SAP Audit Defence · Case Study

SAP Audit Defence for a Major US Food ManufacturerHow We Reduced a USD 15 Million SAP Claim by 92% to USD 1.2 Million

A leading US-based food manufacturer with over 75,000 employees and a global distribution network faced a USD 15 million SAP compliance audit claim alleging indirect access violations, unlicensed users, and outdated licensing entitlements. Redress Compliance conducted a systematic deconstruction of SAP’s audit findings, corrected indirect access misinterpretations, reclassified thousands of user accounts, recovered historical entitlements from legacy agreements, and negotiated a final settlement of USD 1.2 million — a 92% reduction that included future-proof licensing terms aligned with the company’s growth strategy.

📍 United States (Global Operations) 🍞 Food Manufacturing 📅 January 2025 ⏱ 16-week engagement
📘 This case study is part of our SAP Audit Defence Case Studies series. For broader guidance, see our SAP Licensing Knowledge Hub and the SAP Audit Defence Service.
USD 15M
Initial SAP Audit Claim
USD 1.2M
Final Settlement
92%
Claim Reduction
75K+
Employees Worldwide

1. The Challenge: A USD 15 Million SAP Audit Claim

The food manufacturer’s SAP estate was the operational backbone of its entire business. SAP ERP Central Component (ECC) managed production planning, materials management, quality control, and financial consolidation across 30+ manufacturing plants. SAP Supply Chain Management coordinated logistics across a distribution network serving retail, foodservice, and export channels in 45+ countries. SuccessFactors handled HR processes for the 75,000-strong global workforce. The SAP relationship extended back more than 18 years, with licensing agreements accumulated through multiple procurements, acquisitions, and technology refreshes.

SAP initiated a formal licence audit under the company’s software licensing agreement. After four months of data collection through SAP’s License Administration Workbench (LAW) measurements and manual review, SAP presented an audit report claiming USD 15 million in non-compliance fees. The claim was structured across three categories: indirect access and digital access violations (USD 8.2 million), unlicensed and misclassified named users (USD 4.5 million), and entitlement shortfalls related to outdated licensing agreements (USD 2.3 million).

The timing was particularly challenging. The manufacturer was in the midst of a major supply chain modernisation programme and evaluating a transition to S/4HANA. A USD 15 million unplanned compliance liability threatened to derail both initiatives. The company engaged Redress Compliance to challenge SAP’s findings and negotiate a resolution that protected both its financial position and its strategic technology roadmap.

🍞

75,000+ Employees

A global workforce spanning manufacturing plants, distribution centres, corporate offices, and field sales — with significant seasonal fluctuation due to harvest cycles and peak production periods.

🏭

30+ Manufacturing Plants

SAP ECC managed production planning, materials management, quality control, and batch traceability across every plant — critical for food safety compliance and regulatory reporting.

🌐

Global Distribution

SAP SCM coordinated logistics across retail, foodservice, and export channels in 45+ countries. Thousands of external partners, distributors, and co-manufacturers interacted with SAP-managed data through various integration points.

📄

18+ Years of SAP Agreements

Licensing entitlements spread across multiple procurement cycles, two acquisitions, and several technology refreshes — creating the documentation complexity that SAP audits exploit to claim entitlement shortfalls.

2. Understanding SAP’s Audit Methodology and Its Weaknesses

SAP’s audit approach relies on LAW measurements that count every user account with any system activity, combined with manual review of system interfaces and data flows. While the methodology captures deployment breadth, it systematically inflates compliance claims through several well-documented weaknesses that consistently appear in food manufacturing audits.

Weakness 1

Indirect Access Over-Counting

SAP’s audit methodology counts every external system or interface that reads from or writes to the SAP database as requiring named-user licences for every individual who could theoretically access the data. In food manufacturing, this captures customer ordering portals, supplier quality management interfaces, distributor inventory platforms, and IoT sensor feeds from production lines — none of which represent individual human users interacting with SAP in the traditional sense. This methodology routinely inflates indirect access claims by 60–80%.

Weakness 2

Seasonal Workforce Misclassification

Food manufacturers have significant seasonal workforce fluctuation. Peak harvest and production periods can temporarily increase the workforce by 20–40%. SAP’s LAW measurement captures every user account that has been active during the measurement period, including seasonal workers who may have had SAP access for only 2–3 months. These accounts are counted as full Professional or Limited Professional users requiring year-round licences.

Weakness 3

Legacy Agreement Entitlement Gaps

When companies have 15+ years of SAP procurement history including acquisitions, SAP’s current records frequently fail to capture all historical entitlements. Licences purchased through resellers, bundled in acquisition agreements, or included as part of technology refresh deals may be absent from SAP’s entitlement database. The resulting “shortfalls” are documentation failures, not genuine compliance gaps.

