role to position mapping

7/22/2019 Role to Position Mapping

1/21

Role to Position Mapping (RtPM)

101OCS Communications Teleconference


2/21

2

Objectives

Provide OCS practitioners insight into the process of Role toPosition Mapping in ERP implementations

What is it?

How it works

Data sources used

Who is involved?

Timing

Discuss how the process of Role to Position Mapping impactsChange Management practitioners

Share Role to Position Mapping lessons learned from the DisneySAP BPS implementation project


3/21

3

Definitions of Terms You Will Be

Hearing

RoleA group of related SAP or manual worksteps with a level ofauthority and a series of KSA (Knowledge, Skills, and Abilities)requirements. Multiple roles may be mapped to a position.

PositionThe unique combination of job and organization unit thatcreates an employees job title. Multiple positions may be mappedto a role.

Segregation of Duties (SOD)Those combinations of roles mappedto a single position with duties that are potentially conflicting in

nature that may cause internal or financial control issues.


4/21

4

What is Role to Position Mapping?

Role to Position Mapping (RtPM) is the activity of assigning roles to

positions within an organization

RtPM is the determination of who can do what in an ERP

implementation

RtPM process is sensitive to the confidential nature of personnel

information

Access to salary information, social security numbers, job codes, union

data, etc. is not included

Roles mapped

to positions

Positions mapped

to people

People mapped to

courses and access


5/21

5

Why is Role to Position Mapping

Critical?The outcome of the RtPM exercise is critical to implementation of ERP systems ...

Provides the Security team with the information to create accurate security profiles

...And also provides critical inputs for change management-related activities:

Identifies appropriate training for end users

Provides information about potential change implications and job impacts

Establishes defined audiences for targeted communications

Why is it important for a Change practitioner to lead or facilitate the RtPM process?

1. To kick start collaboration between change management practitioners and the rest of the project

2. To present a single face and single source to the client organization for information

3. To ensure that RtPM is not done in a vacuum but that key stakeholders (mappers) are educated on the

roles, impacts to jobs, and potential risks associated with the RtPM activities


6/21

6

How Does RtPM Work?

Transaction:SAP worksteps

SAP Business ProcessesProcess

Sub-ProcessSub-Process

ActivityActivityActivity

WorkstepWorkstepWorkstep

RtPM Begins by linking SAP Business Processes to a Transaction


7/21

7

and Maps that Transaction to

Positions and Employees

Transaction:

SAP worksteps

SAP Business Processes

Process




xxx Organization

Position:performsone ormore roles

EmployeeName

RoleRole

Role:performsone or moretransactions

EmployeeName


8/21

8

then RtPM Data is Used to Develop Change, Training

and Security Deliverables

Transaction:SAP worksteps

SAP Business ProcessesProcess




Position:

performsone ormore roles

Employee

Name

RoleRole

Role:performsone or moretransactions

EmployeeName

Security:Enables Securityteam to createsecurity profiles

Change:Enables OR teamto create targetedcommunications tospecific audiences

Training:Enables OR teamto identify trainingcandidates,curriculum, etc.

