--- title: How to define a SoD Matrix description: "Our tips on how many risks to consider and to define, for which processes. Read our statistics about SoD risks in SAP, learn about the Segregation of Duties management process, and how to build a SoD Matrix" image: https://www.aglea.com/hubfs/Aglea/Imported_Blog_Media/Rischi%20Sod-Jun-14-2024-10-12-04-3239-AM.jpg --- [linkedin](https://www.linkedin.com/company/292350?trk=vsrp_companies_res_name&trkInfo=VSRPsearchId%3A3373431891426179412478%2CVSRPtargetId%3A292350%2CVSRPcmpt%3Aprimary) [YouTube](https://www.youtube.com/c/AgleaSAPSecurity?sub_confirmation=1) [Twitter](https://twitter.com/AgleaItaly?lang=en) [![Logo-Aglea-horsa-company](https://www.aglea.com/hubfs/Aglea/Aglea_November2018%20Theme/Images/Logo-Aglea-horsa-company.webp) ](https://www.aglea.com/en) # How to define a SoD Matrix # How to define a SoD Matrix Posted by [Fabio Mambretti](https://www.aglea.com/en/blog/author/fabio-mambretti) on Jun 3, 2022 12:00:00 AM - [Tweet](https://twitter.com/share) Segregation of Duties project: how many risks need to be defined?   Are you working on a **Segregation of Duties** (SoD) project or are you going to in the future? **Do you need to define risks but don’t know how many?** **![Rischi Sod](https://www.aglea.com/hs-fs/hubfs/Aglea/Imported_Blog_Media/Rischi%20Sod-Jun-14-2024-10-12-04-3239-AM.jpg?width=444&name=Rischi%20Sod-Jun-14-2024-10-12-04-3239-AM.jpg)** Every company has its processes, and not all of them are SoD relevant: **there is no reference number. **One of the most frequent questions during SoD matrix definition meetings is: how many risks do we need to define? There is no single correct answer, but we can learn from what 10 italian companies have done!   Keep in mind: this does not mean that what they’ve done has to be the set rule to apply, however it can give us some perspective and useful advice.   ## [Do you want to know all the details on how to build a SoD Matrix? Download the free checklist here!](https://www.aglea.com/cs/c/?cta_guid=36255d12-10c9-4798-a2e5-ca26dbef85c4&signature=AAH58kESjBY5a8Bpn3csbUaHptiK34HpNw&pageId=6249239459&placement_guid=b53f7b93-7d73-4746-94d3-5d79e8c2c286&click=577b99f4-3216-468c-ac1c-c1510cc0f688&hsutk=d4d18c9b78feff41e4399c3f341cb030&canon=https%3A%2F%2Fwww.aglea.com%2Fblog%2Fprogetto-segregation-of-duties-quanti-rischi-devono-essere-definiti&portal_id=4422290&redirect_url=APefjpFM69lRKWCRbvJrGNT-TmRq5fiNJW3KhU1Ly9wUz12OPvMyP17NyW6ocZMOGC-HEhp3mJzYWR7aum-XdJP_cFyddc51fvbD0tUjjpYDwKNEDsviY1PxYOPCOisBmcbHme4OG_sE6RCBvTzQ34whpOLoc7GNvjkrWsDkB8bdfxi8AgENasVu7QYp0wrsW7QtKbX9AXeKkwmZebGvogWOGSyvVunEUIXl2IQjOxMsOa5Xm0BHpYZlQ5w4R9gbX7hVTFt_C7Ys&__hstc=10030698.d4d18c9b78feff41e4399c3f341cb030.1618843766179.1628235619854.1628241821240.24&__hssc=10030698.1.1628241821240&__hsfp=964902891&contentType=blog-post) ** ** ## Which are the phases of a SoD management project? The Segregation of Duties contains these management steps: - Risks definition - System analysis - Remediation - Mitigation - Continuous compliance   Let’s delve into the risks definition step.   