What is CIAM for government and G2C identity?

Government-to-citizen (G2C) CIAM refers to the governed management of citizen identities across government digital services, including authentication, identity proofing, consent, lifecycle management, and audit requirements under regulatory accountability.

How does CIAM support NIST 800-63 identity assurance levels for government agencies?

CIAM supports NIST SP 800-63 identity assurance levels by dynamically enforcing authentication and identity proofing requirements based on risk. It applies appropriate assurance levels and maintains centralized audit records of each access decision.

What is the difference between citizen identity management and workforce IAM?

Workforce IAM manages internal employee identities based on HR-driven lifecycle events, while citizen identity management governs external identities that require identity proofing, consent-based governance, long-term persistence, and legal auditability.

How do government agencies integrate national eID providers into their CIAM platform?

Government agencies integrate national eID providers through CIAM platforms that support standardized integration, enabling consistent authentication, policy enforcement, and audit logging across different identity sources without custom development.

What deployment options are available for CIAM in government environments?

CIAM platforms for government support on-premise, private cloud, and hybrid deployments to meet data sovereignty, security, and regulatory requirements, with consistent policy enforcement across all environments.

How does CIAM support long-lived citizen identity across multiple agencies?

CIAM supports long-lived citizen identity by maintaining continuity across systems, managing identity updates with audit trails, reconciling records across agencies, and enforcing lifecycle governance over time.

How quickly can a government agency deploy governed citizen identity without a large IT team?

Government agencies can deploy CIAM incrementally using pre-built integrations, templates, and automation tools, allowing rollout with limited IT resources and expansion over time without major infrastructure changes.

SAP SoD Rules for Manufacturing — India IFC Edition

Everything your IFC audit requires. Available on day one.

Mid-size and large manufacturing and distribution companies in India operate complex SAP ECC environments spanning procurement, sales, production, service operations, and financial management. Under the Companies Act 2013, management is required to demonstrate that access controls in SAP are governed in a way that prevents any single individual from executing a complete financial transaction without independent authorization.

The challenge most organizations face when implementing SoD controls in SAP is the cold-start problem: they know they need SoD rules, but mapping the relevant SAP transaction codes, identifying which role combinations create genuine fraud risk, and connecting each rule to a specific control objective is a months-long exercise that requires deep SAP and audit expertise working in combination.

The OpenIAM SoD Accelerator for SAP eliminates this cold-start entirely. Organizations receive a pre-built library of 45 SoD rules across six SAP modules — Financial Accounting, Sales & Distribution, Materials Management, Production Planning, Controlling, and Quality Management — ready to load into OpenIAM on day one. Each rule reflects the operational reality of manufacturing and distribution businesses and maps directly to the control objectives that internal and external auditors test under India's Internal Financial Controls framework. This is the Manufacturing Edition — focused on the six core operational modules. Separate rule sets are available for SAP Basis, HR/Payroll, and Plant Maintenance.

Capability	Detail
Total rules in this edition	45 rules across 6 SAP ECC modules — Manufacturing Edition
Critical risk rules	15 rules — the role conflicts that appear most often in audit findings
High risk rules	20 rules — significant financial reporting risk, actively tested in audit
Medium risk rules	10 rules — best practice controls, important for a mature compliance program
SAP ECC version support	SAP ECC 6.0 — all transaction codes and authorization objects validated for ECC 6.0
S/4HANA compatibility	Yes — the rule set is compatible with SAP S/4HANA. See the S/4HANA compatibility section below for detail.
Time to first violation scan	Hours from connection — no consultant engagement, no rule-building phase required
Regulatory framework alignment	Companies Act 2013 internal controls, ICAI auditing standards, IFC (Internal Financial Controls) requirements
Other module rule sets	SAP Basis, HR/Payroll, and Plant Maintenance are covered by separate OpenIAM SoD rule sets — available as additional modules

Why SoD rules matter for Indian manufacturing companies

The Regulatory Context

Under Section 143(3)(i) of the Companies Act 2013, auditors are required to report on whether the company has adequate internal financial controls and whether such controls are operating effectively. For companies of this scale and complexity, this places a direct obligation on management to demonstrate that access controls in SAP are governed in a way that prevents any single individual from executing a complete financial transaction without a second person's involvement.

The Reserve Bank of India's IT governance frameworks and SEBI's internal controls requirements for listed group companies further reinforce this obligation. Auditors — whether from a Big 4 or leading Indian audit firm — test SAP access controls as part of their IFC assessment. SoD violations found during an audit become reportable deficiencies. Material weaknesses can affect the company's financial statements and the auditor's opinion.

