Course Outline
Session 1 (4 hours) <\/p>
Module 1 – S/4HANA Fundamentals for Auditors (2 hours) <\/p>
- Core architecture overview (ABAP, Fiori, catalogs/roles). <\/li>
-
Key distinctions from ECC:
- Business Partner integration. <\/li>
- Universal Journal (ACDOCA). <\/li>
- Flexible workflows. <\/li> <\/ul> <\/li>
-
Current location of AIS: Transactions and their Fiori equivalents.
<\/li>
<\/ul>
Module 2 – Access, Roles, and Essential SoD (2 hours) <\/p>
- User management, PFCG, SUIM, SU53, and SU24 (authorization checks by transaction code). <\/li>
- Fiori catalogs and roles (app-id, catalog, space structure). <\/li>
-
Basic SoD matrix and common findings (e.g., combining creation and release functions in a single role).
<\/li>
<\/ul>
Session 2 (4 hours) <\/p>
Module 3 – Security Logs and Traces (3 hours) <\/p>
- Security Audit Log (SM19/SM20): Activation, filtering, and interpretation. <\/li>
- STAD/ST03N: Analyzing usage statistics, sessions, and peak times. <\/li>
- Read Access Logging (RAL): Concepts and application scenarios. <\/li>
-
Best practices for retaining and exporting audit evidence.
<\/li>
<\/ul>
Module 4 – Configuration Changes and Sensitive Data (1 hour) <\/p>
- SCU3 (change documents) and SCC4 (change policies). <\/li>
-
Critical parameters (RZ10/RZ11): Interpretation and evidence gathering.
<\/li>
<\/ul>
Session 3 (4 hours) <\/p>
Module 5 – Process Controls (FI/MM/SD) in S/4 (4 hours) <\/p>
- FI: Tolerances, OB52 (period blocks), entry segregation, and journal approvals (workflows). <\/li>
- MM: Release strategies, purchase limits, single-source procurement, and condition changes. <\/li>
- SD: Credit limits (FSCM Credit Management) and price/condition adjustments. <\/li>
- BP: Controls over creation/change processes and fiscal/banking data sensitivity. <\/li>
-
Risk-based sampling and selection methodologies.
<\/li>
<\/ul>
Session 4 (4 hours) <\/p>
Module 6 – Comprehensive Lab and Reporting (3 hours) <\/p>
- Simulating the elevation of roles and access for a critical user profile. <\/li>
- Tracing operations (buy/sell) and securing evidence via SM20/SCU3. <\/li>
- Documenting findings using screenshots and system exports. <\/li>
-
Preparing working papers and ensuring full traceability.
<\/li>
<\/ul>
Module 7 – Wrap-up and Action Plan (1 hour) <\/p>
- Reviewing the internal control checklist specific to S/4. <\/li>
-
Prioritizing findings and formulating recommendations.
<\/li>
<\/ul>
Key Deliverables: <\/p>
- A comprehensive checklist containing 20+ controls (FI/MM/SD/BP). <\/li>
- Quick reference guide for SM19/SM20, SUIM, SCU3, and STAD/ST03N. <\/li> <\/ul>
Requirements
- A solid grasp of fundamental auditing principles <\/li>
- Prior experience working with SAP systems <\/li>
-
Familiarity with compliance standards and control frameworks
<\/li>
<\/ul>
Target Audience <\/p>
- Auditors <\/li>
- Internal control specialists <\/li>
- SAP security consultants <\/li>
- Compliance officers <\/li> <\/ul>
Testimonials (2)
It was straight to the point and more practical
Lungelo Ndlela - SNG Grant Thornton
Course - SAP S/4 Hana (S/4Hana)
His calm and collected voice even though at points he was frustrated with the system, but kept his cool…