3. Our Approach: Systematic Audit Deconstruction

We structured our engagement across four phases, each targeting a specific dimension of SAP’s audit claim with independently verified evidence. The approach was designed to challenge SAP’s inflated findings systematically while identifying the genuine (if modest) compliance gaps that required resolution.

1

Phase One: Audit Report Analysis (Weeks 1–4)

We conducted a line-by-line review of SAP’s audit report, cross-referencing every claimed shortfall against the manufacturer’s actual licensing agreements, purchase records, and deployment data. We catalogued every indirect access claim, identified every user account classification, and mapped every entitlement shortfall against historical procurement documentation spanning the full 18-year SAP relationship.

2

Phase Two: Usage Validation and Independent Measurement (Weeks 4–8)

We worked with the manufacturer’s IT and operations teams to independently validate every deployment metric. This included analysing 62,000+ SAP user accounts to determine actual usage patterns (transaction frequency, module access, role assignments), mapping all external system interfaces and data flows to determine which genuinely required named-user licensing versus those eligible for digital access or exemption, and reviewing seasonal employment records against SAP account activation and deactivation histories.

3

Phase Three: Corrected Compliance Report and Negotiation (Weeks 8–14)

We compiled our findings into a comprehensive corrected compliance report — an 85-page document challenging SAP’s audit findings across all three claim categories with independently verified data, contract analysis, and technical evidence. This report formed the foundation of our structured negotiation with SAP’s licensing and audit teams.

4

Phase Four: Governance and Optimisation (Weeks 14–16)

Following the settlement, we implemented a compliance governance framework including real-time licence monitoring, role-based access controls optimised for the seasonal workforce, and processes to maintain alignment between entitlements and deployments as the manufacturer progressed toward S/4HANA.

4. Challenge One: Dismantling Indirect Access Claims (USD 8.2 Million)

The indirect access claim was the largest component of SAP’s audit — USD 8.2 million, representing 55% of the total. SAP alleged that external systems interacting with SAP data required named-user licences for every individual who could potentially access the information. Our analysis revealed that the vast majority of these interactions did not constitute licensable indirect access.

🛒

Customer Ordering Portal

SAP claimed that 14,000 retail and foodservice customers accessing the company’s online ordering portal required named SAP licences because the portal created sales orders in SAP. We demonstrated that the portal operated through middleware that created batch order documents — no individual customer ever interacted with the SAP system directly. We proposed digital access licensing at a fraction of the named-user cost, reducing this component from USD 3.8 million to USD 220,000.

🚚

Distributor Inventory Platform

The manufacturer’s distributor portal allowed 2,200 distributors to check inventory availability and delivery schedules. SAP counted each distributor as requiring a Limited Professional licence. Our data flow analysis confirmed this was a read-only API interface — distributors queried inventory data but never created, modified, or processed any SAP transactions. Read-only data retrieval through an API does not constitute indirect access under the manufacturer’s agreement terms.

🌡

IoT Production Line Sensors

SAP’s audit included 850 IoT temperature and humidity sensors on production lines that fed quality control data into SAP QM (Quality Management). SAP argued these represented 850 “users” requiring licences. We demonstrated that automated sensor data feeds are machine-to-machine interfaces, not user interactions. No human accesses SAP through these sensors. This claim was entirely without merit and was withdrawn in full — removing USD 1.4 million from the audit.

Indirect Access Resolution

From USD 8.2 Million to USD 340,000: A 96% Reduction

SAP’s position: 14,000 portal customers, 2,200 distributors, 850 IoT sensors, and 1,800 supplier quality system users all required named SAP licences, totalling USD 8.2 million.

Our corrected position: The customer ordering portal qualified for digital access licensing (USD 220,000). The distributor platform was read-only API access, exempt under the agreement. IoT sensors were machine-to-machine, not user access. Supplier quality interfaces involved 180 genuine users (not 1,800) who needed Limited Professional licences, valued at USD 120,000.

Settlement: SAP accepted our corrected indirect access analysis. The USD 8.2 million claim was reduced to USD 340,000 — comprising digital access licensing for the customer portal and Limited Professional licences for the 180 genuine supplier quality users.

5. Challenge Two: Correcting User Licence Misclassification (USD 4.5 Million)

SAP claimed USD 4.5 million for unlicensed and misclassified named users. The LAW measurement had identified 62,000+ user accounts, of which SAP alleged 12,800 required higher-tier licences than the manufacturer held. Our analysis revealed that the true shortfall was a fraction of SAP’s claimed figure.

