Course Outline
Session 1 (4h)
Module 1 – S/4HANA Essentials for Auditors (2h)
- Core architecture components (ABAP, Fiori, catalogs, and roles).
-
Key distinctions from ECC:
- Business Partner model.
- Universal Journal (ACDOCA).
- Flexible workflow capabilities.
- Current AIS locations: mapping transactions to Fiori equivalents.
Module 2 – Access Management, Roles, and Core SoD (2h)
- Managing users via PFCG, SUIM, SU53, and SU24 (authorization checks by T-Code).
- Navigating Fiori catalogs and roles (app-ID, catalog, and space).
- Building a basic SoD matrix and identifying common issues (e.g., conflicting creation and release rights).
Session 2 (4h)
Module 3 – Security Logging and Tracing (3h)
- Security Audit Log (SM19/SM20): enabling, filtering, and analysis.
- STAD/ST03N: Analyzing usage statistics, session data, and peak loads.
- Read Access Logging (RAL): Understanding concepts and application scenarios.
- Best practices for retaining and exporting audit evidence.
Module 4 – Configuration Modifications and Sensitive Data (1h)
- Tracking changes using SCU3 (change documents) and defining policies via SCC4.
- Reviewing critical parameters (RZ10/RZ11) and gathering related evidence.
Session 3 (4h)
Module 5 – Process Controls (FI/MM/SD) in S/4 (4h)
- FI: Managing tolerances, open periods (OB52), entry segregation, and journal approvals via workflows.
- MM: Release strategies, limit enforcement, single supplier rules, and condition changes.
- SD: Credit limit management (FSCM Credit Management) and pricing condition adjustments.
- BP: Controlling creation/exchange processes and addressing fiscal/banking data sensitivity.
- Applying risk-based sampling and selection methodologies.
Session 4 (4h)
Module 6 – Comprehensive Workshop + Reporting (3h)
- Simulating elevated roles and access for high-risk user profiles.
- Tracing operational activities (buy/sell) and securing evidence via SM20/SCU3.
- Recording findings with supporting screenshots and exports.
- Drafting working papers and ensuring full traceability.
Module 7 – Conclusion and Action Planning (1h)
- Utilizing the internal control checklist for S/4HANA.
- Prioritizing identified findings and formulating recommendations.
Course Deliverables:
- A checklist covering 20+ controls across FI, MM, SD, and BP.
- A quick reference guide for SM19/SM20, SUIM, SCU3, and STAD/ST03N.
Requirements
- Foundational knowledge of auditing principles
- Prior experience with SAP environments
- Familiarity with regulatory compliance and control frameworks
Target Audience
- Internal and external auditors
- Internal control specialists
- SAP security consultants
- Compliance officers
Testimonials (2)
It was straight to the point and more practical
Lungelo Ndlela - SNG Grant Thornton
Course - SAP S/4 Hana (S/4Hana)
His calm and collected voice even though at points he was frustrated with the system, but kept his cool…