But first, some quick tips before starting: - At first, it’s suggested to **identify few but well-known risks **inside the selected business area. These risks must be easily understandable and accepted by all interlocutors and especially the risks’ owners. In many cases, by starting from a pre-configured matrix it’s easier to find risks that have nothing to do with the company. - For the identified risks, try to work through the whole SoD itinerary. This can help you better understand the various difficulties in the different project steps. - After the introduction of risks and their complete management, **gradually widen the perimeter.**   **A common mistake often takes place, between the professional figures **who are in charge of cooperating on this kind of projects. The involved areas are many, but the most frequent are: - IT - Audit - Business   It’s often the case – especially in more structured companies – that many different figures work inside the IT department: CIO, CISO, IT Manager, Key User, Business Process Owner etc.   **A SoD Management project concerns business departments**, same for the identification and organizational resolution of risks; the IT department only has a support role and should be involved directly only when the risks in question are the ones of its own department. In this case, the IT becomes a direct player in the project.   ## How many risks should you define? Below you can find a graph that shows the number of risks for **10 italian companies confronted with** **the standard SAP GRC Access Control matrix.**   On the Y axis: the number of risks (blue column), number of Duties (red column), number of relevant SoD transactions in the matrix (continuous line with red triangle)   ![Benchmark delle matrici SOD](https://www.aglea.com/hs-fs/hubfs/Aglea/Imported_Blog_Media/Benchmark%20delle%20matrici%20SOD-Jun-14-2024-10-12-04-7387-AM.jpg?width=600&name=Benchmark%20delle%20matrici%20SOD-Jun-14-2024-10-12-04-7387-AM.jpg) ## So, what does this data show? The average number of risks present in these matrixes is 85. This number is much lower when confronted with the one of risks present in the SAP standard Access Control matrix: 300 risks exist there. The number of SoD relevant considered transactions is also different: the average is however 700.   For Segregation of Duties purposes, only transaction which allow creation and change actions are considered, while those that allow display only are not SoD relevant. The latter exclusion, however, might not be correct when other data protection regulation are considered (i.e. [GDPR](https://app.hubspot.com/blog/4422290/edit-beta/52269148466/content))   A company that uses SAP’s main modules, will average 2500/3000 transactions usage. Considering the above-mentioned facts, SoD relevant transactions are about 20% of the total, which is not a small percentage.   Here are the 10 Italian company fields: - Manufacturing - Chemical - Pharmaceutical - Automotive - Energy - Media   Keep in mind that **even custom transaction must be considered when building a SoD matrix** if they have an impact on the financial statement. If these transactions **do not contain authorization controls, **it will be necessary to edit the ABAP code to add them.   Even the type of risk is important: - SoD Risk: Couples (or more than 2) of actions that conflict with each other - Critical Action Risks: parts of the process which have a risk by themselves - Critical Permission Risks: Technical objects that are critical by definition, often in the IT area In case a process is divided on more systems, it’s important to consider a cross-system analysis.   