The Sap Sod Audit Finding Your Governance Program Is Not Designed To Prevent

By Author: Soham Biswas
Total Articles: 51
Comment this article

The audit finding arrives and the compliance team is surprised. Not because the conflict was obscure or the control particularly difficult to implement. Because the SoD program was running, the access review campaign had completed on schedule, and the certification records were clean.

What the program was not designed to catch was the conflict that lived outside its configured perimeter.

This is the most consistent pattern in manufacturing SoD audit findings: not the absence of an SoD program, but an SoD program whose scope stops at the SAP boundary while the auditor's scope does not. Understanding the structural reason this happens, and what it takes to close the gap, is the practical argument this piece makes.

Where SAP SoD Programs Are Configured to Look

SAP SoD detection is genuinely valuable and genuinely limited by design. A properly configured SoD program for a manufacturing SAP environment surfaces the most dangerous cross-functional conflicts within SAP: vendor master creation combined with payment run execution, purchase order creation combined with goods receipt confirmation, payroll ...
... creation combined with payroll posting, production order creation combined with production order confirmation. These are real risks, they map to real fraud and error scenarios, and surfacing them is the right starting point for any manufacturing governance program.

The limitation is not in the quality of the SAP SoD analysis. It is in what the analysis was configured to cover.

SAP GRC detects conflicts within the SAP role model. It does not analyse Active Directory or Entra ID group memberships that determine what the same user can access across the enterprise. It does not evaluate whether an SAP Accounts Payable user also holds administrative access to the HR system that feeds salary data into payroll, a cross-system combination that creates real risk with no SAP-internal detection path. It does not govern the contractor who acquired SAP access through an ad hoc request six months ago and whose project ended three months ago, because that identity sits outside the HR system that feeds the SAP role model.

The configured scope and the actual risk scope are not the same thing in most manufacturing environments. The audit finds the gap between them.

The Evidence Problem Nobody Names Directly

There is a second dimension to manufacturing SoD findings that is less discussed than the detection gap and more consistently responsible for the actual audit outcome.

Manufacturing companies rarely have an access-data problem. SAP exports exist. Active Directory logs exist. HR system records exist. ServiceNow approval tickets exist. The data that would answer an auditor's questions is distributed across a collection of systems, formats, and ownership boundaries.

What manufacturing companies frequently do not have is audit-ready access evidence: a governance record that connects the access to the risk, the risk to the reviewer, the reviewer to the decision, and the decision to the remediation or accepted compensating control, in a single retrievable format that does not require manual reconstruction under audit pressure.

When an auditor asks why a specific user held a specific access combination, the answer should not require correlating an SAP export with an email thread, a ServiceNow ticket, and a spreadsheet from the previous certification campaign. The answer should exist in a governance record that was produced at the time the decision was made. When it does not, the finding is generated not by the conflict itself but by the inability to demonstrate what happened after the conflict was identified.

This is the distinction that separates a mature manufacturing SoD program from a program that generates clean certification reports and still produces audit findings.

What the Audit Is Actually Testing

The three control areas that appear consistently across SOX ITGC, IFC, and COBIT-aligned manufacturing audits are access control, identity lifecycle, and access certification. Each one extends beyond SAP, and each one has an evidence requirement that SAP-native tooling was not designed to satisfy.

On access control, the audit is testing whether high-risk role combinations exist across all systems that process financially material transactions, not just within SAP. The same user who holds a standard SAP role may also hold directory group memberships, ServiceNow roles, or HR system access that together create a conflict no single-system SoD tool surfaces.

On identity lifecycle, the audit is asking whether access changes when employment status changes and whether the evidence of that change is timestamped and retrievable across every connected system. A leaver whose SAP access was revoked promptly but whose Active Directory account remained active for forty-five days is a finding. The SAP control operated correctly. The lifecycle governance stopped at the SAP boundary.

On access certification, the audit is asking whether reviewers had the information they needed to make a genuine decision, not just whether the campaign completed. A certification that presents role names without business-process context, or that surfaces access without the SoD risk associated with it, is technically complete and produces no reliable evidence that the reviewer understood what they were certifying.

Each of these three areas requires a governance capability that operates across systems, not within one.

The Five Questions Every Manufacturing SoD Program Must Be Able to Answer

When a conflict surfaces during an audit, five sequential questions determine whether the finding becomes a reportable control deficiency or a documented and remediated exception.

What access did this user hold, and when? The answer requires a complete access inventory at a point in time, across all systems in scope.

Was this access flagged as a risk? The SoD analysis must show the conflict identified at the transaction code level, mapped to a control objective, and assigned a risk rating.

Who reviewed it, and when? The review record must show a named reviewer, a documented decision, and a timestamp. A completed campaign without reviewer-level evidence does not satisfy this question.

What was decided? Remediation, meaning the access was removed, or accepted risk, meaning the conflict was retained with a documented compensating control and a business justification. Both are acceptable. Neither is acceptable without documentation.

What happened after the decision? The access change or the compensating control must be timestamped, evidenced, and retrievable. The audit finding most often originates here, not in the existence of the conflict.

A manufacturing SoD program that detects conflicts but cannot answer all five questions has not closed the audit risk. It has documented half of it.

What a Complete Program Requires

Closing the manufacturing SoD audit gap requires three disciplines operating simultaneously across SAP and the systems around it.

Preventive controls evaluate SoD risk at the access request stage, before conflicting access is assigned. When a role request is submitted, the governance platform checks the requesting user's existing access portfolio for combinations that would create a conflict, and flags the request before it becomes active access. This is the most operationally effective form of SoD governance because it removes the remediation burden after the fact.

Detective controls identify conflicts that already exist in the environment, from legacy assignments, inherited roles, ad hoc provisioning, and access that survived organisational changes. These require continuous scanning across all connected systems, not periodic campaigns within SAP. A quarterly scan misses the conflict created in month two of the quarter.

Evidence connects the first two disciplines to the audit requirement. Every preventive decision and every detective finding must produce a timestamped, retrievable record that shows what was found, who reviewed it, what was decided, and what action was taken. Without this record, the control exists but the evidence does not, and in a manufacturing audit, the evidence is what the auditor is testing.

For the full manufacturing identity governance model, including the seven-step framework for building audit-ready access evidence across SAP and every connected system, visit openiam.com/resources/manufacturing-identity-governance