Course Outline
Session 1 (4h)
Module 1 – S/4HANA Essentials for Auditors (2h)
- Core architecture components (ABAP, Fiori, catalogs, and roles).
-
Significant differences from ECC:
- Implementation of the Business Partner concept.
- Integration of the Universal Journal (ACDOCA).
- Enhanced flexibility in workflows.
- Current location of Audit Information System (AIS) data, including transaction equivalents in Fiori.
Module 2 – Access Control, Roles, and Critical SoD (2h)
- Management of users, PFCG, SUIM, SU53, and SU24, focusing on authorizations by transaction code.
- Structure of Fiori catalogs and roles (app-id, catalog, space).
- Analysis of the basic SoD matrix and common audit findings (e.g., conflicting permissions for creation and release within the same role).
Session 2 (4h)
Module 3 – Security Logs and Tracing (3h)
- Utilizing the Security Audit Log (SM19/SM20): activation, filtering, and interpretation.
- Leveraging STAD/ST03N for usage statistics, session analysis, and peak identification.
- Concept of Read Access Logging (RAL) and appropriate use cases.
- Best practices for retaining and exporting audit evidence.
Module 4 – Configuration Monitoring and Sensitive Data (1h)
- Tracking changes via SCU3 (change documents) and managing change policies with SCC4.
- Reviewing critical parameters (RZ10/RZ11) and capturing relevant evidence.
Session 3 (4h)
Module 5 – Process Controls in S/4 (FI/MM/SD) (4h)
- FI: Tolerance limits, open periods (OB52), entry segregation, and journal approval workflows.
- MM: Purchase order release strategies, spending limits, single supplier risks, and condition changes.
- SD: Credit limit enforcement (FSCM Credit Management) and price/condition adjustments.
- BP: Controls on creation and modification, particularly regarding fiscal and banking data sensitivity.
- Applying risk-based sampling and selection techniques.
Session 4 (4h)
Module 6 – Comprehensive Workshop and Reporting (3h)
- Simulating the elevation of roles and access for a high-risk user.
- Tracing transactions (purchasing/sales) and gathering evidence via SM20/SCU3.
- Documenting findings using screenshots and data exports.
- Preparing comprehensive working papers with full traceability.
Module 7 – Conclusion and Action Planning (1h)
- Reviewing an internal control checklist specific to S/4.
- Prioritizing audit findings and developing actionable recommendations.
Course Deliverables:
- A comprehensive checklist containing over 20 controls (FI/MM/SD/BP).
- A quick reference guide for SM19/SM20, SUIM, SCU3, and STAD/ST03N.
Requirements
- A solid grasp of fundamental auditing principles
- Prior experience working with SAP systems
- Knowledge of established compliance and internal control frameworks
Target Audience
- Auditors
- Internal control specialists
- SAP security consultants
- Compliance officers
Testimonials (2)
It was straight to the point and more practical
Lungelo Ndlela - SNG Grant Thornton
Course - SAP S/4 Hana (S/4Hana)
His calm and collected voice even though at points he was frustrated with the system, but kept his cool…
