6 posts
Periodic access review is the second most common audit finding in SAP after SoD.
A major telco-media group extended smartReview beyond SAP to 8 non-SAP systems carrying material accounting, billing and customer data. Practitioner case study, anonymised.
Did your last SAP authorization audit drag on for weeks? Did Excel files and endless emails prolong the process even further? See how you can review SAP accesse
Did your last SAP entitlement audit drag on for weeks? And Excel files and endless emails prolonged the process even more? See how you can complete your SAP acc
Did you know that ineffective privilege management in ERP systems can cost you dearly? Your company could be losing thousands of hours of skilled labor because
How to run a professional SAP authorization review with smartGRC: data preparation, reviewer workflow, decision automation, and closing the control loop.
How a global retail company ran a periodic SAP authorization review across 1000+ users, 2 ERPs, and 1518 SoD risks - in under 3 months with smartGRC.
Periodic access review is the second most common audit finding in SAP after SoD. The compliance expectation is clear: every privileged user must have their access reviewed at a regular cadence by an accountable reviewer who understands what the access enables. The operational reality is harder: most enterprises lack the tooling, ownership and time to run reviews on the full user population. This category collects practitioner content on how to make access reviews actually happen.
Articles cover periodic access review methodology, smartReview platform usage, AI-assisted review suggestions, multi-system access governance (SAP + non-SAP), reviewer training, evidence trail design for external auditors, and the case study of how a major telco-media group extended access reviews beyond SAP to 8 non-SAP systems.
This category is for internal audit teams, GRC managers, SAP Security professionals and access governance owners responsible for periodic access certification. If you are facing audit findings on access review completeness, designing a new review cycle, or evaluating GRC tooling for review automation, this is the practitioner content most relevant.
Industry standard: quarterly review for high-privilege users (Firefighter, admin, finance), annual full review for the entire user population. SOX-relevant systems typically require quarterly cadence as a regulatory expectation. GDPR-relevant systems benefit from an additional annual PII access classification audit.
The business owner of the system or process the access enables - not IT, not the user themselves, not their administrator. For SAP authorizations, this typically means: finance access reviewed by Finance manager, procurement access by Procurement manager, HR access by HR manager. The reviewer needs both organizational authority and enough understanding of what the authorization enables to make a decision.
Yes - and most modern enterprises need to. SAP is typically 30-50% of the access risk surface; the rest lives in billing platforms, data warehouses, CRM, custom apps. We published a detailed case study of a major telco-media group covering 8 non-SAP systems with one access review platform via universal XML adapter pattern.