Endeavor’s IT teams are working with increasingly stringent audit requirements against a backdrop of a growing functional footprint.

Their SAP installation was originally implemented in the mid-1990s, resulting in a ‘snowball effect’ of user access over time. Typical user requests were along the lines of “please mirror Joe’s access”. Also, the problem was exacerbated by long-term users gaining additional access over time, and retaining access that was no longer required in their current business role.

The team conducted Periodic User Access Reviews (UARs), but it was largely an IT-centric process, reliant on manual Excel-based extracts and email. It was a very time-consuming process, and difficult to repeat. Being a manual process, it was also prone to error. It was difficult to track, consolidate responses and audit results. Because it was such a challenging process to manage, getting engagement from the business was difficult. The focus for the UARs was on a small subset of people, largely within the finance department. The team would typically have around 25 people to review the access of around 2,000 people.

What were Endeavor’s main objectives?

Endeavour’s primary goal was to implement a centralized and easily repeatable methodology for conducting UARs, governed by a defined, stable and system-based ruleset.

They needed to:

• Reduce manual preparation effort
• Remove the risk of manual error
• Make risk visible and transparent by type and severity
• Improve UAR end-to-end process efficiency
• Engage and drive business ownership in risk management

Their secondary goal was to improve the efficiency, transparency and reportability in their access provisioning processes.