Most frameworks ask the same things of an SAP system in different words: who has access, what changed, who did it and who was watching. sapaudit keeps those answers ready.
Users, roles and critical authorizations, now and at any past date.
Changes to master data, financial documents, roles and configuration, with before and after.
Each action tied to a user, a time, a system and a terminal.
Alerts raised, anomalies reviewed and the decisions taken on them.
Predefined report sets are included for each standard below, grouped by the requirement they evidence.
Prove who can change financial data and configuration in SAP, and that changes were authorised.
Show who accessed personal data held in SAP, who was able to, and that access is reviewed and limited.
Evidence of access control, accountability and timely detection of personal data incidents.
Records for access management, logging and monitoring, and change management controls.
Track and review access to the SAP systems that hold or process cardholder data.
Demonstrate access control, incident detection and handling on business-critical systems.
Trace changes and privileged activity on the systems that support critical functions.
Record access to SAP systems holding health data and review it for inappropriate use.
For SAP cloud services such as SAP S/4HANA Cloud, independent audit firms examine SAP's controls and SAP makes the resulting SOC 1 and SOC 2 reports available to customers.
The security, availability and confidentiality of the cloud infrastructure and operations that SAP runs.
Your users, their roles and authorizations, the changes they make and how that activity is reviewed.
It provides the evidence for your part, so the SOC reports and your own records together answer the whole question.
Review critical authorizations, close what you find and keep the record that you did.
Answer each request with a dated report instead of a promise to follow up.
Scheduled reviews and Sage AI keep controls working when nobody is asking.