... are called up from other systems via remote function call (RFC) or application link enabling (ALE). When the proportion of externally accessed transactions is high, this indicates that the degree of openness to external systems is too great and the landscape comparatively complex. In this case, bear in mind that RFC-compatible function modules called up from an unprotected SAP system or from external programs can circumvent authorization structures. To ensure proper security it’s imperative to check authorization in ERP and satellite systems regularly.
Think its time you took a closer look at your system?