The SAP access control challenge

SAP ECC's role-based authorization model is powerful but does not natively prevent SoD violations. Roles are assigned based on job function, and over time — through promotions, temporary access grants, and emergency access that is never revoked — users accumulate role assignments that individually are appropriate but in combination create dangerous conflicts.

In a manufacturing and distribution context, the most common SoD risks arise in three areas:

Procure-to-pay: a user who can create a vendor in SAP and also approve the payment run creates an opportunity to introduce a fictitious supplier and approve payment to that supplier without any independent check.
Order-to-cash: a user who can create a customer order and also issue a credit memo can manipulate revenue by issuing unauthorized credits to customers or related parties.
Financial reporting: a user who can both post and approve journal entries, or who can maintain general ledger master data and post transactions to it, can manipulate the company's financial statements without detection.

The cost of a missed SoD violation

An SoD violation found by an auditor is not merely a compliance finding — it requires remediation evidence, a management response in the audit report, and potential re-testing in subsequent audit cycles. For a group company of this profile, an IFC deficiency finding can have implications across the group's consolidated financial reporting. Identifying and remediating violations before the auditor finds them — using OpenIAM's pre-built rule set — is significantly less costly than responding to an audit finding after the fact.

The Rule Set Framework

Every rule in the OpenIAM SoD Accelerator is built to the same six-field standard. This consistency means that the output of every violation scan is formatted as audit evidence — not an IT report that needs to be translated before an auditor can use it.

Rule field	Purpose and content
Rule ID	A unique identifier following the convention [VERTICAL]-[MODULE]-[NNN] — e.g. MFG-FI-001, MFG-MM-001. The ID is the permanent reference used in remediation documentation and audit workpapers.
Rule name	Plain language description of the role conflict — e.g. “Create vendor master + Execute payment run”. Written so a finance or audit professional can understand the risk without SAP technical knowledge.
Conflict detail	The specific SAP transaction codes (T-codes) on each side of the conflict, with the full SAP transaction name. This is the technical definition that OpenIAM uses to detect the conflict in the live SAP environment.
Risk level	Critical, High, or Medium. Critical rules map to conflicts that have appeared in actual IFC audit findings at peer organizations. High rules represent significant financial reporting risk. Medium rules represent best practice controls.
Control objective	The internal financial control statement that this rule enforces — expressed in the language of IFC auditing. This is the evidence that management has addressed the control requirement that auditors test.
Remediation guidance	The recommended action when a violation is detected: the preferred role split approach, and the compensating control that can be applied where a role split is not operationally feasible.

Risk level definitions

Critical

A role conflict that could result in financial fraud or a material misstatement. These are the first conflicts IFC auditors test and will be reported as significant deficiencies or material weaknesses if found without compensating controls.

All 15 Critical rules must be addressed before the next audit cycle.

High

A role conflict that creates significant financial reporting risk. These are actively tested in IFC audits. Unmitigated High-level violations are typically reported as control deficiencies requiring management response.

Medium

A role conflict that represents best practice SoD control. Medium-level rules may not be tested in every audit cycle but are important for the organization's long-term compliance posture and for demonstrating a comprehensive approach to access governance.

SAP Module Coverage

The Manufacturing Edition rule set covers the six SAP ECC modules that matter most for manufacturing and distribution operations in India. It is one of several purpose-built OpenIAM SoD rule sets — each focused on a specific functional domain. This edition covers Financial Accounting, Sales & Distribution, Materials Management, Production Planning, Controlling, and Quality Management. The module coverage reflects the business processes where SoD violations most commonly arise and where IFC auditors focus their testing.

Rule set scope — what this edition covers and what it does not

This is the Manufacturing Edition — purpose-built for the six SAP modules that IFC auditors focus on in manufacturing and distribution environments.

In scope — this edition

FI (Financial Accounting) • MM (Materials Management) • SD (Sales & Distribution) • PP (Production Planning) • CO (Controlling) • QM (Quality Management)

Covered by separate rule sets

SAP Basis (technical administration and privileged access) • HR/Payroll (personnel master data, payroll processing, and time management) • Plant Maintenance / PM (work orders, maintenance planning, and equipment master data)

When comparing SoD rule set coverage across vendors, ensure the comparison is module-for-module. A vendor quoting 200+ rules across all SAP modules combined is not comparable to this edition. OpenIAM provides dedicated rule sets for Basis, HR/Payroll, and Plant Maintenance — each with the same IFC depth and audit alignment as this edition.

FI 10 rules

Financial Accounting

General ledger, accounts payable, accounts receivable, and payment processing. The highest-scrutiny module in every IFC audit.

