Description

A focused course, tailored for you

The SAP Security Senior Manager Customer-Audit Playbook

Walk a customer security and audit team through SAP authorisations, BTP identity, and S/4HANA segregation of duties without spending three nights rebuilding evidence packs.

The customer auditor wants SU24, PFCG, GRC Access Control, SAP IAG, BTP destination service, and Firefighter evidence cross-referenced in a single artefact. The senior SAP security manager who owns the account ends up assembling it manually every quarter because the underlying systems do not produce one report.

$199 one-time

Tailored to your situation. Access within 24 hours. 30-day money-back.

Includes a hand-built implementation playbook delivered alongside course access, generated for your specific situation.

Why this course

Senior SAP security managers running customer-facing programmes carry a recurring assembly problem. The customer's internal audit, external audit, or regulator wants segregation of duties evidence for sensitive roles, identity and trust evidence for BTP destinations, Fiori catalog evidence aligned to job functions, and emergency access logs reconciled to change tickets. Each of those sits in a different system, with a different export format, on a different release cadence. The first time the senior manager walks a new account through the cycle, three or four evenings disappear into Excel reconciliations, screenshots, and rewriting cover memos because the customer auditor sent the evidence list back asking for a different cut. The second account is faster, but only because the manager carries the assembly logic in their head. The course turns the assembly logic into a documented, repeatable workflow with the cover memos and templates customers actually accept.

What you walk away with

Produce a single-artefact customer-audit evidence pack covering SoD, BTP identity, Fiori catalogs, and Firefighter logs.
Map an SAP IAG ruleset baseline to the customer's GRC Access Control ruleset and reconcile the deltas in writing.
Document BTP destination service identity mapping and trust configuration in a format an external auditor accepts.
Cut the assembly time for a quarterly customer-audit cycle from three evenings to one afternoon.
Walk a customer CISO and external auditor through the evidence pack in a single meeting and close open items in writing.

The 12 modules

Module 1. The customer-audit evidence pack as a single artefact

What goes in the cover memo, what goes in the appendices, what goes in the supporting templates. The order the customer auditor reads it in, the screenshots they expect, the trace IDs they verify. This module establishes the artefact shape every later module feeds. The downloadable template is a populated example for an S/4HANA programme with BTP subaccounts and a Firefighter footprint, ready to be cloned per customer.

Module 2. SoD ruleset baseline from SAP IAG and GRC Access Control

How the SAP IAG ruleset baseline reconciles to a customer's GRC Access Control ruleset, where the gaps land, and how to document the deltas in a way the customer's internal audit accepts without rework. Includes the reconciliation spreadsheet template, the cover memo wording for ruleset deltas, and the workflow for getting a customer's risk owner to sign off on the residual exposure list.

Module 3. PFCG role design evidence for sensitive transactions

How to extract PFCG role authorisations for sensitive transactions like F-02, MIRO, MIGO, ME21N, and FB60, document the SU24 trace evidence, and present the role-to-job-function mapping in a single sheet. Covers the SUIM extraction sequence, the screenshots the auditor expects, and how to handle composite roles versus single roles in the cover memo.

Module 4. Fiori catalog and tile evidence aligned to job functions

Fiori catalogs and tiles often do not match the underlying PFCG role design cleanly, especially after a Fiori launchpad rebuild. This module walks the catalog extraction, the tile-to-PFCG cross-reference, and the documentation format that explains the difference to a customer auditor without sending them into the SAP launchpad themselves. Includes the catalog evidence template and the worked example for a procurement role.

Module 5. BTP destination service identity and trust configuration

BTP destinations carry the identity and trust configuration that lets the S/4HANA system talk to external services, integration suite, and custom CAP applications. Auditors increasingly ask for the trust chain, the OAuth client credentials lifecycle, and the destination owner. This module documents the destination service evidence format, the trust configuration screenshots, and the rotation evidence the customer's CISO expects.

Module 6. BTP subaccount and Cloud Foundry space authorisation evidence

Cloud Foundry spaces, subaccount role collections, and BTP cockpit role assignments are a separate authorisation surface from S/4HANA. This module covers the subaccount inventory, the role collection mapping, the space developer versus space auditor distinction, and the evidence format that satisfies a customer auditor asking how BTP authorisations align to the SAP IAG baseline.

Module 7. Firefighter and emergency access log reconciliation

Emergency access via Firefighter is the highest-frequency audit finding on customer programmes. This module covers the Firefighter log extraction, the reconciliation to change tickets and incident records, the workflow for handling missing justifications, and the cover memo wording for quarterly Firefighter reviews. Includes a Firefighter log reconciliation template and the worked example for a quarter with one finding the customer auditor accepted.

Module 8. User access review and recertification evidence

Quarterly or annual user access reviews are the artefact most customers run badly. This module covers the review scope definition, the reviewer assignment workflow, the evidence the customer's internal audit looks for, and the documentation format that closes the cycle without a follow-up. Includes the recertification template, the reviewer instructions worksheet, and the cover memo wording for the closeout.

Module 9. GRC Access Control workflow evidence and risk acceptance

GRC Access Control workflows produce a paper trail that customer auditors expect to see end to end, including the risk analysis output, the mitigating control assignment, and the risk acceptance signoff. This module covers the workflow evidence extraction, the mitigating control documentation format, and how to handle risk acceptances that have outlived their review date.

Module 10. Change management and transport evidence for security objects

Security objects move through the transport system like any other change, but customer auditors want explicit evidence that a security change went through proper change management. This module covers the transport evidence extraction, the change ticket cross-reference, and the documentation format that links a PFCG role change to an approved change record with a named approver.