Aglea can help you define a rules matrix: **we have many templates you can start from. **   Furthermore, we developed a solution that **makes it possible to almost semi-automatically understand if a custom transaction (write but also display) has an impact on a SoD Process.**   Finally, if you need to perform a risk analysis on your systems, we can help you with our [Security Analyzer](https://www.taliasecurity.com/) tool    Blog post originally translated from: [https://www.aglea.com/blog/progetto-segregation-of-duties-quanti-rischi-devono-essere-definiti](https://www.aglea.com/blog/progetto-segregation-of-duties-quanti-rischi-devono-essere-definiti) Topics: [Segregation of duties](https://www.aglea.com/en/blog/tag/segregation-of-duties), [SAP Security](https://www.aglea.com/en/blog/tag/sap-security), [audit](https://www.aglea.com/en/blog/tag/audit), [custom transactions](https://www.aglea.com/en/blog/tag/custom-transactions) ### Subscribe Here! ### Blog Aglea, cosa puoi trovare? Ogni mercoledì pubblichiamo articoli, interviste e documenti relativi alla security SAP. Cosa puoi trovare: - Suggerimenti su come mettere in sicurezza i sistemi SAP - Come fare a … (How To) - Checklist - Gli errori comuni che spesso vengono fatti in ambito Security SAP - Interviste con esperti del settore - Chi è AGLEA quale è la nostra vision security SAP ### Recent Posts ### Post By Topic - [SAP Security (12)](https://www.aglea.com/en/blog/tag/sap-security) - [SAP GRC (11)](https://www.aglea.com/en/blog/tag/sap-grc) - [pfcg (8)](https://www.aglea.com/en/blog/tag/pfcg) - [gdpr (7)](https://www.aglea.com/en/blog/tag/gdpr) - [SAP GDPR (5)](https://www.aglea.com/en/blog/tag/sap-gdpr) - [Segregation of duties (5)](https://www.aglea.com/en/blog/tag/segregation-of-duties) - [governance (5)](https://www.aglea.com/en/blog/tag/governance) - [sod (5)](https://www.aglea.com/en/blog/tag/sod) - [SAP ECC (4)](https://www.aglea.com/en/blog/tag/sap-ecc) - [audit sap (4)](https://www.aglea.com/en/blog/tag/audit-sap) - [auditing (4)](https://www.aglea.com/en/blog/tag/auditing) - [sap consulenza security (4)](https://www.aglea.com/en/blog/tag/sap-consulenza-security) - [sap password (4)](https://www.aglea.com/en/blog/tag/sap-password) - [HANA (3)](https://www.aglea.com/en/blog/tag/hana) - [SAP HR (3)](https://www.aglea.com/en/blog/tag/sap-hr) - [UI logging (3)](https://www.aglea.com/en/blog/tag/ui-logging) - [rfc security (3)](https://www.aglea.com/en/blog/tag/rfc-security) - [sap cyber security (3)](https://www.aglea.com/en/blog/tag/sap-cyber-security) - [sap hana (3)](https://www.aglea.com/en/blog/tag/sap-hana) - [sap_all (3)](https://www.aglea.com/en/blog/tag/sap_all) - [security audit log (3)](https://www.aglea.com/en/blog/tag/security-audit-log) - [sicurezza sap (3)](https://www.aglea.com/en/blog/tag/sicurezza-sap) - [su53 (3)](https://www.aglea.com/en/blog/tag/su53) - [HANA Security (2)](https://www.aglea.com/en/blog/tag/hana-security) - [ISO (2)](https://www.aglea.com/en/blog/tag/iso) - [Profiles (2)](https://www.aglea.com/en/blog/tag/profiles) - [SAP FIORI Security (2)](https://www.aglea.com/en/blog/tag/sap-fiori-security) - [SAP audit (2)](https://www.aglea.com/en/blog/tag/sap-audit) - [Secure programming (2)](https://www.aglea.com/en/blog/tag/secure-programming) - [UCON (2)](https://www.aglea.com/en/blog/tag/ucon) - [UI Masking (2)](https://www.aglea.com/en/blog/tag/ui-masking) - [access