PP 7 rules

Production Planning

Production orders, bill of materials, and goods confirmation. Covers production cost reporting and work-in-progress valuation.

MM 10 rules

Materials Management

Procurement, goods receipt, inventory management, and invoice verification. Covers the procure-to-pay cycle.

CO 6 rules

Controlling

Cost center management, internal orders, and profitability analysis. Protects management accounting integrity.

SD 8 rules

Sales & Distribution

Customer orders, pricing, billing, and credit management. Covers the order-to-cash cycle.

QM 4 rules

Quality Management

Inspection lots and usage decisions. Protects quality certifications, inspection records, and product release decisions.

Rule count by module and risk level

Module	Module name	Risk level	Rules	Key process area
FI	Financial Accounting	Critical	6	Payment processing, GL integrity
FI	Financial Accounting	High	3	AP and AR management
FI	Financial Accounting	Medium	1	Bank master data
MM	Materials Management	Critical	4	Procure-to-pay cycle
MM	Materials Management	High	4	Goods receipt, invoice verification
MM	Materials Management	Medium	2	Inventory adjustments
SD	Sales & Distribution	Critical	3	Order-to-cash cycle
SD	Sales & Distribution	High	3	Customer master, pricing
SD	Sales & Distribution	Medium	2	Returns and credits
PP	Production Planning	Critical	2	Production order integrity
PP	Production Planning	High	3	BOM and routing management
PP	Production Planning	Medium	2	Goods confirmation
CO	Controlling	High	4	Cost center and internal orders
CO	Controlling	Medium	2	Profitability analysis
QM	Quality Management	High	3	Inspection and usage decisions
QM	Quality Management	Medium	1	Quality notifications
Total			45	15 Critical / 20 High / 10 Medium

The 15 Critical Rules - Full Detail

The following 15 rules represent the highest-priority SoD controls for SAP ECC and S/4HANA manufacturing environments in India. Each rule is presented with its complete technical definition and the specific business risk it addresses. These rules are the primary focus of the first OpenIAM violation scan and should be remediated before the next IFC audit cycle. .

Financial Accounting (FI) — 6 Critical Rules

MFG-FI-001Create vendor master + Execute payment run

⌄

MFG-FI-002Post vendor invoice + Approve payment

⌄

MFG-FI-003Post journal entry + Approve journal entry

⌄

MFG-FI-004Maintain GL account master + Post to GL account

⌄

MFG-FI-005Create customer master + Process billing

⌄

MFG-FI-006Maintain bank master data + Initiate bank transfer

⌄

Materials Management (MM) — 4 Critical Rules

MFG-MM-001Create purchase order + Approve purchase order

⌄

MFG-MM-002Create purchase order + Post goods receipt

⌄

MFG-MM-003Create vendor master + Create purchase order

⌄

MFG-MM-004Post goods receipt + Process invoice verification

⌄

Sales & Distribution (SD) — 3 Critical Rules

MFG-SD-001Create sales order + Issue credit memo

⌄

MFG-SD-002Create pricing condition + Process billing

⌄

MFG-SD-003Create customer order + Confirm delivery

⌄

Production Planning (PP) — 2 Critical Rules

MFG-PP-001Modify bill of materials + Release production order

⌄

MFG-PP-002Create production order + Confirm production order

⌄

High and Medium Risk Rules - Summary

The following tables summarize the 20 High and 10 Medium risk rules in the Manufacturing Edition rule set. Full T-code and control objective detail for each rule is available in the OpenIAM platform and in the accompanying technical rule library document.

High Risk Rules (20)

Rule ID	Rule name	Module	Key process area
MFG-FI-007	Maintain AP account + Post vendor invoice	FI	Accounts payable master data
MFG-FI-008	Post AR invoice + Apply cash receipts	FI	Accounts receivable
MFG-FI-009	Create fixed asset + Post asset acquisition	FI	Fixed asset management
MFG-MM-005	Create purchase requisition + Convert to PO	MM	Requisition-to-order
MFG-MM-006	Maintain material master + Post inventory	MM	Inventory management
MFG-MM-007	Post goods issue + Process customer return	MM	Returns management
MFG-MM-008	Maintain info record + Create purchase order	MM	Purchasing conditions
MFG-SD-004	Maintain customer credit limit + Release blocked order	SD	Credit management
MFG-SD-005	Create customer master + Maintain credit limit	SD	Customer master data
MFG-SD-006	Create sales order + Approve sales order discount	SD	Discount authorization
MFG-PP-003	Maintain routing + Confirm production operation	PP	Work center management
MFG-PP-004	Maintain work center + Create production order	PP	Resource management
MFG-PP-005	Post goods issue to order + Confirm production	PP	Material consumption
MFG-CO-001	Create cost center + Post to cost center	CO	Cost center management
MFG-CO-002	Create internal order + Post to internal order	CO	Internal order management
MFG-CO-003	Maintain settlement rule + Execute settlement	CO	Order settlement
MFG-CO-004	Maintain cost element + Post primary cost	CO	Cost element management
MFG-QM-001	Create inspection lot + Record inspection results	QM	Quality inspection
MFG-QM-002	Record inspection results + Post usage decision	QM	Quality decision
MFG-QM-003	Create quality notification + Complete notification	QM	Quality notifications

