Course Outline
Session 1 (4 hours)
Module 1 – S/4HANA Fundamentals for Auditors (2 hours)
- Core architecture (ABAP, Fiori, catalogs, and roles).
-
Key Differences from ECC:
- Business Partner model.
- Universal Journal (ACDOCA).
- Flexible workflows.
- The role of AIS today: transactions and their Fiori equivalents.
Module 2 – Access, Roles, and Essential SoD (2 hours)
- Managing Users, PFCG, SUIM, SU53, and SU24 (authorization by transaction code).
- Understanding Fiori catalogs and roles (app ID, catalog, space).
- Basic SoD matrix and common findings (e.g., creation and release functions within the same role).
Session 2 (4 hours)
Module 3 – Security Logs and Traces (3 hours)
- Security Audit Log (SM19/SM20): activation, filters, and data retrieval.
- STAD/ST03N: analyzing usage statistics, sessions, and performance peaks.
- Read Access Logging (RAL): concepts and appropriate use cases.
- Best practices for retaining and exporting evidence.
Module 4 – Configuration Changes and Sensitive Data (1 hour)
- SCU3 (change documents) and SCC4 (change policy).
- Identifying critical parameters via RZ10/RZ11: reading data and securing evidence.
Session 3 (4 hours)
Module 5 – Process Controls (FI/MM/SD) in S/4 (4 hours)
- FI: Tolerances, OB52 (posting periods), entry segregation, and journal approval workflows.
- MM: Release strategies, limits, single-supplier issues, and condition changes.
- SD: Credit limits (via FSCM Credit Management) and price/condition adjustments.
- BP: Controls on creation and data exchange, focusing on fiscal and banking sensitivity.
- Techniques for risk-driven sampling and selection.
Session 4 (4 hours)
Module 6 – Comprehensive Laboratory and Reporting (3 hours)
- Managing role assignments and access for critical users.
- Tracing operations (buy/sell) and retrieving evidence (via SM20/SCU3).
- Documenting findings with screenshots and exported data.
- Preparing working papers and ensuring traceability.
Module 7 – Closure and Action Plan (1 hour)
- Internal control checklist for S/4 environments.
- Prioritizing findings and formulating recommendations.
Deliverables:
- A checklist comprising over 20 controls (FI/MM/SD/BP).
- A quick reference guide for SM19/SM20, SUIM, SCU3, and STAD/ST03N.
Requirements
- A foundational understanding of basic auditing principles
- Practical experience with SAP systems
- Familiarity with compliance and control frameworks
Target Audience
- Auditors
- Internal control specialists
- SAP security consultants
- Compliance officers
Testimonials (2)
It was straight to the point and more practical
Lungelo Ndlela - SNG Grant Thornton
Course - SAP S/4 Hana (S/4Hana)
His calm and collected voice even though at points he was frustrated with the system, but kept his cool…
