SAP Substantive testing for 3 Way match

We had discussed 3 way match in SAP in last post about Application Controls testing. Today, in this post we shall discuss about how to test the controls when Walk-through or Configuration testing fails.

Control

It is important that, for every Purchase Order, there is a Good Receipt Note (GRN) and Purchase Invoicing is allowed only if GRN is completed for the goods. The control is important because this ensures that company is receiving money's worth before payment is made to vendor. In short, this control mitigates that risk that company might end up paying without even receiving goods / services.

SAP Configuration

In default SAP installation, a key configuration named "GR-Bsd IV" i.e. "Goods Receipt based Invoice" is editable by users. Which is a cause for concern for auditors, because this will enable users to have invoice without GRN. We had discuss the best case scenario for this configuration to be "Display only", i.e. users should not be able to edit this field in Purchase Order.

Layout config for ME21 (Best case scenario)

More often that not, when we audit SAP we find that this (GR-Bsd IV) field is kept open. See screenshot below.

GR-Bsd IV field is open (Not the best scenario)

Practical Auditing

In practical sense, we cannot just fail the control just because the field is kept open. We need to find out if there were any purchase orders which were created with a wrong config. Obtaining data to substantiate our findings is called as substantive testing.

To substantively test the 3way match control in SAP, we obtain data about purchase Order. Purchase order is divided into 2 parts

1. Header Data (Table - EKKO)
2. Line Level Data (Table - EKPO)

Tables in SAP can be extracted using T-Code SE16. Before we being extracting data. It is important to know where does the GR-Bsd IV field data stored.

The field GR-Bsd IV is stored in EKPO table. EKPO is line level data of all purchase orders. EKPO does not contain any filtering parameters like company code, Date created. Hence we need EKKO table to extract the list of all purchase orders created in a company for a given period, and use the list of purchase orders in EKPO table to get our relevant data and field.

SE16 - For extracting data in any SAP table

EKKO - Parameter entry screen

EKPO - Parameter entry screen

Using EKKO get list of all the purchase orders created for a company code. Then use the list of purchase orders as filter in EKPO to get line level data of all relevant purchase orders.

EKPO table, with GR Bsd IV field highlighted

If we find that there are cases where the field is blank, we can conclude that the control is ineffective. As in our case here in the screenshot.

This concludes our substantive testing for 3 Way match in SAP.