management (2)](https://www.aglea.com/en/blog/tag/access-management) - [authorization concept (2)](https://www.aglea.com/en/blog/tag/authorization-concept) - [autorizzazioni sap (2)](https://www.aglea.com/en/blog/tag/autorizzazioni-sap) - [consulenti (2)](https://www.aglea.com/en/blog/tag/consulenti) - [corso (2)](https://www.aglea.com/en/blog/tag/corso) - [e-learning (2)](https://www.aglea.com/en/blog/tag/e-learning) - [password policy (2)](https://www.aglea.com/en/blog/tag/password-policy) - [patch (2)](https://www.aglea.com/en/blog/tag/patch) - [programmazione sicura (2)](https://www.aglea.com/en/blog/tag/programmazione-sicura) - [quality (2)](https://www.aglea.com/en/blog/tag/quality) - [rfc (2)](https://www.aglea.com/en/blog/tag/rfc) - [ruoli (2)](https://www.aglea.com/en/blog/tag/ruoli) - [sap access control (2)](https://www.aglea.com/en/blog/tag/sap-access-control) - [sap custom (2)](https://www.aglea.com/en/blog/tag/sap-custom) - [sap etd (2)](https://www.aglea.com/en/blog/tag/sap-etd) - [sap gui (2)](https://www.aglea.com/en/blog/tag/sap-gui) - [sap query (2)](https://www.aglea.com/en/blog/tag/sap-query) - [sap security guidelines (2)](https://www.aglea.com/en/blog/tag/sap-security-guidelines) - [sap siem (2)](https://www.aglea.com/en/blog/tag/sap-siem) - [sap standard role (2)](https://www.aglea.com/en/blog/tag/sap-standard-role) - [sap super user (2)](https://www.aglea.com/en/blog/tag/sap-super-user) - [sap vulnerability (2)](https://www.aglea.com/en/blog/tag/sap-vulnerability) - [se16 (2)](https://www.aglea.com/en/blog/tag/se16) - [security ams (2)](https://www.aglea.com/en/blog/tag/security-ams) - [siem (2)](https://www.aglea.com/en/blog/tag/siem) - [soar (2)](https://www.aglea.com/en/blog/tag/soar) - [supporto sap ams (2)](https://www.aglea.com/en/blog/tag/supporto-sap-ams) - [test system (2)](https://www.aglea.com/en/blog/tag/test-system) - [threat detection (2)](https://www.aglea.com/en/blog/tag/threat-detection) - [upgrade (2)](https://www.aglea.com/en/blog/tag/upgrade) - [312 (1)](https://www.aglea.com/en/blog/tag/312) - [ABAP (1)](https://www.aglea.com/en/blog/tag/abap) - [AI (1)](https://www.aglea.com/en/blog/tag/ai) - [CVA (1)](https://www.aglea.com/en/blog/tag/cva) - [DPO (1)](https://www.aglea.com/en/blog/tag/dpo) - [FIORI Security (1)](https://www.aglea.com/en/blog/tag/fiori-security) - [HANA Roles (1)](https://www.aglea.com/en/blog/tag/hana-roles) - [PFCG SAP transaction (1)](https://www.aglea.com/en/blog/tag/pfcg-sap-transaction) - [SAP Cloud Security (1)](https://www.aglea.com/en/blog/tag/sap-cloud-security) - [SAP Consulting (1)](https://www.aglea.com/en/blog/tag/sap-consulting) - [SAP DLP (1)](https://www.aglea.com/en/blog/tag/sap-dlp) - [SAP Fraud Management (1)](https://www.aglea.com/en/blog/tag/sap-fraud-management) - [SAP IDM (1)](https://www.aglea.com/en/blog/tag/sap-idm) - [SAP LOG (1)](https://www.aglea.com/en/blog/tag/sap-log) - [SAP Security Documentation (1)](https://www.aglea.com/en/blog/tag/sap-security-documentation) - [SAP Table (1)](https://www.aglea.com/en/blog/tag/sap-table) - [SAP Transactions (1)](https://www.aglea.com/en/blog/tag/sap-transactions) - [SPOOL (1)](https://www.aglea.com/en/blog/tag/spool) - [Security Analyzer (1)](https://www.aglea.com/en/blog/tag/security-analyzer) - [Statistiche security SAP (1)](https://www.aglea.com/en/blog/tag/statistiche-security-sap) - [Trace