Why reviews turn into rubber-stamping
The review form is usually the problem, not the manager. If someone can't see what a role does, the only safe answer seems to be "keep it". So the review happens, the signature is there, and nothing changes.
What makes a review work
Readable roles
A description in business language, not a technical name.
Risk first
Sensitive access and SoD conflicts at the top of the list.
Usage in view
Show what hasn't been used, so "remove" becomes the easy choice.
An evidence trail
Who reviewed what, what changed, and proof that it really was removed.
Don't forget these accounts
- People who changed jobs and kept their old roles
- Leavers whose account is still active
- External consultants, long after the project ended
- Service and generic accounts that nobody owns
- Standard users such as SAP*, DDIC and EARLYWATCH
Firefighter access
Emergency access has a place. Production stops, someone needs broad rights for an hour, and that is fine as long as you can show what happened. Auditors tend to ask four things:
- Who used it, and who approved that?
- Why was it used, with a reason that makes sense?
- What was done, according to the log?
- Who checked the log, and were they independent?
Read the full SAP firefighter access guide.
Questions about access reviews
What is an SAP user access review?
An SAP user access review is a periodic check in which business owners confirm that each person still needs the access they hold. The result, including what was removed, is kept as evidence.
How often should SAP access be reviewed?
That depends on your risk and your audit requirements. A common pattern is sensitive access every quarter and all other access once a year. Agree the frequency with your auditor and stick to it.
What is a firefighter ID?
A firefighter ID is a temporary account with elevated access for emergencies. Each use should have a reason, an owner and a log that someone independent reviews.
