HBCG performed a comprehensive review of the current design and found that the issues being encountered were primarily the result of miscommunication and incomplete understanding between the business process teams and the technical security team. The security team understood the technical aspects of building and managing security and the limitations of SAP security, while the process teams understood the business requirements; the teams were not able to communicate or fully understand each other’s requirements or limitations. Furthermore, there was a lack of security involvement to-date in integration testing which meant the issues caused by this were not being detected. HBCG assisted the client to formulate a detailed action plan, which included integrated Business Requirements Workshops between the business process and Security teams. The rounds of workshops were designed to educate business process owners on SAP security, gather business requirements from the business process owners, and review the role design to ensure security met the business’ needs. Once the roles were signed off and accepted by the business, security was integration tested by utilizing existing test scripts to be executed using security roles. HBCG ensured that security became involved with the integration test process and was represented on the testing team. Scripts were reviewed to ensure business critical processes and business process controls were included within the scripts, and that both positive and negative security testing was performed.