original role and becomes a discrete role
itself. It could later be grouped with other
Display roles performed by the same group
of end users.
4 SAP Txn. 1Role 1
SAP Txn. 2
SAP Txn. 4
SAP Txn. 5
Out of the transactions remaining in the
original role, another is determined to be an
Approval transaction that will be assigned to
a smaller, more senior group of end users.
5
SAP Txn. 5 Role 3
The Approval transaction is pulled out of
the original role and becomes a discrete
role itself.
6SAP Txn. 1
Role 1SAP Txn. 2
SAP Txn. 4
The original role now only has 3 transactions.
It has evolved into 3 discrete roles.
-
7/22/2019 Role to Position Mapping
16/2116
Example Role Descriptions & Mapping Input
Finance - General Ledger
SAP Role SAP Role Description
If you map the SAP Role inthe first column to a
position, then the role(s)
below should also be
mapped
R3: G/L JE Approver This role allows a user to post parked
Journal Entry Documents
R3: G/L Display
R3: G/L Reporting
R3: G/L JE Processor This role allows a user to create and
park Journal Entry Documents
R3: G/L Display
R3: G/L Reporting
R3: G/L Master Data
Maintainer
This role allows a user to maintain
company code specific Chart of Account
Master Data.
R3: G/L Display
R3: G/L Master Display This role allows a user to display the
General Ledger Chart of Accounts and
G/L Account Lists within their own
company code(s).
N/A
-
7/22/2019 Role to Position Mapping
17/21
Role Mapping and Segregation of
Duties Conflicts
-
7/22/2019 Role to Position Mapping
18/21
18
Segregation of Duties (SOD) Overview
Given the integrated nature of SAP, there are certain inherent rolecombinations that represent segregation of duty (SOD) conflicts
SOD conflicts could lead to internal control issues such as fraud,misleading information, etc.
An example SOD conflict:1. Vendor Maintenance
2. AP Invoice Processor3. AP Check Processor
In the above example, a user could create a fictitious vendor andprocess a payment
While this is a simple example, there are numerous standard SAPconflicts that must be incorporated into the RtPM process
-
7/22/2019 Role to Position Mapping
19/21
19
SOD Conflicting Roles Matrix
As part of the RtPM process, we are providing a summary matrix ofSOD conflicting roles
The general objective of these conflicts is to point out any rolecombinations that may cause internal or financial control issues
This list is not all encompassing
Instead it is a starting point that will be refined over time
Mappers can reference this document during the RtPM process to
determine which combination of roles may or may not be wellsuited to a position
-
7/22/2019 Role to Position Mapping
20/21
20
Example SOD Role ConflictsFinanceGeneral Ledger
SAP Role Area Potential Conflicts Potential Control Risks
Global Chart ofAccounts Maintainer
General Ledger Journal EntryProcessor
Potential misstatement of financialstatements
Chart of Accounts disorganization
Potential misclassification of financial
transactions
General Ledger
Journal Entry
Approver
Accounts Payable Invoice
Processor
Potential misstatement of financial
statements
Entry of fictitious A/P invoices which
could lead to fraud
General Ledger
Journal Entry
Processor
Accounts Payable Invoice
Processor
Potential misstatement of financial
statements
Entry of fictitious A/P invoices which
could lead to fraud
General LedgerPeriod Closer
General Ledger Journal EntryProcessor
General Ledger Journal Entry
Approver
Accounts Payable Invoice
Processor
Potential material misstatement offinancial statements by posting to closed
(and/or audited) periods
-
7/22/2019 Role to Position Mapping
21/21
21
SOD Exceptions
As part of the RtPM process, we understand thatSOD exceptions may come up
The business may identify a new SOD conflict
or The business may identify a need to assign SOD
conflicting roles
In either case, the feedback is positive and will beincorporated into the RtPM process