Home > FOI 201 – SAP Products

FOI 201 – SAP Products

The OPCC is asked to provide information about SAP products.

FOI Request

Can you please confirm if you currently use or plan to use any of the following software:

  1. SAP Business Integrity Screening
  2. SAP Access Control
  3. SAP Process Control
  4. AP Audit Management
  5. Identity Access Management
  6. SAP GRC
  7. SAP Risk Management
  8. SAP Global Trade Services?

In the event that you currently use any of the aforementioned software:

  • Do you have a support contract with an external provider for SAP Support?
  • If you employ any of the aforementioned software or have a support contract what is the renewal date?
  • Where is your SAP infrastructure located and in what format?
  • When is the contract for third party support of your SAP infrastructure due for renewal?
  • Do you manage SAP Security, SAP Role Authorisations and SAP Role Designs internally or through an external provider?
  • If SAP Security, SAP Role Authorisations and SAP Role Designs is managed through an external provider, what is the renewal date?
  • Which organisational department is responsible for managing overall SAP Security, Role Authorisations and Role Design?
  • When is your next internal and external audit covering SAP roles and access?
  • Where do you advertise any SAP related procurement opportunities?

FOI Response

Under the circumstances of this current e-mail I would refuse your request for information under s8(1)(b) of the Act.

The Information Commissioner’s Office (ICO) informs that:

8.—(1) In this Act any reference to a “request for information” is a reference to such a request which—

(a) is in writing,

(b) states the name of the applicant and an address for

correspondence, and

(c) describes the information requested.

A requester can be an individual, a company or an organisation, but in each case Section 8(1)(b) requires that a request for information must include the name of the requester.

As an example a requester named Robert Jones could call themselves ‘Rob Jones’, ‘Bobby Jones’, ‘R Jones’, ‘Bob Jones’ or ‘Mr Jones’. However, they could not just use ‘Robert’, ‘Bob’, ‘Bobby’ or ‘R.J’.

Therefore by just informing us that your name is Thomas would not be acceptable.

Following this I would ask that if you would be so kind as to provide such details I would seek the information you request.

However I can tell you that for the information you seek, the Office of the Police & Crime Commissioner for Cleveland does not hold this information.

I am required under s16 of the Act that it is a duty of a public authority to provide advice and assistance to those seeking information.  To that end the information you seek may be held by Cleveland Police on their website.

Date responded: 5 September 2018