An engineering manufacturer's SAP audit, built from raw tables
An engineering manufacturer wanted its SAP configuration, access and transactions audited together. Rule-based analytics on raw table extracts found over-privileged accounts and segregation-of-duties conflicts.
From our own project and product work. Client names and identifying details are removed, and some figures are rounded.
The situation
An engineering manufacturer wanted a full audit of its SAP environment: weak configuration settings, people who hold incompatible access, and transactions that bypass controls. These three areas are usually audited separately, by different teams.
What we did
- Extract. We pulled the SAP tables we needed with the standard table browser, so no new software went onto the client's system.
- Check configuration. We tested the extracts for security settings and weaknesses.
- Map access. We joined four to five security and authorisation tables into one dataset, showing each user's exact roles and permissions.
- Test transactions. KNIME workflows applied rules to the raw tables to flag exceptions and control bypasses.
- Show it. The results feed an interactive dashboard.
What we found
| Area | Finding |
|---|---|
| Access | Overlapping roles and over-privileged accounts |
| Segregation of duties | Distinct conflicts where one person could complete a transaction alone |
| Transactions | Exceptions and control bypasses flagged for review |
What changed
- Three audits in one. Configuration, access and transactions are reviewed from the same data.
- Exact access, not role names. Joining the security tables shows what each user can actually do.
- Repeatable. The same workflows run again at the next audit.
Products and services
Our digital, cyber and IT risk team runs SAP audits like this one. CompliBear can monitor the same rules every day. See manufacturing and automotive.