xxx Organization


9/21

9

RtPM Key Players and Activities

Gather Role and Position

Information

Role to Positions

Mapping processValidate Results

Project

Implementation

Map transactions to roles

Provision roles in the role

mapping database

Provide role requirements

and business justifications

Define roles

Provide employee data to

Security to load into role

mapping database

Provide job descriptions to

assist with mapping

Participate in role education

sessions

Define security restrictions

and discuss potential SODs

Participate in role education

sessions

Work with local SMEs to map

roles to positions

Facilitate role education

sessions

Coordinate with other project

teams to meet criticaldeadlines

Track and communicate

progress to key executives

Check for potential SODs

Document business process

controls

Work with key executives /

SMEs to ensure mapping

consistency

Update role mapping data in

the mapping database

Coordinate and facilitate role

validation meetings with

process teams, SMEs, and

client executives

Leverage initial mapping data

to obtain estimated user count

Build curriculum by mapping

roles to courses

Transport final role mapping

results into production

Test users mapping and security

access

Use mapping data to assess

change impacts and potential

job impacts (esp. union

employees) communicate change impacts to

end users

Include change impacts

Use mapping data to estimate

training audience count

Leverage role assignments to

schedule training

Security

Process/

functional

HR

Change Mgmt

&

Comms

Training


10/21

10

Disney Forecast & Planning Project

RtPM Lessons Learned

Identify role mapping strategy (who, what, how, when) early in the project

Push for mapping to a position and not at the individual level to promote standardization

Manage the overall mapping process, timeline, and expectations to meet different teams deliverable needs while

keeping in mind mapper availability.

Very difficult to do unless it is managed early and added in as part of each teams resource plan; including change management

Work closely with the Security team to design role mapping tool/database

Avoid using spreadsheets (high data error rate)

Push for automated mapping tool and reports to empower mappers to review and validate own work before due dates

Educate mappers on roles, transactions, and security model before the start of the role mapping exercise

Instill interim deadlines to review mapping results for consistency and adherence to project guidelines

Schedule reoccurring calls with the mappers, process and security teams to check progress This also works as a platform to discuss new information, raise questions, remove roadblocks

Obtain signoff on the mapping results from key client executives

Promotes participation in the process and ownership of the final product


11/21

11

Summary

RtPM creates consistent ERP-enabled rights and responsibilities that are standardized within each Division

(and company-wide, where possible)

RtPM is critical because it forces the different project teams to work together and integrate

implementation efforts

Many different teams involved with many interdependencies

Change Management, HR, Security, Process, Training, Communication

RtPM helps put Change Management on the project teams map!

Effort needs to be planned, integrated, and started quickly

Estimated efforts required during peak RtPM times:

Change management: 50% of one FTE

Process: 25% of one FTEs time per process

Security: 50% of one FTE

HR: 25% of one HR rep per division/business unit

Caveat - Not all RtPM efforts are the same

Process, tools, and resources will vary depending on the type of system being implemented and

your clients unique requirements

However, fundamentally all RtPM efforts begin with collaboration between HR, Process, and

Security teams to deliver key outcomes that directly support the projects success.


12/21

12

Sample RtPM Timeline

TASKS

Jan

Legend

Feb Mar Apr May Jun

3/1: Complete Role Descriptions and Segregation of DutiesSEC

Functional TeamFUNC

3/18-4/5: Conduct RtPM TrainingCH

Change Management//Communications TeamCH

3/5-3/11: Conduct Initial Mapping of Roles to Position TitlesFUNC

MappersMAP

3/20-5/3: Map Roles to PositionsMAP

5/3: Deliverable - RtPM MapRtPM

5/3: Provide mapping to Training and

SecurityCH

1/8-2/27: work with HR to identify Division-specific PositionsCH

Week of 3/11: Build Division-specific SpreadsheetsCH

SEC

4/19-5/3: Project Team Validates Mapping

CH

MAP

SEC

Security TeamSEC

5/3-Go Live: Maintenance

5/3: Implement change impacts in

end user communicationsCH


13/21

Role Creation


14/21

14

Organization Design is Different than Role to Position Mapping

SAP Role GroupSAP Role GroupSAP Role Group

SAPRole

SAPRole

SAPRole

SAPRole

SAPRole

SAPRole

SAPRole

TWDC

Position A

TWDC

Position B

TWDC

Position D

TWDC

Position C

TWDC

Position E

Division

Structure

Department

Structure

Department

Structure

TopDown

BottomU

p


15/21

15

Baseline Role Development Process

1

SAP Txn. 1

Role 1

SAP Txn. 2

SAP Txn. 3

SAP Txn. 4

SAP Txn. 5

Activity

Starting Point:

Role defined at the Activity level of the Blueprintdocumentation and includes all SAP transactions.

