Bolting on GRC derails SAP programmes

Every SoD review I've seen checks the standard transactions carefully — and skips the custom ones almost by default. That's backwards. Custom Z-transactions and custom authorization objects are exactly where segregation-of-duties conflicts hide longest, because nobody built a standard ruleset for them. The GRC tool flags what it knows. A transaction built in-house eighteen months ago, never mapped to an authorization object, doesn't show up in any conflict matrix — until an auditor asks who can execute it, and the answer is "more people than anyone realized." I've walked into more than one review where the custom transaction layer hadn't been touched since go-live, while the standard SAP roles were reviewed every year without fail. A SoD ruleset built once and never extended to custom developments doesn't stay static — the gap just waits for the audit that finally asks the right question. Does your review process cover custom transactions the same way it covers standard ones? #SAPSecurity #GRC #SoD #InternalAudit #RiskManagement #SAP

Most SAP auditors are still flagging SoD conflicts at the transaction level and calling it done. That's not enough. Here's what I've seen get missed repeatedly during ITGC reviews on SAP environments: Transaction-level analysis tells you a user can launch a t-code. It doesn't tell you whether they can actually execute it for the company codes, plants, or purchasing orgs that matter. A conflict at the transaction level with no access at the authorization object level is a false positive — and chasing false positives wastes everyone's audit cycle. The sharper test: go one layer deeper. Run authorization-object-level analysis to surface conflicts that are exploitable, not just technically flagged. This also matters for PII risk. A financial analyst with access to PA30 (HR master data t-codes) may clear a transaction-level SoD check but still be pulling employee records they have no business viewing. In SAP engagements at Deloitte and across my ITGC work, this distinction — transaction vs. authorization object — is one of the first things I validated before marking any SoD finding as a real risk. PCAOB inspection findings keep citing access management as a top ITGC deficiency. The gap isn't always controls — sometimes it's the depth of the analysis. What layer does your team typically go to when validating SoD conflicts in SAP — t-code, auth object, or both? #ITGC #SAP #SOXCompliance #AccessRisk #InternalAudit

An SoD check can come back clean and still miss the real conflict. Why? Because the risk may not sit inside one system. Someone could have: → supplier creation in SAP → supplier approval in a SaaS workflow → payment release somewhere else Each permission can look reasonable when reviewed on its own. Together, they can create a business-process conflict. This is where access governance gets harder in hybrid environments. The question is no longer only: “Does this SAP role conflict with another SAP role?” It also becomes: “What can this identity do across the whole process?” SAP Access Control supports cross-system risk analysis, which is a useful reminder that SoD is really a business-process problem, not just a role-design problem. In my opinion, access reviews need to follow the process end to end. Otherwise, individual systems can look clean while the combined access still creates risk. Where do you see the bigger challenge today: visibility across systems, ruleset design, or ownership of the end-to-end process? #SAPSecurity #SAPGRC #AccessGovernance #S4HANA

76% of SAP security professionals point to poor role design as the primary driver of Segregation of Duties conflicts. The principle behind SoD is straightforward: no single person should control an entire critical process end to end. High-risk combinations are well documented and none of these should sit in one user's profile. In practice, they do. Roles accumulate as people change positions. Composite roles get cloned, temporary access granted for an upgrade granted is never revoked. None of these conflicts should be there, but they exist in SAP, and your auditor will find them before you do. The common response is a periodic review: pull the data, compare against a ruleset, remediate what surfaces, and repeat at the next audit cycle. The problem is that role changes do not wait for your review schedule. Effective SoD management requires three things working together: 1) a maintained ruleset that reflects your actual transactions (including custom T-codes and Fiori apps deployed post-go-live) 2) continuous analysis that flags conflicts as they form 3) risk simulation that shows the impact of a proposed change before it reaches production. Read our full blog: What is SoD — How to Manage it in SAP? https://bit.ly/4xaLSGL #SAPSecurity #AccessControl #SegregationOfDuties #SoD #Compliance #GRC #SAP #CERPASS

SAP GRC Process Control (GRC PC): From Risk Detection to Real-Time Control! Discover how SAP GRC PC helps organizations: 🔹 Spot control gaps and risks 🔹 Automate control monitoring & testing 🔹 Gain real-time insights 🔹 Strengthen SOX & regulatory compliance 🔹 Turn control data into smarter decisions 🔹 Build stronger governance Less risk. More control. Stronger business. Visit Us : https://lnkd.in/gyQKM4fw #SAP #SAPGRC #GRCPC #SAPGRCPC #Compliance #RiskManagement #InternalControls #SOX #SAPSecurity #DigitalTransformation TechBrainz Consulting Suresh Nalluru SAP SAP GRC JOBS SAP GRC Access Controls