Medium Risk Rules (10)

Rule ID	Rule name	Module	Key process area
MFG-FI-010	Maintain bank account + View bank statement	FI	Treasury — best practice
MFG-MM-009	Conduct physical inventory + Post count difference	MM	Inventory count
MFG-MM-010	Create service entry sheet + Approve service entry	MM	Service procurement
MFG-SD-007	Create returns order + Post goods return receipt	SD	Returns processing
MFG-SD-008	Maintain output condition + Process billing	SD	Output management
MFG-PP-006	Create capacity plan + Confirm production order	PP	Capacity management
MFG-PP-007	Maintain production version + Create production order	PP	Production version
MFG-CO-005	Maintain allocation cycle + Execute allocation	CO	Cost allocation
MFG-CO-006	Maintain planning version + Post actual costs	CO	Plan vs actual
MFG-QM-004	Create sampling procedure + Create inspection lot	QM	Sampling management

S/4HANA Compatibility & Additional Modules

S/4HANA compatibility

The OpenIAM SoD Accelerator rule set is fully compatible with SAP S/4HANA. When an organization migrates from ECC 6.0 to S/4HANA — whether to on-premise S/4HANA or SAP S/4HANA Cloud Private Edition — the rule set migrates with it without requiring a rebuild. This protects the organization’s compliance investment across the migration.

Compatibility detail	Explanation
T-code continuity	The vast majority of transaction codes in the rule set exist in S/4HANA with identical names and functions. SAP has preserved ECC T-codes for backwards compatibility, and FI, MM, SD, PP, CO, and QM T-codes have particularly high continuity.
SAP Fiori equivalent mapping	Where S/4HANA introduces Fiori apps that replace specific T-codes, OpenIAM's S/4HANA connector maps SoD rules to the equivalent Fiori app permissions and authorization objects. The compliance control remains intact regardless of the user interface used to execute the transaction.
Authorization object continuity	SAP authorization objects — the underlying technical basis for SoD detection — are highly stable across ECC and S/4HANA. Core financial and logistics authorization objects (F_BKPF_BUK, M_BEST_BSA, V_VBAK_AAT, etc.) are unchanged.
Migration path	When you upgrade to S/4HANA, the rule set is updated in OpenIAM to reflect any T-code changes — this is a configuration update, not a rule rebuild. Existing violation history, remediation records, and audit evidence are preserved across the migration.

Additional SAP module coverage — available as extensions

The following SAP modules are available as rule set extensions beyond the Manufacturing Edition core library. These modules may be relevant to specific operational areas and can be added as separate named extensions based on the organization’s SAP landscape.

Module	Relevance and available rule coverage
SAP PM — Plant Maintenance	Directly relevant to manufacturing maintenance and service operations. PM rules cover work order creation and completion, maintenance plan management, and equipment master data — the technical compliance controls for workshop and field service operations.
SAP CS — Customer Service	Relevant to after-sales service and warranty management. CS rules cover service order creation and completion, warranty processing, and service contract management. Particularly important for OEM warranty compliance and service accreditation.
SAP EWM — Extended Warehouse Management	Relevant for organizations operating dedicated warehouses with SAP EWM. EWM rules extend MM procure-to-pay SoD coverage into warehouse transfer orders, stock movements, and physical inventory.
SAP TM — Transportation Management	Relevant to logistics operations for equipment delivery and spare parts distribution. TM rules cover freight order creation, carrier assignment, and transportation cost settlement.
SAP HR / HCM — Human Resources	Relevant for payroll and personnel administration governance. HR rules cover payroll posting, personnel master data management, and the access segregation between HR administration and payroll execution — an area of increasing audit focus for Indian companies.
Microsoft Active Directory / Entra ID	Where the SAP access governance program is extended to cover the full IT landscape, OpenIAM governs Microsoft Active Directory and Entra ID using the same platform, connectors, and access certification workflow. Recommended as a follow-on phase once the SAP SoD program is established.