2SAP Txn. 1

Role 1

SAP Txn. 2

SAP Txn. 3

SAP Txn. 4

SAP Txn. 5

It is determined that one of the transactions

is a Display transaction that will be madeavailable to a larger group of people.

3SAP Txn. 3 Role 2

The Display transaction is pulled out of

the original role and becomes a discrete role

itself. It could later be grouped with other

Display roles performed by the same group

of end users.

4 SAP Txn. 1Role 1

SAP Txn. 2

SAP Txn. 4

SAP Txn. 5

Out of the transactions remaining in the

original role, another is determined to be an

Approval transaction that will be assigned to

a smaller, more senior group of end users.

5

SAP Txn. 5 Role 3

The Approval transaction is pulled out of

the original role and becomes a discrete

role itself.

6SAP Txn. 1

Role 1SAP Txn. 2

SAP Txn. 4

The original role now only has 3 transactions.

It has evolved into 3 discrete roles.


16/2116

Example Role Descriptions & Mapping Input

Finance - General Ledger

SAP Role SAP Role Description

If you map the SAP Role inthe first column to a

position, then the role(s)

below should also be

mapped

R3: G/L JE Approver This role allows a user to post parked

Journal Entry Documents

R3: G/L Display

R3: G/L Reporting

R3: G/L JE Processor This role allows a user to create and

park Journal Entry Documents

R3: G/L Display

R3: G/L Reporting

R3: G/L Master Data

Maintainer

This role allows a user to maintain

company code specific Chart of Account

Master Data.

R3: G/L Display

R3: G/L Master Display This role allows a user to display the

General Ledger Chart of Accounts and

G/L Account Lists within their own

company code(s).

N/A


17/21

Role Mapping and Segregation of

Duties Conflicts


18/21

18

Segregation of Duties (SOD) Overview

Given the integrated nature of SAP, there are certain inherent rolecombinations that represent segregation of duty (SOD) conflicts

SOD conflicts could lead to internal control issues such as fraud,misleading information, etc.

An example SOD conflict:1. Vendor Maintenance

2. AP Invoice Processor3. AP Check Processor

In the above example, a user could create a fictitious vendor andprocess a payment

While this is a simple example, there are numerous standard SAPconflicts that must be incorporated into the RtPM process


19/21

19

SOD Conflicting Roles Matrix

As part of the RtPM process, we are providing a summary matrix ofSOD conflicting roles

The general objective of these conflicts is to point out any rolecombinations that may cause internal or financial control issues

This list is not all encompassing

Instead it is a starting point that will be refined over time

Mappers can reference this document during the RtPM process to

determine which combination of roles may or may not be wellsuited to a position


20/21

20

Example SOD Role ConflictsFinanceGeneral Ledger

SAP Role Area Potential Conflicts Potential Control Risks

Global Chart ofAccounts Maintainer

General Ledger Journal EntryProcessor

Potential misstatement of financialstatements

Chart of Accounts disorganization

Potential misclassification of financial

transactions

General Ledger

Journal Entry

Approver

Accounts Payable Invoice

Processor

Potential misstatement of financial

statements

Entry of fictitious A/P invoices which

could lead to fraud

General Ledger

Journal Entry

Processor


Processor

Potential misstatement of financial

statements

Entry of fictitious A/P invoices which

could lead to fraud

General LedgerPeriod Closer

General Ledger Journal EntryProcessor

General Ledger Journal Entry

Approver


Processor

Potential material misstatement offinancial statements by posting to closed

(and/or audited) periods


21/21

21

SOD Exceptions

As part of the RtPM process, we understand thatSOD exceptions may come up

The business may identify a new SOD conflict

or The business may identify a need to assign SOD

conflicting roles

In either case, the feedback is positive and will beincorporated into the RtPM process