autorizzazioni SAP (1)](https://www.aglea.com/en/blog/tag/trace-autorizzazioni-sap) - [User Access Management (1)](https://www.aglea.com/en/blog/tag/user-access-management) - [aglea (1)](https://www.aglea.com/en/blog/tag/aglea) - [audit (1)](https://www.aglea.com/en/blog/tag/audit) - [authorization model (1)](https://www.aglea.com/en/blog/tag/authorization-model) - [biometric (1)](https://www.aglea.com/en/blog/tag/biometric) - [chatGPT (1)](https://www.aglea.com/en/blog/tag/chatgpt) - [codice sicuro SAP (1)](https://www.aglea.com/en/blog/tag/codice-sicuro-sap) - [consulenti sap security (1)](https://www.aglea.com/en/blog/tag/consulenti-sap-security) - [consulenza sap security (1)](https://www.aglea.com/en/blog/tag/consulenza-sap-security) - [crittografia SAP (1)](https://www.aglea.com/en/blog/tag/crittografia-sap) - [custom transactions (1)](https://www.aglea.com/en/blog/tag/custom-transactions) - [cyber security (1)](https://www.aglea.com/en/blog/tag/cyber-security) - [data loss prevention (1)](https://www.aglea.com/en/blog/tag/data-loss-prevention) - [data privacy (1)](https://www.aglea.com/en/blog/tag/data-privacy) - [documentazione sap security (1)](https://www.aglea.com/en/blog/tag/documentazione-sap-security) - [emergency users (1)](https://www.aglea.com/en/blog/tag/emergency-users) - [gxp (1)](https://www.aglea.com/en/blog/tag/gxp) - [identity management system (1)](https://www.aglea.com/en/blog/tag/identity-management-system) - [idm (1)](https://www.aglea.com/en/blog/tag/idm) - [log sap (1)](https://www.aglea.com/en/blog/tag/log-sap) - [mail security sap (1)](https://www.aglea.com/en/blog/tag/mail-security-sap) - [microsoft (1)](https://www.aglea.com/en/blog/tag/microsoft) - [parameter sap (1)](https://www.aglea.com/en/blog/tag/parameter-sap) - [processi security (1)](https://www.aglea.com/en/blog/tag/processi-security) - [profili (1)](https://www.aglea.com/en/blog/tag/profili) - [profili sap (1)](https://www.aglea.com/en/blog/tag/profili-sap) - [progetti security sap (1)](https://www.aglea.com/en/blog/tag/progetti-security-sap) - [quotazione borsa (1)](https://www.aglea.com/en/blog/tag/quotazione-borsa) - [rfc destination (1)](https://www.aglea.com/en/blog/tag/rfc-destination) - [role translation (1)](https://www.aglea.com/en/blog/tag/role-translation) - [s_tabu_dis (1)](https://www.aglea.com/en/blog/tag/s_tabu_dis) - [s_tabu_nam (1)](https://www.aglea.com/en/blog/tag/s_tabu_nam) - [s_tabu_rfc (1)](https://www.aglea.com/en/blog/tag/s_tabu_rfc) - [sap FIORI (1)](https://www.aglea.com/en/blog/tag/sap-fiori) - [sap btp (1)](https://www.aglea.com/en/blog/tag/sap-btp) - [sap data masking (1)](https://www.aglea.com/en/blog/tag/sap-data-masking) - [sap dati personali (1)](https://www.aglea.com/en/blog/tag/sap-dati-personali) - [sap developer (1)](https://www.aglea.com/en/blog/tag/sap-developer) - [sap earlywatch (1)](https://www.aglea.com/en/blog/tag/sap-earlywatch) - [sap grc 12 (1)](https://www.aglea.com/en/blog/tag/sap-grc-12) - [sap grc tables (1)](https://www.aglea.com/en/blog/tag/sap-grc-tables) - [sap gui history (1)](https://www.aglea.com/en/blog/tag/sap-gui-history) - [sap gui security (1)](https://www.aglea.com/en/blog/tag/sap-gui-security) - [sap gxp compliance (1)](https://www.aglea.com/en/blog/tag/sap-gxp-compliance) - [sap ilm gdpr (1)](https://www.aglea.com/en/blog/tag/sap-ilm-gdpr) - [sap