Course Outline
Session 1 (4h)
Module 1 – S/4HANA Essentials for Auditors (2h)
- Core architecture components (ABAP, Fiori, catalogs/roles).
-
Primary differences from ECC:
- Business Partner integration.
- Universal Journal (ACDOCA) structure.
- Flexible workflows.
- Current Audit Information System (AIS) locations: corresponding transactions and Fiori equivalents.
Module 2 – Access Control, Roles, and Core SoD (2h)
- Management of users, PFCG, SUIM, SU53, and SU24 (authorization via tcode).
- Fiori catalog and role management (app-id, catalog, space).
- Fundamental SoD matrices and common audit findings (e.g., combined creation and release authorities).
Session 2 (4h)
Module 3 – Security Logs and System Traces (3h)
- Security Audit Log (SM19/SM20): setup, filtering, and interpretation.
- STAD/ST03N: analyzing usage statistics, sessions, and peak loads.
- Read Access Logging (RAL): core concepts and appropriate application scenarios.
- Best practices for retaining and exporting audit evidence.
Module 4 – Configuration Updates and Sensitive Data (1h)
- Tracking changes via SCU3 (change documents) and SCC4 (change policies).
- Reviewing critical parameters (RZ10/RZ11) and gathering supporting evidence.
Session 3 (4h)
Module 5 – Process Controls in S/4 (FI/MM/SD) (4h)
- FI: Tolerance settings, OB52 (posting periods), entry segregation, and journal approvals via workflows.
- MM: Release strategies, purchase limits, single-supplier policies, and condition changes.
- SD: Credit limits (FSCM Credit Management) and price/condition modifications.
- BP: Controls on creation/exchange and sensitivity regarding fiscal/banking data.
- Risk-based sampling and selection methodologies.
Session 4 (4h)
Module 6 – Comprehensive Laboratory and Reporting (3h)
- Simulating the elevation of roles and access for a critical user.
- Tracing operations (buy/sell) and collecting evidence using SM20/SCU3.
- Documenting findings through screenshots and data exports.
- Drafting working papers and ensuring traceability.
Module 7 – Conclusion and Action Planning (1h)
- Internal control checklists specific to S/4.
- Prioritizing identified issues and formulating recommendations.
Deliverables:
- A comprehensive checklist covering over 20 controls across FI/MM/SD/BP.
- A quick reference guide for SM19/SM20, SUIM, SCU3, and STAD/ST03N.
Requirements
- A solid grasp of fundamental auditing concepts
- Prior exposure to SAP platforms
- Knowledge of established compliance and control frameworks
Target Audience
- Audit professionals
- Internal control experts
- SAP security advisors
- Compliance specialists
Testimonials (2)
It was straight to the point and more practical
Lungelo Ndlela - SNG Grant Thornton
Course - SAP S/4 Hana (S/4Hana)
His calm and collected voice even though at points he was frustrated with the system, but kept his cool…
