SAP Audit: SAP Native and Third Party Solutions

What is an SAP Audit?

An SAP audit refers to the systematic review of an organization’s SAP environment, focusing on ensuring the effectiveness of the enterprise software suite provided by SAP, particularly its enterprise resource planning (ERP) system. This suite supports a wide array of business processes, such as accounts receivable, accounts payable, and purchasing. The primary objectives of an SAP audit process are to monitor control management, detect any violations, and verify compliance with various standards and regulations. This is an integral component of SAP’s Governance, Risk, and Compliance (GRC) framework.

SAP’s infrastructure is designed to safeguard critical financial data, implementing stringent controls to limit data access and modifications to authorized personnel only. Audits can be conducted using SAP’s own tools included in its solution portfolio and compatible third-party solutions that can interact with SAP systems.

Understanding SAP audits, along with the fundamentals of SAP system security and compliance, is crucial for executives and senior management. This knowledge not only helps in audit planning and ensuring that the organization adheres to relevant regulations, such as the Sarbanes-Oxley Act (SOX), the Financial Controls and Fraud Act (FCFA), and the International Standards on Assurance Engagements (ISAE) Service Organization Control (SOC) 1, but also demonstrates a responsible and informed leadership stance in secure resource management.

What is SAP Audit Management?

SAP Audit Management is a solution that comes with the SAP Assurance and Compliance Software. It is useful for a variety of tasks, including building an audit plan, preparing audits and their documentation, and analyzing the results.

SAP Audit Management is powered by SAP HANA and offers a complete end-to-end management solution for SAP audits. It can help your audit department plan and execute audits, analyze the relevant data, document and communicate results, and monitor progress. SAP Audit Management includes the following key features:

• Mobility: It’s fully mobile-enabled, providing easy access through desktops, laptops, and mobile devices
• Full audit roadmap coverage: This includes the planning, preparation, execution, reporting and followup stages
• Flexible Audit Universe: Provides a centralized source for auditing and monitors global audit requests
• Third-party integration: Supports integration with systems such as SAP Risk Management and SAP Business Integrity Screening
• Working paper management: Lets you generate audit documents using drag-and-drop, access documents with a single click and review your management
• Global monitoring: Allows you to monitor findings and progress
• Search function: Allows you to find your target information with a single click
• User interface: An intuitive user interface helps boost efficiency and enhances user experience

SAP Audit Management divides the auditing process into five phases—planning, preparation, execution, reporting, and followup. Each phase involves a different set of audit tasks.

You can see how SAP Audit Management organizes an audit workflow in the following figure. Keep in mind that these roles are only an example of a standard audit scenario, but you may use a different role for each action in your own organization.

Image Source: SAP

Challenges of Working With SAP Audit Logs

Many large enterprises use SAP’s ERP systems, and these organizations face complex compliance requirements. To achieve regulatory compliance, they must enable, properly configure and secure SAP security audit logs.

Incompatible With Standard Tools

The SAP Security Audit Log (SAL) contains all events that occurred in the ERP system. Each operation has its own transaction code and related details — who did it, when and under what circumstances. There are about 100,000 different transaction codes, many of which are important for security, risk, and compliance purposes.

What is important to know about SAP logs is that, technically, they are endless, fixed-size rows of log entries. This unusual architecture, combined with the 4-digit transaction codes, makes it impossible for standard tools to read and understand the logs. One option is SAP Log Viewer, but it is limited compared to third-party log aggregation solutions.

Difficult to Secure Data

Another challenge is that there is a need to protect log file integrity. Unprotected audit logs are of no value because anyone with relevant access can delete, modify, or create log entries. Therefore, the team managing the SAP installation is responsible for protecting the integrity of the SAP audit log.

You can use security information and event management (SIEM) systems to manage your SAP system and log data, but you usually need to install a special plug-in for your SAP installation to help translate the alerts to a format the SIEM can ingest.

Another option is to use SAP Enterprise Threat Detection (ETD), a solution that collects events from SAP HANA databases and associated SAP applications. SAP ETD has a purpose-built log preprocessor that normalizes and enriches data from SAP applications, converting it to a format that is useful for security professionals.

The Need for Third-Party SAP Audit Solutions

Many organizations complement SAP Audit Management and SAP Audit Logs with third-party solutions that can help automate audit plans and improve compliance efforts centered around SAP systems.

Third-party SAP audit solutions can provide the following capabilities in addition to those provided by native SAP audit management solutions:

• Automated change tracking: Automatic monitoring and auditing of every system change or upgrade to a SAP application, with information about who made the change, according to what policy, why, and in which context. This can quickly reveal violations of company policies or compliance requirements.
• Compliance alerting: Codifying unique organizational policies and continuously monitoring to see if any activity in SAP systems violates them. When an action does not align with corporate policies, the system alerts and escalates to the relevant personnel.
• Audit support: Readily available reports in the format required by internal or external auditors for each compliance standard. Instead of having to manually reconstruct events from SAP logs, solutions can generate the required information automatically based on data gathered from SAP systems.
• Audit customization: Each company has specific audit requirements based on its internal policies, the compliance standards it needs to comply with, and specific requirements within those standards. SAP auditing solutions can help generate customized audits that meet these complex and often changing requirements.

Related content: Read our guide to SAP GRC tools

SAP Audit Automation with Pathlock

Pathlock is the proven SAP Solution Extension partner, which extends your SAP GRC investment in several critical areas:

With Pathlock Access Control Integration, customers can extend their SAP Access Control and SAP Process Control implementation to monitor cross-application SOD risks in SAP cloud applications (like SAP Ariba and SuccessFactors) and non-SAP applications (like Salesforce and Workday)

With Access Violation Management, customers can clearly articulate the financial exposure that access risks have on the business. The application automates the monitoring and correlation of business transactions to identify instances where actual segregation-of-duties (SoD) violations occurred, and it summarizes the financial dollar value by business process, risk, or user.

With Pathlock, customers can:

• Extend their SAP Access Control implementation with Emergency Access Management for SAP Cloud (SAP Ariba and SuccessFactors) and non-SAP applications (like Salesforce and Workday)
• Extend their SAP Process Control implementation to monitor business process controls across SAP cloud applications (like SAP Ariba and SuccessFactors) and non-SAP applications (like Salesforce and Workday)
• Extend their Role Based Access Control to Attribute Based Access Control, providing fine grained data masking and encryption to provide greater protection than broad roles can provide on their own

Interested to learn more about how you can extend your SAP GRC investment with Pathlock? Request a demo of our industry leading capabilities today!