Course Outline
Session 1 (4 Hours)
Module 1 – S/4HANA Essentials for Auditors (2 Hours)
- Core architecture (ABAP, Fiori, catalogs/roles).
-
Major Distinctions from ECC:
- Business Partner model.
- Universal Journal (ACDOCA).
- Flexible Workflows.
- Current Access Identity System (AIS) status: transactions and their Fiori counterparts.
Module 2 – Access Control, Roles, and Critical SoD (2 Hours)
- Users, PFCG, SUIM, SU53, SU24 (transaction-based authorizations).
- Fiori catalogs and roles (app-id, catalog, space).
- Fundamental SoD matrices and common findings (e.g., conflicting creation and release privileges within a single role).
Session 2 (4 Hours)
Module 3 – Security Logging and Tracing (3 Hours)
- Security Audit Log (SM19/SM20): setup, filtering, and interpretation.
- STAD/ST03N: analyzing usage statistics, session patterns, and peak loads.
- Read Access Logging (RAL): conceptual overview and applicable scenarios.
- Best practices for retaining and exporting audit evidence.
Module 4 – Configuration Changes and Sensitive Data (1 Hour)
- SCU3 (change documentation) and SCC4 (change policies).
- Critical parameters (RZ10/RZ11): review methods and evidentiary standards.
Session 3 (4 Hours)
Module 5 – Process Controls (FI/MM/SD) in S/4 (4 Hours)
- FI: Tolerance limits, OB52 (period management), entry segregation, and journal approvals via workflows.
- MM: Release strategies, limit controls, single-supplier restrictions, and condition modifications.
- SD: Credit limits (FSCM Credit Management) and price/condition adjustments.
- BP: Controls on creation/modification, and sensitivity of fiscal/banking data.
- Risk-based sampling and selection methodologies.
Session 4 (4 Hours)
Module 6 – Comprehensive Practical Lab and Reporting (3 Hours)
- Escalating the roles and access rights of a high-risk user.
- Tracing operations (purchase/sale) and gathering evidence (SM20/SCU3).
- Recording findings with screenshots and data exports.
- Drafting working papers and ensuring full traceability.
Module 7 – Conclusion and Action Planning (1 Hour)
- Internal control checklists specific to S/4.
- Prioritizing findings and formulating actionable recommendations.
Deliverables:
- A comprehensive checklist covering 20+ controls (FI/MM/SD/BP).
- A concise reference guide for SM19/SM20, SUIM, SCU3, and STAD/ST03N.
Requirements
- Solid grasp of fundamental auditing principles
- Prior experience with SAP systems
- Working knowledge of compliance and control frameworks
Target Audience
- Auditors
- Internal control specialists
- SAP security consultants
- Compliance officers
Testimonials (2)
It was straight to the point and more practical
Lungelo Ndlela - SNG Grant Thornton
Course - SAP S/4 Hana (S/4Hana)
His calm and collected voice even though at points he was frustrated with the system, but kept his cool…
