Course Outline
Session 1 (4 hours)
Module 1 – S/4HANA Foundations for Auditors (2 hours)
- Core architecture overview (ABAP, Fiori, catalogs/roles).
-
Primary differences from ECC:
- Business Partner concept.
- Universal Journal (ACDOCA).
- Flexible workflows.
- Current locations of AIS data: transaction codes and their Fiori equivalents.
Module 2 – Access, Roles, and Critical SoD (2 hours)
- User management, PFCG, SUIM, SU53, SU24 (authorization checks by t-code).
- Fiori catalogs and roles (app-id, catalog, space).
- Basic SoD matrix analysis and common findings (e.g., creation and release permissions within the same role).
Session 2 (4 hours)
Module 3 – Security Logs and Traces (3 hours)
- Security Audit Log (SM19/SM20): setup, filtering, and interpretation.
- STAD/ST03N: analyzing usage statistics, sessions, and peak activities.
- Read Access Logging (RAL): concepts and application scenarios.
- Best practices for retaining and exporting audit evidence.
Module 4 – Configuration Changes and Sensitive Data (1 hour)
- Change documentation (SCU3) and change policies (SCC4).
- Critical parameters (RZ10/RZ11): review and evidence collection.
Session 3 (4 hours)
Module 5 – Process Controls (FI/MM/SD) in S/4 (4 hours)
- FI: Tolerance keys, OB52 (posting periods), entry segregation, and journal approval workflows.
- MM: Release strategies, limit settings, single supplier scenarios, and condition changes.
- SD: Credit limits (FSCM Credit Management) and price/condition modifications.
- BP: Controls for creation/modification and fiscal/banking data sensitivity.
- Risk-based sampling and selection methodologies.
Session 4 (4 hours)
Module 6 – Comprehensive Lab + Reporting (3 hours)
- Simulating the elevation of roles and access for a high-risk user.
- Tracing operations (buy/sell) and gathering evidence (SM20/SCU3).
- Documenting findings using screenshots and data exports.
- Drafting working papers and ensuring traceability.
Module 7 – Closure and Action Planning (1 hour)
- Internal control checklists specific to S/4.
- Prioritizing findings and formulating recommendations.
Deliverables:
- A comprehensive checklist containing over 20 controls (FI/MM/SD/BP).
- Quick reference guides for SM19/SM20, SUIM, SCU3, STAD/ST03N.
Requirements
- Foundational knowledge of auditing principles.
- Prior experience with SAP systems.
- Familiarity with compliance standards and control frameworks.
Target Audience
- Auditors.
- Internal control specialists.
- SAP security consultants.
- Compliance officers.
Testimonials (2)
It was straight to the point and more practical
Lungelo Ndlela - SNG Grant Thornton
Course - SAP S/4 Hana (S/4Hana)
The interaction between the team and sharing their experience with us
Brenda Toral - Michelin Mexico Services
Course - SAP S/4HANA Overview (S4H00)
Machine Translated
