Findings we often see discussed
| The finding | The question behind it |
|---|---|
| SAP_ALL or SAP_NEW in production | Who holds it, why, and what replaces it? |
| Open SoD conflicts | Which ones matter, and who owns each one? |
| No periodic access review | What is reviewed, by whom, and how often? |
| Firefighter logs not reviewed | Who reviews them, and are they independent? |
| Leavers with active accounts | How does HR tell IT, and how quickly? |
| Generic or shared accounts | Who is behind each account? |
| Direct changes in production | Who can change data or debug, and is it logged? |
From finding to plan
Read it properly
What did the auditor test, on which system, and over which period?
Check the evidence
Look at the real users, roles and logs behind the finding.
Decide per item
Fix it, compensate for it, or accept the risk and document why.
Make it stick
Assign owners and dates, and keep the evidence that shows it's done.
The root cause matters more than the list
Fixing 200 users by hand closes a line in the report. Next year it's back, because the role that caused it is still there. That's why we look for what produces the finding: a role, a process, or a missing owner.
We help you understand and plan. We don't give an audit opinion, and your auditor decides whether a finding is closed.
Questions about SAP audit findings
Can you fix an audit finding for us?
We can work with you on what the finding means, what to change and how to show it. Your auditor decides whether a finding is closed, so nobody can promise that outcome.
What are common SAP audit findings?
Common ones are SAP_ALL in production, unresolved segregation of duties conflicts, no periodic access review, firefighter logs that nobody reviews, leavers with active accounts, and direct changes in production.
Do we have to fix every finding?
Not always in the same way. Some can be fixed, some need a compensating control, and sometimes management accepts a risk and documents why. That decision belongs to the business, not to IT alone.