license auditing (1)](https://www.aglea.com/en/blog/tag/sap-license-auditing) - [sap logon (1)](https://www.aglea.com/en/blog/tag/sap-logon) - [sap patch (1)](https://www.aglea.com/en/blog/tag/sap-patch) - [sap security blog (1)](https://www.aglea.com/en/blog/tag/sap-security-blog) - [sap security teal (1)](https://www.aglea.com/en/blog/tag/sap-security-teal) - [sap sos (1)](https://www.aglea.com/en/blog/tag/sap-sos) - [sap splunk (1)](https://www.aglea.com/en/blog/tag/sap-splunk) - [sap sso (1)](https://www.aglea.com/en/blog/tag/sap-sso) - [sap tabelle custom (1)](https://www.aglea.com/en/blog/tag/sap-tabelle-custom) - [sap tdms (1)](https://www.aglea.com/en/blog/tag/sap-tdms) - [sap_all_only_view (1)](https://www.aglea.com/en/blog/tag/sap_all_only_view) - [se16n (1)](https://www.aglea.com/en/blog/tag/se16n) - [secpol (1)](https://www.aglea.com/en/blog/tag/secpol) - [secure coding sap (1)](https://www.aglea.com/en/blog/tag/secure-coding-sap) - [secure operation map (1)](https://www.aglea.com/en/blog/tag/secure-operation-map) - [security awareness (1)](https://www.aglea.com/en/blog/tag/security-awareness) - [security bridge (1)](https://www.aglea.com/en/blog/tag/security-bridge) - [sentinel (1)](https://www.aglea.com/en/blog/tag/sentinel) - [sicurezza codice ABAP (1)](https://www.aglea.com/en/blog/tag/sicurezza-codice-abap) - [sicurezza dei dati sap (1)](https://www.aglea.com/en/blog/tag/sicurezza-dei-dati-sap) - [slaw (1)](https://www.aglea.com/en/blog/tag/slaw) - [social engineering (1)](https://www.aglea.com/en/blog/tag/social-engineering) - [sost (1)](https://www.aglea.com/en/blog/tag/sost) - [sql (1)](https://www.aglea.com/en/blog/tag/sql) - [su25 (1)](https://www.aglea.com/en/blog/tag/su25) - [super utenti sap (1)](https://www.aglea.com/en/blog/tag/super-utenti-sap) - [system users (1)](https://www.aglea.com/en/blog/tag/system-users) - [tabelle (1)](https://www.aglea.com/en/blog/tag/tabelle) - [tabelle SAP grc access control (1)](https://www.aglea.com/en/blog/tag/tabelle-sap-grc-access-control) - [ticket management system (1)](https://www.aglea.com/en/blog/tag/ticket-management-system) - [training (1)](https://www.aglea.com/en/blog/tag/training) - [transazioni sap (1)](https://www.aglea.com/en/blog/tag/transazioni-sap) - [userid (1)](https://www.aglea.com/en/blog/tag/userid) - [usmm (1)](https://www.aglea.com/en/blog/tag/usmm) - [ust04 (1)](https://www.aglea.com/en/blog/tag/ust04) - [zero trust security (1)](https://www.aglea.com/en/blog/tag/zero-trust-security) [See all](https://www.aglea.com/en/blog/how-to-define-a-sod-matrix#) ## [SAP Security Blog AGLEA RSS Feed](https://www.aglea.com/blog/rss.xml) Aglea s.r.l. P. IVA: IT 03868780960 - 2026 | Copy | [Note legali](https://cdn2.hubspot.net/hubfs/4422290/Aglea_November2018%20Theme/Pdfs/Privacy-policy-AGLEA.pdf) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Fabio Mambretti", "url" : "https://www.aglea.com/en/blog/author/fabio-mambretti" }, "dateModified" : "2024-06-14T10:13:57.646Z", "datePublished" : "2022-06-02T22:00:00.000Z", "headline" : "How to define a SoD Matrix", "image" : [ "https://www.aglea.com/hubfs/Aglea/Imported_Blog_Media/Rischi%20Sod-Jun-14-2024-10-12-04-3239-AM.jpg" ], "mainEntityOfPage" : { "@id" : "https://www.aglea.com/en/blog/how-to-define-a-sod-matrix", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject" }, "name" : "Horsa S.p.A." } } ```