Course Outline
Session 1 (4 hours)
Module 1 – S/4HANA Fundamentals for Auditors (2 hours)
- Overview of the basic architecture, including ABAP, Fiori, and the role of catalogs.
-
Key distinctions from ECC:
- The Business Partner concept.
- The Universal Journal table (ACDOCA).
- Flexible workflow capabilities.
- Mapping traditional transactions to their Fiori equivalents.
Module 2 – Access Control, Roles, and Essential SoD (2 hours)
- Exploration of user management, PFCG, SUIM, SU53, and SU24 for transaction-based authorizations.
- Understanding Fiori catalogs and roles, including app-IDs, spaces, and page definitions.
- Review of the basic SoD matrix and common findings, such as conflicting create and release permissions in a single role.
Session 2 (4 hours)
Module 3 – Security Logs and System Traces (3 hours)
- Managing the Security Audit Log (SM19/SM20): activation, filtering, and analysis.
- Analyzing usage statistics, session durations, and peak times via STAD/ST03N.
- Understanding Read Access Logging (RAL): its purpose and appropriate application scenarios.
- Best practices for retaining and exporting evidence.
Module 4 – Configuration Changes and Sensitive Data (1 hour)
- Utilizing SCU3 for change documents and SCC4 for change policy verification.
- Reviewing critical parameters in RZ10/RZ11 and documenting evidence.
Session 3 (4 hours)
Module 5 – Process Controls in S/4 (FI/MM/SD) (4 hours)
- FI: Reviewing tolerances, open periods (OB52), entry segregation, and journal approval workflows.
- MM: Examining release strategies, spending limits, single-source supplier rules, and condition changes.
- SD: Assessing credit limits (FSCM Credit Management) and pricing condition adjustments.
- BP: Controlling creation and modification processes, with a focus on fiscal and banking data sensitivity.
- Techniques for risk-driven sampling and selection.
Session 4 (4 hours)
Module 6 – Comprehensive Laboratory and Reporting (3 hours)
- Scenario-based exercise: escalating roles and access for a critical user.
- Tracing end-to-end operations (purchase/sales cycles) and gathering evidence using SM20/SCU3.
- Documenting findings with precise screenshots and data exports.
- Preparing detailed working papers and ensuring full traceability.
Module 7 – Conclusion and Action Planning (1 hour)
- Applying the internal control checklist specific to S/4HANA.
- Prioritizing audit findings and formulating actionable recommendations.
Key Deliverables:
- A comprehensive checklist covering over 20 controls across FI, MM, SD, and BP modules.
- A quick reference guide for SM19/SM20, SUIM, SCU3, and STAD/ST03N.
Requirements
- Foundational knowledge of auditing principles
- Prior experience working with SAP systems
- Familiarity with established compliance and control frameworks
Target Audience
- Internal and external auditors
- Internal control specialists
- SAP security consultants
- Corporate compliance officers
Testimonials (2)
It was straight to the point and more practical
Lungelo Ndlela - SNG Grant Thornton
Course - SAP S/4 Hana (S/4Hana)
His calm and collected voice even though at points he was frustrated with the system, but kept his cool…
