Course Outline
Session 1 (4h)
Module 1 – S/4HANA Essentials for Auditors (2h)
- Core architecture components (ABAP, Fiori, catalogs/roles).
-
Distinct changes compared to ECC:
- Integration of Business Partners.
- Adoption of Universal Journal (ACDOCA).
- Flexible workflow management.
- Mapping of current audit information sources: transaction codes and their Fiori equivalents.
Module 2 – Access Management, Roles, and SoD Fundamentals (2h)
- User management via PFCG, SUIM, SU53, and SU24 (transaction-based authorizations).
- Fiori catalogs and role assignments (app-id, catalog, space).
- Constructing basic SoD matrices and identifying common conflicts (e.g., simultaneous creation and release privileges).
Session 2 (4h)
Module 3 – Security Logging and Trace Analysis (3h)
- Utilizing Security Audit Logs (SM19/SM20): activation, filtering, and interpretation.
- Analyzing usage statistics, sessions, and peak loads using STAD/ST03N.
- Understanding Read Access Logging (RAL): concepts and application scenarios.
- Best practices for retaining and exporting audit evidence.
Module 4 – Configuration Changes and Sensitive Data Handling (1h)
- Tracking changes via SCU3 (change documents) and managing policies in SCC4.
- Reviewing critical parameters (RZ10/RZ11): interpretation and evidence collection.
Session 3 (4h)
Module 5 – Process Controls (FI/MM/SD) in S/4 (4h)
- FI: Tolerance definitions, OB52 (posting periods), entry segregation, and journal approval workflows.
- MM: Purchase order release strategies, limit settings, single-supplier risks, and condition changes.
- SD: Credit limit management (FSCM) and oversight of price/condition modifications.
- BP: Controls on creation/modification, and sensitivity checks for fiscal/banking data.
- Applying risk-based sampling and selection methodologies.
Session 4 (4h)
Module 6 – Comprehensive Lab Simulation and Reporting (3h)
- Simulating privilege escalation for a critical user profile.
- Tracing business operations (buy/sell) and gathering evidence (SM20/SCU3).
- Documenting findings using screen captures and data exports.
- Preparing working papers and ensuring audit trail traceability.
Module 7 – Closing and Remediation Planning (1h)
- Developing an internal control checklist specific to S/4.
- Prioritizing audit findings and formulating actionable recommendations.
Key Deliverables:
- A comprehensive checklist containing 20+ controls for FI/MM/SD/BP.
- A quick reference guide for SM19/SM20, SUIM, SCU3, and STAD/ST03N.
Requirements
- A solid grasp of fundamental auditing principles
- Prior experience interacting with SAP systems
- Familiarity with standard compliance and control frameworks
Target Audience
- Internal and external auditors
- Specialists in internal controls
- SAP security consultants
- Compliance officers
Testimonials (2)
It was straight to the point and more practical
Lungelo Ndlela - SNG Grant Thornton
Course - SAP S/4 Hana (S/4Hana)
His calm and collected voice even though at points he was frustrated with the system, but kept his cool…
