← All modules
smartReview icon

smartReview

Access reviews across SAP, AD, S/4 HANA, HCM - focused on SoD risks.

smartReview enables intelligent review of authorizations and access across various IT systems (SAP ERP, S/4 HANA, HCM, Active Directory and others). The focus is on Segregation of Duties (SoD) risks held by users. It supports the decision-maker by showing which accesses were used frequently or rarely - so reviews are based on facts, not guesswork.

play_circleTry the live demo calculateCalculate your ROI auto_awesomeSee AI Agents
auto_awesome Our AI vision (in development)

AI agents in smartReview

3 agents handle the routine work in this module and escalate only what needs a human. Each agent has its own autonomy dial - your governance officer chooses how much the agent does and where humans stay in the loop.

shield_lock

Your governance officer owns the dial

Per agent, per environment, per risk level - tighten or loosen autonomy without redeploying code or filing engineering tickets. The agent never decides its own permission level. Business rules decide, and your team owns the rules.

Off
No AI
Suggest
AI advises
Approve
Human gate
Auto
Rules-governed
Agent 1 of 3 . Continuous Access Review

AI Continuous Access Review

Instead of quarterly campaigns, the agent monitors every user-role assignment continuously and surfaces unused permissions in real time. Continuous compliance, no end-of-quarter spike.

tune AI autonomy level
Off
Suggest
Approve
Autonomous
Continuous access review - live signals
smartReview
Roles monitored
3,842
Unused > 90d
214
Auto-revoked this week
41
SAP_FI_END_USER assigned to T. Kowalski
Not used for 127 days . last login 14.12.2025
REVOKE SOON
Z_BASIS_DEBUG assigned to 12 users
High-risk role, none used in 180+ days
URGENT
SAP_MM_BUYER . 28 users . all active
Healthy usage pattern, no action needed
OK
Z_ARCH_DISPLAY . A. Nowak
No TX executed in 95 days . low business impact
PRUNE

Illustrative mockup from the smartReview dashboard. Live signals show role-usage health, with PRUNE/URGENT badges driven by agent analysis.

What you see
  • looks_oneHealth metrics across all monitored roles in one dashboard.
  • looks_twoPer-row signals: usage gaps, last login, role criticality.
  • looks_3Status badges: OK / PRUNE / REVOKE SOON / URGENT.
  • looks_4One-click drilldown into reasoning for any flagged role.
trending_up

Always current, never stale

External auditors see today's state, not a snapshot from last quarter. Findings about unused access drop because issues surface and get resolved as they appear.

Agent 2 of 3 . Auto-Revocation

AI Auto-Revocation

When a role has been unused for too long, the agent runs a revocation playbook: notify, wait for appeals, off-hours scheduling, execute. Every step logged. Reversible.

tune AI autonomy level
Off
Suggest
Approve
Autonomous
Auto-revocation queue
smartReview
5 DAYS LEFT
SAP_FI_DISPLAY . T. Kowalski
90d unused
notifications Owner notified 14 May. Appeal window: 5 days. Auto-revoke scheduled 20 May 09:00.
2 DAYS LEFT
Z_BASIS_DEBUG . 12 users
180d unused
notifications High-risk role . BASIS team approved bulk revocation. Scheduled 17 May 02:00 (off-hours).
REVOKED
SAP_HR_PA40 . M. Wisniewska
120d unused
check_circle Auto-revoked 12 May 02:00 . audit trail filed . no appeal received.
ON HOLD
SAP_SD_PRICING . A. Lewicki
95d unused
pending Appeal raised by user . business owner confirmed seasonal need . paused 60 days.

Illustrative mockup from the smartReview revocation queue. Countdown badges show time-to-revoke; entries flip to REVOKED or ON HOLD based on appeals.

What you see
  • looks_oneCountdown badge shows time-to-revoke per role.
  • looks_twoNotification + appeal window before any action.
  • looks_3REVOKED rows include full audit trail and execution timestamp.
  • looks_4ON HOLD for legitimate appeals - paused for an owner-configured period.
trending_up

Least-privilege enforced by code

Unused roles don't sit in the system forever waiting for someone to notice. Audit trail is built into the revocation flow, not bolted on after.

Agent 3 of 3 . Decision Co-pilot

AI Decision Co-pilot

Reviewers see an AI verdict and rationale before making their final call. Faster reviews, higher consistency - because everyone evaluates against the same evidence.

tune AI autonomy level
Off
Suggest
Approve
Autonomous
Access certification - reviewer queue
smartReview
JN
J. Nowak . Finance Controller
Reviewing access to: SAP_FI_POSTING + SAP_FI_APPROVE
psychology AI SUGGESTION confidence 0.76
Recommend: REVOKE one role

User holds both POSTING and APPROVE - a P2P SoD conflict (RISK-FI-04). User has posted in 30/90 days, but never approved her own postings (mitigated by manual control MC-021). Cleanest fix: remove SAP_FI_APPROVE since the user does not actually approve.

SoD conflict MC-021 applies No usage gap risk

Illustrative mockup from the smartReview certification flow. The AI SUGGESTION panel shows verdict + rationale next to Accept / Keep / Need more info.

