Course Outline
Session 1 (4 hours)
Module 1 – S/4HANA Fundamentals for Auditors (2 hours)
-
Core architecture components (ABAP, Fiori, catalogs, and roles).
-
Key changes compared to ECC:
- Business Partner (BP) concept.
- Universal Journal (ACDOCA).
- Flexible workflows.
- Current location of Audit Information System (AIS): transactions and their Fiori equivalents.
Module 2 – Access, roles, and essential SoD (2 hours)
-
Management of users, PFCG, SUIM, SU53, and SU24 (authorizations by transaction code).
-
Fiori catalogs and roles (application ID, catalog, and space).
-
Basic SoD matrix and typical findings (e.g., creation and release functions assigned to the same role).
Session 2 (4 hours)
Module 3 – Security logs and traces (3 hours)
-
Security Audit Log (SM19/SM20): activation, setting filters, and reading logs.
-
STAD/ST03N: analyzing usage statistics, sessions, and peak periods.
-
Read Access Logging (RAL): concepts and appropriate use cases.
-
Best practices for retaining and exporting evidence.
Module 4 – Configuration changes and sensitive data (1 hour)
-
SCU3 (change documents) and SCC4 (change policy).
-
Critical parameters (RZ10/RZ11): reading data and gathering evidence.
Session 3 (4 hours)
Module 5 – Process Controls (FI/MM/SD) in S/4 (4 hours)
-
FI: Tolerances, OB52 (accounting periods), segregation of entries, and journal approval (via workflow).
-
MM: Release strategies, limit checks, single-supplier scenarios, and conditions changes.
-
SD: Credit limits (FSCM Credit Management) and price/condition modifications.
-
BP: Controls on creation/exchange, focusing on fiscal and banking sensitivity.
-
Risk-driven sampling and selection techniques.
Session 4 (4 hours)
Module 6 – Comprehensive laboratory + reporting (3 hours)
-
Managing roles and access for a critical user.
-
Tracing operations (buy/sell) and obtaining evidence (via SM20/SCU3).
-
Documenting findings with screenshots and data exports.
-
Preparing working papers and ensuring traceability.
Module 7 – Closure and action plan (1 hour)
-
Internal control checklist for S/4.
-
Prioritizing findings and formulating recommendations.
Deliverables:
-
A checklist covering 20+ controls (FI, MM, SD, BP).
-
A quick reference guide for SM19/SM20, SUIM, SCU3, and STAD/ST03N.
Requirements
- A foundational understanding of basic auditing principles
- Practical experience with SAP systems
- Familiarity with compliance and control frameworks
Audience
- Auditors
- Internal control specialists
- SAP security consultants
- Compliance officers
Testimonials (2)
It was straight to the point and more practical
Lungelo Ndlela - SNG Grant Thornton
Course - SAP S/4 Hana (S/4Hana)
His calm and collected voice even though at points he was frustrated with the system, but kept his cool…