Module 11. The customer CISO walk-through and external auditor handover

How to walk a customer CISO and external auditor through the evidence pack in a single meeting. The agenda template, the screen-share sequence, the questions to pre-empt, the open-items log format, and the closeout email that confirms what was accepted and what stays open. Includes the worked example for an external audit walk-through that closed nine of nine open items in writing within five business days.

Module 12. The repeatable quarterly cycle and the per-account playbook

How to turn the assembly logic from modules 1 through 11 into a repeatable quarterly cycle the senior manager can hand to a junior analyst on the account team. Covers the cycle calendar template, the per-account playbook structure, the handover checklist, and the format for the quarterly status memo the customer CISO and audit committee expect. Includes the per-buyer implementation playbook hand-built for your specific customer mix.

How this addresses your situation

Specific modules that map to what you said you are dealing with.

When a customer's external auditor sends a Q-end evidence list, modules 1 through 7 produce the appendices and the cover memo in one afternoon.

When a customer's CISO asks for a BTP authorisation review separate from S/4HANA, modules 5 and 6 produce the BTP-specific evidence pack with the destination and subaccount inventories.

When Firefighter usage spikes and the customer's internal audit raises it, module 7 produces the reconciliation and the wording for the quarterly Firefighter review memo.

When the senior manager wants to hand the quarterly cycle to a junior on the account team, module 12 produces the per-account playbook and the handover checklist.

What you get with this course

Twelve written modules in the Art of Service learning environment.
Downloadable evidence pack template populated with a worked example.
Downloadable SoD ruleset reconciliation spreadsheet.
Downloadable Firefighter log reconciliation template.
Downloadable BTP destination and subaccount inventory templates.
Downloadable customer walk-through agenda and closeout email templates.
The per-buyer implementation playbook hand-built for your customer mix and S/4HANA release.

What you will have in hand by Day 1, Week 1, Month 1

Within 24 hours of purchase your account in the Art of Service learning environment is provisioned and the per-buyer implementation playbook is delivered alongside it.

Modules 1 through 4 are typically worked in the first week.

Modules 5 through 8 are typically worked in the second week.

Modules 9 through 12 plus the per-buyer implementation playbook walk-through are typically worked in the third and fourth weeks.

A typical senior manager finishes the full pack in four to six weeks at three to five hours per week.

Before and after

Before

Three evenings per quarter assembling a customer-audit evidence pack from SU24, PFCG, GRC, IAG, BTP cockpit, and Firefighter logs, with cover memos rewritten twice because the customer auditor sent the first cut back.

After

One afternoon per quarter producing a single-artefact evidence pack the customer auditor accepts on the first cut, with a documented per-account playbook a junior analyst can run under supervision.

What happens if you do not address this

The assembly logic stays in the senior manager's head. When the account scales to a second or third customer programme, the quarterly cycle stretches across more evenings, the junior analysts on the team cannot take any of it off the senior manager's plate, and the customer auditor finds the same gaps the manager already knew about because the cover memo did not call them out clearly the first time.

Who it is for

Senior SAP security manager running customer-facing security and audit advisory for one or more S/4HANA programmes. Comfortable with PFCG, SU24, GRC Access Control, SAP IAG, BTP identity and trust, Fiori, and Firefighter. Typically advises a customer's CISO, Head of Internal Audit, or external auditor on what good looks like. Often the single technical point of contact when the customer's auditor asks for evidence the customer cannot produce on their own.

Who this is NOT for. Not for ABAP developers who do not own role design. Not for first-line basis administrators. Not for managers who only touch on-premise ECC without any BTP, IAG, or S/4HANA footprint. Not for anyone looking for a generic ISO 27001 overview.

How it arrives

Text-based course in the Art of Service learning environment, plus downloadable templates and worked examples for every module, plus the hand-built implementation playbook delivered alongside course access.

Time investment. Three to five hours per week over four to six weeks for the full pack. The first customer-audit cycle a buyer runs after module 7 typically saves more time than the course took to work through.

Why $199 is the right number

SAP's own learning hub teaches the product. SAP partner academies teach implementation. Big4 audit methodologies teach the auditor's side of the table. None of those produce the senior manager's single-artefact customer-audit evidence pack with downloadable templates and a per-buyer implementation playbook. The closest equivalent on the market is a Big4 advisory engagement at twenty to fifty thousand USD for a comparable artefact, without the templates the manager can reuse on the next account.

FAQ

Does this assume a specific S/4HANA release?

The worked examples use S/4HANA 2023 and 2026 release behaviours, and the per-buyer implementation playbook is hand-built for the release your customer is on. The reconciliation logic and evidence templates work across releases.

Does it cover ECC as well as S/4HANA?

The PFCG, SU24, Firefighter, and GRC Access Control modules apply equally to ECC. The BTP modules and the Fiori catalog module are S/4HANA and BTP specific.

What if my customer uses Azure AD or Entra ID rather than SAP IAG for identity?

Module 5 covers BTP trust configuration for external identity providers, including Azure AD and Entra ID, and the destination evidence format does not assume SAP IAG.

Can a junior analyst on my team work the course instead of me?

Yes. The course is designed for a senior manager to work first, then hand to a junior with the per-account playbook from module 12. The junior runs the cycle, the senior reviews and signs off.

Is there a refund if it does not fit?

Yes. Thirty days, no questions, full refund.

30-day money-back guarantee. If after a week of working through the materials this is not what you needed, reply to the receipt email and a full refund is processed. No questions, no forms.

Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.