Dual control on GL postings

On this post I would like to share a simple solution that would enable the companies to implement dual control on journal postings. In other words this solution would make sure that two users are involved on each journal posting where one person parks the document and another one posts it. Unlike the traditional authorization based solutions, none of the users are restricted at the transaction code level. This is how the solution works.

1. First user parks the document using FB50. If the user attempts to post, system throws an error message.
2. Second user posts the document using FBV0. If the second user attempts to post his own-parked document, system throws an error message.

Now lets see how this solution is implemented.

Step 1

Create a validation rule at complete document level with userexit.

Step 2

Implement the following logic in the validation userexit.

FORM us007 USING b_result.

* Enhancement by Shathees Loganathan.

select single * from VBKPF where BELNR = BKPF-BELNR and BUKRS= BKPF-BUKRS and BSTAT = 'V'.

if sy-subrc = 0.

if VBKPF-USNAM = SYST-UNAME.

Message e019(ZLF01).

b_result = B_FALSE.

endif.

else.

Message e018(ZLF01).

b_result = B_FALSE.

endif.

ENDFORM.

Now lets see how would this affect the journal entries.

Step 1

First user parks the document using FB50. If the user tries to post the document, the following error message is shown.

First user parks the document.

Second user posts the document using FBV0. If the second user tries to post a document parked by him, the following message is shown.

If the second user posts a document parked by another user, system allows the document to be posted.

This solution could be further enhanced. For example we could allow certain managers to post the document directly through an exception process or we can implement this dual control to certain GL accounts or document types.

Hope this is useful. See you all next time.