Security Governance & Internal Audit Controls

1. Overview & Business Value#

This comprehensive operational guide details the architecture, business workflows, configuration parameters, and execution steps for Security Governance & Internal Audit Controls within SmartERP.

Core banking security policies, maker-checker authorization gates, four-eyes principles, and tamper-evident audit trails.

{screenshot:security-and-internal-audit-controls-overview-dashboard}

2. Prerequisites & Security Access Groups#

• Required Modules: smarterp_sacco_core, smarterp_equb, smarterp_loan_management
• Security Groups:
  • SACCO Loan Officer (Technical ID: smarterp_sacco.group_sacco_officer)
  • SACCO Credit Committee Member (Technical ID: smarterp_sacco.group_sacco_committee)
  • SACCO General Manager (Technical ID: smarterp_sacco.group_sacco_manager)
• Master Data Dependencies: Member KYC profiles, share capital registers, savings product tiers, loan products with reducing-balance schedules, and Equb rotational pool configurations.

3. Step-by-Step Configuration & Execution#

Step 1: Navigating to the Module Interface#

1. Log into your SmartERP instance at https://smarterp.et/odoo.
2. Open the main App Switcher (grid icon in the top-left corner).
3. Select the SACCO & Equb app icon.
4. From the top navigation bar, open SACCO & Equb → Members → KYC Registry / Savings Accounts / Loan Applications / Equb Pools.

{screenshot:security-and-internal-audit-controls-app-switcher-navigation}

Step 2: Creating and Parameterizing Records#

1. Click the New button in the top-left control panel.
2. Complete the mandatory fields in the record form:
   • Member Identification Number (Mandatory): Unique membership number complying with Ethiopian Cooperative Commission rules
   • Full Name & Kebele ID (Mandatory): Verified member identity with physical residence verification
   • Share Capital Subscriptions (Mandatory): Subscribed shares not exceeding statutory 10% member ceiling (Proclamation 985/2016)
   • Primary Savings Product (Mandatory): Compulsory regular monthly savings account configuration
3. Configure optional operational parameters and localized tags as required:
   • Guarantor & Collateral (Optional): Approved co-signers with locked savings accounts or registered vehicle/property lien
   • Equb Rotational Group (Optional): Linked digital Equb pool with lottery draw eligibility
   • Beneficiary Nominee (Optional): Designated next of kin for death or disability benefit transfer
4. Click the Save icon in the control bar to commit the record.

{screenshot:security-and-internal-audit-controls-record-creation-form}

Step 3: Validating and Processing Transactions#

• State Transitions: Execute operational state progression (Application → KYC Verified → Approved → Active / Disbursed → Delinquency Monitored → Settled).
• Ledger & System Impact: Loan disbursement debits loans receivable and credits cash/bank; loan repayments credit interest income and loan principal, updating 5-tier NBE provisioning registers.
• Audit Verification: Automated recording of author ID, timestamp, and immutable revision history.

{screenshot:security-and-internal-audit-controls-transaction-processing-state}

Four-Eyes Principle & Maker-Checker Governance#

To safeguard member funds and prevent internal embezzlement, SmartERP enforces the Four-Eyes Principle (Maker-Checker) across all high-risk transactions:

• Loan Approvals: The loan appraisal officer (Maker) cannot approve the loan; approval requires independent review by the Branch Manager or Committee (Checker).
• Vault Cash Transfers: The teller initiating a cash transfer cannot confirm receipt; the Chief Cashier must authenticate via separate credentials.
• Journal Entries & Write-Offs: Loan write-offs or manual general ledger adjustments mandate dual sign-offs from the Chief Accountant and General Manager.

Role-Based Access Control Matrix#

Tamper-Evident Transaction Logging#

All balance-affecting transactions write to an immutable append-only ledger (sacco.transaction.audit):

• Every record captures SHA-256 hash chaining connecting back to the genesis transaction.
• Direct database UPDATE or DELETE SQL queries against balance tables are programmatically blocked by PostgreSQL triggers.

4. Advanced Configuration Points#

• Automated Actions & Scheduled Tasks (Crons):
  • SACCO: Accrue monthly member savings interest (smarterp_sacco.ir_cron_savings_interest): Runs on the final day of each calendar month to credit interest
  • Loan: Evaluate 5-tier NBE delinquency classification (smarterp_sacco.ir_cron_loan_delinquency): Runs nightly to compute loan loss provisions per NBE directives
  • Equb: Execute scheduled lottery draw (smarterp_sacco.ir_cron_equb_draw): Runs on defined pool cycle dates using provably fair random selection
• Custom Print Templates & Reports:
  • Member Savings Passbook & Transaction Ledger
  • Loan Amortization Schedule (Reducing Balance)
  • NBE 5-Tier Delinquency & Loan Loss Provisioning Statement
  • Annual Patronage Dividend Distribution Schedule
• Multi-Company Rules: Record-level security isolation under Company 1 (Ashewa Technology Solutions S.C.), preventing cross-company ledger leakage across parent and subsidiary legal entities.

5. Comprehensive Troubleshooting Matrix#