Course Outline
Session 1 (4 hours)
Module 1 – S/4HANA Essentials for Auditors (2 hours)
- Foundational architecture components, including ABAP, Fiori, and catalogs/roles.
-
Significant changes from ECC:
- Business Partner master data.
- Universal Journal (ACDOCA).
- Flexible workflows.
- Current availability of AIS: Transactions and their Fiori equivalents.
Module 2 – Access Control, Roles, and Critical SoD (2 hours)
- Management of users, PFCG, SUIM, SU53, and SU24 (authorizations by transaction code).
- Fiori catalogs and roles (application ID, catalog, space).
- Basic Segregation of Duties (SoD) matrices and common observations (e.g., conflicting creation and release functions within a single role).
Session 2 (4 hours)
Module 3 – Security Logs and Traces (3 hours)
- Security Audit Log (SM19/SM20): configuration, filtering, and analysis.
- STAD/ST03N: system usage statistics, session monitoring, and peak activity analysis.
- Read Access Logging (RAL): concepts and applicable scenarios.
- Best practices for retaining and exporting audit evidence.
Module 4 – Configuration Changes and Sensitive Data (1 hour)
- SCU3 (change documents) and SCC4 (change policies).
- Critical parameters (RZ10/RZ11): interpretation and evidence gathering.
Session 3 (4 hours)
Module 5 – Process Controls in S/4 (FI/MM/SD) (4 hours)
- FI: Tolerances, OB52 (posting periods), entry segregation, and journal approval via workflows.
- MM: Release strategies, limits, single-source procurement, and condition changes.
- SD: Credit limits (FSCM Credit Management) and price/condition modifications.
- BP: Controls on creation/exchange and fiscal/banking data sensitivity.
- Risk-based sampling and selection methodologies.
Session 4 (4 hours)
Module 6 – Comprehensive Lab and Reporting (3 hours)
- Escalation of roles and access for a critical user.
- Tracing operations (procurement/sales) and gathering evidence (SM20/SCU3).
- Documenting findings with captures and exports.
- Preparing working papers and ensuring traceability.
Module 7 – Conclusion and Action Plan (1 hour)
- Internal control checklist specific to S/4.
- Prioritizing findings and formulating recommendations.
Deliverables:
- Checklist containing 20+ controls for FI/MM/SD/BP.
- Quick reference guide for SM19/SM20, SUIM, SCU3, and STAD/ST03N.
Requirements
- Familiarity with fundamental auditing principles
- Experience working with SAP systems
- Knowledge of compliance and control frameworks
Target Audience
- Auditors
- Internal control specialists
- SAP security consultants
- Compliance officers
Testimonials (2)
It was straight to the point and more practical
Lungelo Ndlela - SNG Grant Thornton
Course - SAP S/4 Hana (S/4Hana)
His calm and collected voice even though at points he was frustrated with the system, but kept his cool…
