SAP authorisations audit program.
How to audit whether authorisations in the SAP system are granted according to a concept, segregation of duties is maintained and critical rights, emergency access and changes to the production system are controlled.
Last updated: 13 October 2026 · Sample, not legal advice
Download the sample as PDF 8 pages, no sign-up
Download as Excel template with columns for result and notes, no sign-up
Audit objective
The audit assesses whether the organisation grants authorisations in the ERP system according to an approved concept and reviews them regularly, whether incompatible functions are segregated and whether critical authorisations, standard and emergency users and changes to the production system are controlled and traceable. It also assesses whether logging secures the traceability of changes relevant to bookkeeping.
Scope
- Productive SAP systems and clients with processes relevant to bookkeeping
- Roles, users, request and approval process and the segregation of duties rule set
- Emergency users, standard users, interface and system users
- Out of scope: authorisations in upstream systems outside SAP, which have their own audits
Audit program
| No. | Criterion | Reference | Audit procedure | Expected evidence |
|---|---|---|---|---|
| 1 | An authorisation concept describes role design, naming conventions, granting, review and responsibilities and is approved. | BSI APP.4.2; ISO/IEC 27001:2022 Annex A 5.15 | Read the concept, check approval and trace naming conventions for ten roles in the system. | Authorisation concept with approval, role list |
| 2 | Roles are tailored to business tasks and have accountable role owners from the business. | BSI APP.4.2; ISO/IEC 27001:2022 Annex A 5.18 | Check content and owner for five roles and ask owners about their knowledge of the role content. | Role descriptions, list of role owners |
| 3 | Authorisations are granted only on request with approval by line manager and role owner. | ISO/IEC 27001:2022 Annex A 5.18 | Reconcile ten role assignments of the last six months with requests and approvals. | User master change documents, requests, approvals |
| 4 | A segregation of duties rule set is defined; conflicts are detected, assessed and offset by controls. | ISO/IEC 27001:2022 Annex A 5.3; GoBD para. 100 | Review the rule set, run a current conflict analysis and trace compensating controls for three conflicts. | Segregation of duties rule set, conflict report, control evidence |
| 5 | Critical authorisations such as full access profiles, debugging with change rights or direct table maintenance are limited to few justified cases. | ISO/IEC 27001:2022 Annex A 8.2; BSI APP.4.2 | Analyse users with critical profiles and authorisations and reconcile them with approved exceptions. | Analysis of critical authorisations, exception approvals |
| 6 | Standard users are locked or secured with changed passwords and monitored in all clients. | BSI APP.4.2 | Read status and password change of standard users in all clients. | Analysis of standard users per client |
| 7 | Emergency users are activated only when needed; their activities are logged and reviewed afterwards. | ISO/IEC 27001:2022 Annex A 8.2 and 8.15 | Select five emergency uses and trace reason, activation, log and follow-up review. | Emergency logs, approvals, evidence of follow-up review |
| 8 | Authorisations are recertified regularly by line managers and role owners; removals are implemented. | ISO/IEC 27001:2022 Annex A 5.18 | Check the last recertification for completeness and trace implementation in the system for five removals. | Recertification record, change documents |
| 9 | Productive clients and the production system are locked against direct changes; openings are approved and logged. | GoBD para. 107; BSI APP.4.2 | Read system and client changeability settings and trace openings in the last twelve months. | System settings, system changeability log, approvals |
| 10 | Table logging and change documents are active for data relevant to bookkeeping. | GoBD para. 107; ISO/IEC 27001:2022 Annex A 8.15 | Check system parameters for table logging and have logging evidenced for three relevant tables. | System parameters, table log analysis |
| 11 | Development, test and production are separated; changes reach production only through the transport system. | ISO/IEC 27001:2022 Annex A 8.31 and 8.32 | Review transport routes and check whether development rights are granted in the production system. | Transport landscape, transport logs, analysis of development rights |
| 12 | Interface and system users have only the rights needed for their task and cannot be used for dialogue sign-in. | BSI APP.4.2; ISO/IEC 27001:2022 Annex A 8.2 | Read users of type system and communication and check rights and user type. | List of technical users with roles and user type |
| 13 | Users of former employees are locked promptly and validity dates are maintained. | ISO/IEC 27001:2022 Annex A 5.18; BSI ORP.4 | Reconcile the HR leaver list with active SAP users and their last sign-in. | Leaver list, user list with status and last sign-in |
Documents to request
- Authorisation concept with approval
- Role list with role owners
- Segregation of duties rule set and current conflict analysis
- Analysis of critical authorisations and standard users
- Emergency user logs with follow-up review
- Record of the last recertification
- System changeability settings and log
- List of technical users
Typical findings
- Several users have full access profiles in the production system.
- Segregation of duties conflicts are known, compensating controls are missing.
- Emergency users are used, but their logs are never reviewed.
- The production system was open for direct changes for weeks.
- Table logging is not activated.
- Former employees still have valid users.
Note on references
The references point to laws, regulations and standards so that you can read the requirement in the original. No normative text is reproduced. Criteria and procedures are original wording and replace neither the text of the provisions nor legal advice. Whether and to what extent a provision applies to your organisation should be clarified before the audit.
The complete package
This sample shows the objective, the audit steps and the document list on one page. For your own audit topic, ProAuditMap creates the complete package: audit plan, audit program per audit dimension, document request list, interview guides, schedule, communication and report template. You review the draft, approve it and export to Excel and Word.
Create account View a complete sample package View pricing