Course Outline
Session 1 (4 hours)
Module 1 – S/4HANA Fundamentals for Auditors (2 hours)
- Overview of core architecture (ABAP, Fiori, catalogs, and roles).
-
Key Differences from ECC:
- Business Partner concept.
- Universal Journal (ACDOCA).
- Flexible workflows.
- Understanding the location of Accounting Information Systems (AIS) within current transactions and their Fiori equivalents.
Module 2 – Access, Roles, and Essential Segregation of Duties (2 hours)
- Managing users and authorizations via PFCG, SUIM, SU53, and SU24 (authorization by transaction code).
- Navigating Fiori catalogs and roles (app-id, catalog, and space).
- Understanding the basic Segregation of Duties (SoD) matrix and common findings (e.g., creation and approval within the same role).
Session 2 (4 hours)
Module 3 – Security Logs and Traces (3 hours)
- Utilizing the Security Audit Log (SM19/SM20): activation, setting filters, and reading logs.
- Analyzing STAD/ST03N for usage statistics, session data, and peak loads.
- Understanding Read Access Logging (RAL): concepts and applicable scenarios.
- Best practices for retaining and exporting evidence.
Module 4 – Configuration Changes and Sensitive Data (1 hour)
- Monitoring change documents (SCU3) and change policies (SCC4).
- Identifying and documenting critical parameters (RZ10/RZ11).
Session 3 (4 hours)
Module 5 – Process Controls in S/4 (FI/MM/SD) (4 hours)
- FI (Financials): Tolerances, OB52 (period management), entry segregation, and journal approval workflows.
- MM (Materials Management): Release strategies, value limits, single-supplier controls, and condition changes.
- SD (Sales and Distribution): Credit limits via FSCM Credit Management, and price/condition changes.
- BP (Business Partner): Controls on creation and exchange, focusing on fiscal and banking sensitivity.
- Implementing risk-driven sampling and selection techniques.
Session 4 (4 hours)
Module 6 – Comprehensive Laboratory and Reporting (3 hours)
- Creating roles and assigning access to a critical user.
- Tracing operations (such as buying and selling) and obtaining evidence via SM20/SCU3.
- Documenting findings with screenshots and data exports.
- Preparing working papers and ensuring traceability.
Module 7 – Closure and Action Plan (1 hour)
- Utilizing an internal control checklist for S/4.
- Prioritizing findings and formulating recommendations.
Deliverables:
- A checklist containing 20+ controls for FI/MM/SD/BP.
- A quick reference guide for SM19/SM20, SUIM, SCU3, and STAD/ST03N.
Requirements
- A foundational understanding of auditing principles
- Practical experience with SAP systems
- Familiarity with compliance and control frameworks
Target Audience
- Auditors
- Internal control specialists
- SAP security consultants
- Compliance officers
Testimonials (2)
It was straight to the point and more practical
Lungelo Ndlela - SNG Grant Thornton
Course - SAP S/4 Hana (S/4Hana)
His calm and collected voice even though at points he was frustrated with the system, but kept his cool…
