HR07- Why only IT0014,0015 have been considered in Permission

[gv_s]

As per note 1083611 - Compliance Calibrator Rule Update Q3 2007, in FunctionID HR07 Tcode - PA20, Field INFTY - Value 0014, 0015 have been enabled for object P_ORGIN.

However, there are many other Payroll & HR critical infotypes that can be modified with PA20 write access.

Has anyone modified this to include other relevant infotypes or even if not, then why only these infotypes should be considered

Would appreciate some views pls

[Colleen]

Hi Gauravi

I always thought HR/PY would be difficult for SAP to provide every value due to country specific configuration. I'm not on a 5.3 but does the action PA20 belong to any other function where the info types might be mentioned there?

Do you have examples of IT not included int function definition (or any function)?

Regards

Colleen

[gv_s]

Hi Collen

Precisely the reason for my concern &  query. HR05 was just an example.

Other would be :

HR04 - Maintain Time Data Tcode- PA61 - Maintain Time Data- Only IT 2001 & 2002 are Enabled. PA61 enables update to a host of other Time Infotypes (some critical like 2011, 2005, 2006 etc). This is applicable for GRC 10 too.

While I understand that Functional team members need to review & update the values as per specific requirements, Was wondering wouldnt it have been better for SAP to leave the INFTY field Disabled, so that a wider population can be considered for SOD and/ or also allow a conscious decision by functional teams to enable all relevant infotypes.

[Colleen]

Hi Gauravi

In truth when you mentioned PA20 allowing edit I was surprises. I thought the idea of PA20 is to mask the create/change/delete/copy buttons and PA30 for updates.

If you think the rules are incorrect, perhaps contact SAP via marketplace. Technically, it should be an incident and fixed in next release (a bit like SU24 updates).

Leaving the field disabled may not be ideal either as you will have a bunch of false positives.

The key lesson is that rule set is a baseline starting point. Some companies will ignore it altogether and build their own. Some implement just it. I see there is a balance between the two extremes.

Regards

Colleen