Knowledge base / Reference

Glossary

Segregation of duties (SoD)

No single person should be able to carry out two steps of a process that together allow fraud or error to go unnoticed — for example creating a vendor and paying it.

Risk

A combination of duties that should be split, such as "Maintain vendor master and run payments". Each risk has a level: critical, high, medium or low.

Function

One side of a risk, for example "Run the payment program". It lists the t-codes and authorization values that make it possible.

Action / t-code

A transaction code such as F110. Holding a t-code alone does not mean the user can do the risky thing.

Authorization value

The detailed right behind a t-code, such as company code 1000 or activity 01 (create). ClearDuty checks at this level, which is why it raises fewer false alarms than a t-code list.

Finding

One user who holds one risk, with the roles and values that cause it.

Within one role / across roles

Within one role: the role itself is unsafe and should be fixed once for everyone. Across roles: each role is fine; the combination for this user is the problem.

Exercised

The user actually ran t-codes on both sides of the risk in the usage period.

Mitigating control

A check that catches misuse when the access cannot be removed, for example a monthly review of vendor changes. It needs an owner and an expiry date.

Composite role

A bundle of single roles. ClearDuty looks inside it.

Derived role

A copy of a role with different organisational values, such as another company code. Placeholders such as $BUKRS are resolved from AGR_1252.

Critical action / permission

A single right that is dangerous on its own, such as running any program or holding SAP_ALL.

Firefighter / emergency access

A temporary, logged ID for urgent work that would otherwise need permanent critical access.

Pseudonymisation

Replacing user IDs and role names with codes before sharing a report, with the key kept separately.

Evaluation mode

ClearDuty without a licence: the sample works fully, your own data is limited to 25 users.

Still stuck? Ask us — we answer within one working day.