Preparing for ITGC and ISO audits should not require a manual scramble every six months. When audit readiness relies on a rush of manual evidence gathering, the underlying security architecture is already failing. The result is high operational overhead, disrupted development teams, and elevated compliance risk. In complex multi-system landscapes, manual verification cannot keep pace with constant user and role changes. Based on delivering five consecutive years of zero-deviation audits for over 50,000 users, true compliance requires moving from reactive cleanup to continuous system-driven verification. Achieving role-level governance at scale relies on three technical shifts: 1. Automated control enforcement: Replace periodic manual spot-checks with systematic daily monitoring of SAP GRC and Firefighter logs. 2. Continuous SoD validation: Run real-time Segregation of Duties checks during provisioning to prevent role drift before the audit cycle starts. 3. Platform synchronization: Align identity and authorization layers across S/4HANA, BTP, and cloud IAS/IPS to maintain a unified audit trail. The accompanying infographic outlines the validation framework and critical control points needed to establish a continuous audit-ready state. How does your team currently validate critical action and firefighter logs across hybrid landscapes?

SoD Violations — The Go-Live Problem Every ERP go-live creates SoD violations. Not because the implementation team is careless. Because go-live is chaos. Users need access to get their job done on Day 1. Security reviews take time nobody has. Temporary access gets granted. Temporary access never gets removed. Three years later: One person has AP access AND vendor master access. Another can create a PO AND approve the invoice. A third can post a journal AND approve the batch. These are not hypotheticals. They are the three most common SoD conflicts we find in Oracle and SAP environments. The go-live was years ago. The access was never cleaned up. The auditors will find it. Riscova finds it first. #ERP #SAP #Oracle #Compliance #riscova

Compliance at the Speed of Operations. https://hubs.li/Q04wX6-y0 GRC isn't a tech problem. It's a content problem. Most companies have strong tools and risk platforms. But the evidence that actually proves compliance? Scattered across inboxes, file shares, and spreadsheets. That disconnect is the real risk. Audits take too long. Controls lack traceability. And executive confidence suffers. Qellus fixes this by embedding GRC content directly into SAP. So every policy, control, and audit trail is tied to business processes — not floating in a silo. → Evidence is always available → Workflows are automated → Governance scales with operations If your GRC still runs on emails and manual checklists, it's time to modernize. Start with one initiative. Make governance move at the speed of operations.   #GRC #SAP #Compliance #EnterpriseContentManagement #AuditReady

Every Segregation of Duties (SoD) rule starts as a simple sentence spoken out loud: "The person who creates a vendor should not be able to pay them." Sounds easy, right? But translating that sentence into a functioning, auditable SAP GRC rule requires three distinct moves. And the hard truth? The standard, out-of-the-box SAP ruleset only helps you with one of them. Here is exactly how a sentence becomes a rule: 1️⃣ Name the Activities First, you have to define what "creating a vendor" and "paying them" actually mean in your specific organisation. Are there custom processes involved? SAP cannot tell you this—your business process owners must dictate it. 2️⃣ Find Every Door Once the activities are named, you have to map every technical entry point. Is it a traditional GUI transaction? A Fiori app? An API endpoint? A background job? Table maintenance? This is the ONLY step where the shipped SAP ruleset actually helps. It provides the technical mapping to catch the activity. 3️⃣ Define the Conflict Now, the nuance. What actually constitutes a violation? Is it only a risk if it happens within the same Company Code? Does "display-only" access count? Again, SAP cannot ship your organisation's risk appetite. Your business must decide this. The reality is that only the middle step is something SAP can put in a box. Steps 1 and 3 are fundamental questions about how your business operates. This is exactly why simply implementing the standard ruleset is not the same thing as having true Segregation of Duties. If your rules are too broad, every conflict just gets automatically mitigated until your SoD report becomes meaningless wallpaper. If they are too narrow, you will pass every audit right up until the one where you fail spectacularly. The Litmus Test: Can you explain one of your SoD rules to a business process owner without ever using the word "transaction"? I'd love to hear from others in the space: how much of your current ruleset relies on the standard shipment vs. custom tailoring? Let me know in the comments! #SAPSecurity #SAPGRC #SegregationOfDuties #RiskManagement #SAP #Compliance #S4HANA

GRC Excel Dashboard Suite: https://lnkd.in/dMR6hz7K SAP transformation needs governance that moves with the business. As organizations modernize core platforms, governance cannot remain a separate compliance activity. It needs to support access decisions, control effectiveness, risk ownership, audit readiness, and operational accountability throughout the transformation. • Build governance into business processes from the beginning. • Connect access, controls, risk, and assurance activities. • Reduce manual evidence gaps through stronger workflow discipline. • Give control owners clear accountability and timely visibility. • Use monitoring to identify exceptions before they become audit issues. • Keep governance aligned as systems, roles, and risks evolve. Strong SAP governance is not about adding more controls. It is about creating greater confidence that access, risk, and compliance decisions are working as intended. What is the biggest SAP GRC challenge in your organization? #SAP #SAPGRC #GRC #RiskManagement #Compliance #ITGovernance #InternalControls