Updated 31 October 2026
An SoD matrix is a grid that lists your tasks on both axes and marks which pairs one person shouldn't hold. Agree it with the business first, then check your users and roles against it.
SAP SoD matrix template
Excel file with tasks, a matrix, a conflict register and compensating controls. No email address needed.
What goes in the matrix
| Part | What it holds | Example |
|---|---|---|
| Task | A piece of work in business language | Run the payment |
| Technical link | The transactions, and the authorization objects behind them | F110 |
| Conflict | Which task pairs can't go together | Vendor bank details + payment |
| Risk | How serious it is, and why | High: money could leave the company |
| Owner | Who decides in the business | Head of Finance |
A small example
| Vendor | Invoice | Payment | |
|---|---|---|---|
| Create vendor | - | Conflict | Conflict |
| Post invoice | Conflict | - | Conflict |
| Run payment | Conflict | Conflict | - |
How to build yours
- Start with your processesPurchase-to-pay, order-to-cash, finance and user administration are the usual first four.
- Write tasks, not transactionsThe people who decide have to understand the list.
- Mark the conflicts with the businessAsk what could go wrong, not what a list says.
- Rate each conflictHigh, medium or low, with a one-line reason.
- Link tasks to SAPAdd transactions and authorization objects, including the S/4HANA and Fiori equivalents.
- Check real users and rolesStart with the high risks. Fix the roles that cause the most lines first.
- Decide per conflictRemove, split or compensate, with a named owner.
Common mistakes
- Copying a list without adjusting it to your business
- Checking transaction codes only, so people who can only view get flagged
- Forgetting that a user's roles combine, so a conflict can arise across two roles
- Fixing users one by one instead of the role behind them
The template is an illustrative starting point. Your own business and your auditor decide what counts as a conflict.
Questions about SoD matrices
Is there a standard SAP SoD matrix?
No single one fits everybody. SAP Access Control ships with a standard ruleset, and auditors and consultancies have their own lists, but every organisation has to adjust it to how it actually works.
What is the difference between an SoD matrix and a ruleset?
The matrix is the business decision: which tasks can't go together. The ruleset is the technical version: the transactions and authorization objects that SAP or a tool checks.
Do we need a tool?
Not to start with. A matrix in Excel is enough to agree the rules. Checking a large system against them by hand is slow, which is when a tool starts to pay off.