How OpenIAM Delivers the Rule Set

The OpenIAM SoD Accelerator is not a consulting deliverable or a spreadsheet — it is a product capability that ships with the OpenIAM platform and connects directly to the customer's SAP ECC or S/4HANA environment. This section describes what the experience looks like from the moment OpenIAM is connected to SAP.

Step	What happens
1 Connect	Connect to SAP ECC — OpenIAM connects to your SAP ECC 6.0 or S/4HANA environment using the native SAP connector. The connector reads role assignments, authorization objects, and user master data — read-only, no changes to SAP during connection.
2 Load	Load the manufacturing rule set — The 45-rule manufacturing SoD rule set is loaded into OpenIAM. Each rule is pre-mapped to the relevant SAP authorization objects and T-codes. No configuration is required for the standard rule set.
3 Scan	Run the first violation scan — OpenIAM analyses the full population of SAP user assignments against all 45 rules. For a typical mid-market environment, the first scan completes within hours of connection.
4 Review	Review the violation report — The report shows every detected conflict: rule ID, rule name, the specific user accounts affected, the conflicting roles, and the risk level. The report is formatted as audit evidence — it maps directly to the IFC control objectives auditors test.
5 Prioritize	Prioritize remediation — Critical violations are highlighted first. For each violation, the report includes the recommended remediation — role split or compensating control — so the IT and compliance team can prioritize and assign remediation actions immediately.
6 Monitor	Ongoing monitoring — After initial remediation, OpenIAM continuously monitors for new SoD conflicts as role assignments change. Any new violation triggers an alert and is added to the audit evidence trail.
7 Certify	Access certification — OpenIAM's access certification module allows the organization to run regular (quarterly or annual) access reviews where business managers certify that their team members' SAP access is appropriate. The SoD rule set is applied during certification — any certifier who approves access that creates a SoD conflict is flagged.

The Active Directory / Microsoft question

For organizations where Active Directory is also part of the access governance scope, OpenIAM governs Microsoft Active Directory and Microsoft Entra ID using the same platform that governs SAP — there is no separate tool required.

The recommended approach is to establish the SAP SoD program first, validate the rule set against your SAP environment, and then extend the governance scope to Active Directory in a follow-on phase. This allows the compliance team to demonstrate measurable SAP compliance improvement quickly, and then broaden the program with a proven operational model.

Next steps

Ready to run your first violation scan?

Review the 15 Critical rules

Review the Critical rules above with your SAP team and internal audit to confirm the rule set addresses the control objectives required for your IFC program.

Confirm the SAP ECC connection

OpenIAM's technical team will provide the connector configuration guide and the read-only authorization profile required for your SAP system.

Schedule a demonstration scan

OpenIAM connects to your SAP sandbox or test system, loads the manufacturing rule set, runs the first violation scan, and presents the output in the format your auditors will see.

Questions on specific rules?

For questions on any specific rule, the S/4HANA migration path, or the Active Directory extension, contact the OpenIAM team directly.

Book a demo Back to SAP compliance overview

Common questions about SAP SoD compliance for Indian manufacturing companies

What is Segregation of Duties (SoD) in SAP, and why does it matter for Indian companies? ⌄

Why doesn't SAP's native role management prevent SoD violations? ⌄

What are the most common SoD violations in SAP manufacturing environments? ⌄

What is the OpenIAM SoD Accelerator for SAP — Manufacturing Edition? ⌄

How long does it take to run the first SoD violation scan after connecting to SAP? ⌄

How are the SoD rules aligned to Indian regulatory requirements? ⌄

Is the rule set compatible with SAP S/4HANA, or only SAP ECC 6.0? ⌄

Can we build our own SoD rule set instead of using the pre-built one? ⌄

We already have SAP GRC Access Control. Do we still need this? ⌄

Does the Manufacturing Edition cover all SAP modules, or are some excluded? ⌄

Let’s Connect

Managing identity can be complex. Let OpenIAM simplify how you manage all of your identities from a converged modern platform hosted on-premises or in the cloud.

For 15 years, OpenIAM has been helping mid to large enterprises globally improve security and end user satisfaction while lowering operational costs.

Download a Trial Contact Sales

45 pre-built SAP SoD rules for Indian manufacturing companies — ready on day one.

Built for SAP ECC 6.0 and S/4HANA. Mapped to Companies Act 2013 IFC control objectives. Covering FI, MM, SD, PP, CO, and QM — the six modules IFC auditors test. No consultant required. No rule-building phase.