What you see
  • looks_oneAI SUGGESTION panel with verdict and confidence score.
  • looks_twoReasoning: history, conflicts, mitigating controls already in place.
  • looks_3Three actions: Accept AI / Keep both / Need more info.
  • looks_4Reviewer decides every time - AI never moves the queue forward alone.
trending_up

Reviews 5x faster, decisions more consistent

Reviewers handle 100+ items in the time it used to take for 20. Decisions converge because the same evidence is laid out the same way every time.

auto_awesome See all 19 AI agents

Key features

smartReview · Continuous review
auto_awesome
Agent activity, last 24h

Reviewed 1,284 user-role assignments. 412 auto-cleared as actively used. 18 flagged for human review (unused > 90d, role-creep, anomalies).

UNUSED 124d
anna.kowalska · Z_FI_AP_POST
FI module · no logins since 17.12.2025
auto_awesome AUTO-REVOKE
ANOMALY
tomasz.lewandowski · Z_HR_RECRUITER
Used 3x last week (unusual pattern for HR Recruiter)
escalator_warning HUMAN REVIEW
ACTIVE
piotr.kuriata · Z_BASIS_ADMIN
Basis · used 47x last 30 days · all in scope
check_circle KEEP
UNUSED 96d
beata.sikora · Z_HR_PAYROLL
Last access 14.01.2026 · notice sent
auto_awesome AUTO-REVOKE

Illustrative mockup. The Continuous Review Agent monitors usage in real time, auto-revokes after a notice window, and escalates ambiguous patterns to a human reviewer.

What you see
  • looks_oneContinuous review, not a quarterly campaign. Agent processes every assignment every day.
  • looks_twoAUTO-REVOKE for clear-cut unused permissions (with notice + appeal window).
  • looks_3HUMAN REVIEW for anomalies: unusual patterns, sudden activity, ambiguous cases.
trending_up

No more quarterly review spike

Review work spread evenly across the year. Reviewers focus on ambiguous cases, not rubber-stamping the obvious ones.

check_circle

Multi-system in one review

SAP ERP, S/4 HANA, HCM, Active Directory, custom systems - everything gathered per user in one view.

check_circle

Usage statistics

See which permissions were used intensively, rarely, or never. Decisions based on facts.

check_circle

SoD risk focus

Reviewer sees which permissions generate an SoD conflict - easy to decide what to revoke.

check_circle

Approval workflow

Manager / Security Officer / Process Owner - each reviews their slice, the system orchestrates.

check_circle

Full audit trail

Every decision recorded with context - who, when, why. Audit material without prep.

check_circle

Recurring campaigns

Quarterly / semi-annual / annual schedules - the system launches the campaign, reminds, escalates delays.

Typical use cases

FAQ

Frequently asked questions about smartReview

smartReview vs SAP GRC Access Control - what's the difference? expand_more

smartReview covers the same recertification functions as SAP GRC AC but adds three key capabilities SAP GRC AC does not have: (1) AI suggestions (Approve/Revoke/Examine) based on real usage patterns, (2) reviews beyond SAP via universal XML adapter (billing, DWH, CRM, custom apps), (3) transparent pricing from €15K/year vs ~€250K/year for SAP GRC AC. smartReview is the modern SAP GRC AC replacement for most mid-market and enterprise organizations.

Does smartReview work on non-SAP systems? expand_more

Yes. smartReview has been extended beyond SAP at multiple enterprise customers, including a major telco-media group covering 8 non-SAP systems (billing, Teradata DWH, CRM, accounting sub-ledger, customer-file) on a single platform. The pattern relies on a universal XML adapter (XSD schema) that lets any system exporting user/permission/risk data integrate in days.

Read the full case study: 8 non-SAP systems, one platformarrow_forward

How much does smartReview cost? expand_more

smartReview is included in the Professional plan (from €30K/year, up to 800 SAP users) and Enterprise plan (custom pricing, full governance). All implementation costs are included in the annual fee - no hidden costs, no post-contract surprises. For comparison, classical enterprise GRC platforms start at ~€250K/year.

See all pricing tiersarrow_forward

Is smartReview ISO 27001 certified and GDPR compliant? expand_more

Yes. smartGRC is built by GRC Solutions Sp. z o.o., with sister consulting practice GRC Advisory ISO 27001 certified, 15+ years SAP Security experience, 15 signed customer references. smartReview is designed to support SOX, ISO 27001, GDPR audits and equivalent obligations (e.g., banking regulators across EU).

What's the typical implementation timeline for smartReview? expand_more

For a standard SAP deployment: 4-8 weeks from kick-off to first production review campaign. For a multi-system deployment (SAP + non-SAP): 10-12 weeks, including XML adapter configuration for each added system. The internal audit team is trained to configure risks and campaigns in 1-2 parallel weeks.

Does smartReview integrate with my existing IDM (SailPoint, Oracle, One Identity)? expand_more

Yes. smartReview can consume identity and permission data from any IDM via the XML adapter (documented XSD schema). In practice, we have customers combining smartReview with Oracle IDM, SailPoint and One Identity without dualism: smartReview handles business-language risk, IDM handles technical account lifecycle.

Do external auditors (EY, KPMG, Deloitte, PwC) accept smartReview? expand_more

Yes. smartReview has been accepted by Big 4 auditors in multiple financial audits of publicly-listed groups, specifically via the complete audit trail: who reviewed, when, what they saw, what they decided, with what evidence attached. All exports are in standard format (CSV/XML) acceptable for external auditor working papers.

Can I test smartReview without commitment? expand_more

Yes: the interactive demo is accessible without signup, no credit card. You see the full interface with representative demo data. If you prefer to see the tool on your own data, we organize a 30-minute video session with a senior consultant - direct booking at contact.

Ready to see it live?

Try the interactive UX preview - no signup, no credit card.

play_circleTry the live demo Book a real demo