User Classification Discrepancies Identified and Resolved

Seasonal workers counted as permanent users: 4,200 user accounts belonged to seasonal workers who accessed SAP for 2–4 months during peak production periods. SAP counted these as full-year Professional users. We demonstrated through employment records and SAP login histories that these accounts were active for an average of 11 weeks. We negotiated seasonal licensing provisions that reduced the annual cost from approximately USD 1.9 million (if licensed as permanent Professional users) to USD 280,000.
Dormant and departed employee accounts: 3,600 user accounts belonged to employees who had left the company or were on long-term leave. These accounts had not been deactivated in SAP but showed zero transaction activity during the audit period. SAP counted them as requiring active licences. We provided HR termination records and SAP activity logs demonstrating these were phantom accounts — removing approximately USD 1.4 million from the claim.
Professional users reclassified from single transactions: 2,800 users had been reclassified by SAP from Limited Professional to Professional based on one or two transactions in Professional-tier modules (typically a single accidental navigation into a Finance transaction). We analysed transaction logs showing these were incidental, non-recurring events — not sustained use of Professional-tier functionality. The genuine Professional-tier users numbered approximately 400.
Test and training accounts: 1,200 accounts were test, training, or demo users created for internal SAP training programmes and system testing. These accounts were not production users and did not require commercial licences under the agreement’s Authorised Use provisions.
Genuine user licence shortfall: After resolving all classification errors, the genuine shortfall was approximately 800 users who required licensing adjustments: 400 genuinely requiring Professional-tier upgrade and 400 requiring new Limited Professional licences for roles created during a recent organisational restructuring.

6. Challenge Three: Recovering Legacy Entitlements (USD 2.3 Million)

SAP claimed USD 2.3 million for entitlement shortfalls — products the manufacturer was allegedly running without sufficient licences. Our investigation into the company’s 18-year procurement history revealed that the majority of these “shortfalls” were documentation gaps in SAP’s records, not genuine compliance failures.

📄

Acquisition Entitlements Not Credited

The manufacturer had acquired a regional food company in 2019 that held its own SAP licences worth approximately USD 900,000 in entitlement value. These licences had never been consolidated into the parent company’s SAP agreement. We provided the acquisition agreement, the acquired company’s SAP licence certificates, and evidence of continuous maintenance payments. SAP acknowledged the entitlements, removing USD 900,000 from the claim.

📝

Technology Refresh Bundle Entitlements

A 2018 technology refresh agreement included bundled licences for SAP Business Warehouse and SAP Process Integration that SAP’s current records did not reflect. The original agreement explicitly granted these entitlements as part of a platform upgrade package. We presented the original contract documentation, reducing the claim by approximately USD 650,000.

🔄

Legacy Module Entitlements

SAP counted usage of certain SCM modules as separate licensable products. Our contract review confirmed these modules were included components of the manufacturer’s SAP SCM licence bundle purchased in 2014. This single misclassification accounted for approximately USD 480,000 of the entitlement claim.

Genuine Entitlement Gap

After recovering all historical entitlements, the genuine shortfall was limited to approximately USD 160,000 — additional SuccessFactors Employee Central licences required for a workforce expansion that had outgrown the original provisioning.

7. Negotiation: From USD 15 Million to USD 1.2 Million

With our 85-page corrected compliance report establishing the verified position across all three claim categories, we entered structured negotiations with SAP’s licensing and audit teams over four weeks. The negotiation strategy combined technical evidence with commercial context and forward-looking value to achieve the optimal outcome for the manufacturer.

Strategy 1

Lead with the Corrected Report

We presented the corrected compliance report as a unified technical document addressing every line item in SAP’s audit. The report’s credibility — backed by independently verified data flow analyses, employment records, transaction logs, and original contract documentation — shifted the negotiation from SAP’s inflated USD 15 million claim to our verified position as the starting point for discussion.

Strategy 2

Frame the S/4HANA Migration Opportunity

The manufacturer was evaluating a transition to S/4HANA — a multi-million-dollar investment that represented significant future revenue for SAP. We framed the audit resolution as an opportunity to preserve a commercial relationship that would generate far more value through S/4HANA than through punitive audit penalties. Alienating a customer on the cusp of a major platform investment was not in SAP’s long-term interest.

Strategy 3

Offer Genuine Remediation Plus Growth

We acknowledged the genuine compliance gaps (800 user licences + USD 160,000 SuccessFactors shortfall + digital access licensing) and proposed a settlement that combined remediation of actual shortfalls with pre-negotiated S/4HANA migration credits. The manufacturer paid for what it genuinely needed while securing favourable terms for the investment it planned to make.

Claim CategorySAP ClaimVerified PositionReduction
Indirect access / digital accessUSD 8.2MUSD 340K96%
User licence misclassificationUSD 4.5MUSD 580K87%
Entitlement shortfallsUSD 2.3MUSD 280K88%
TotalUSD 15.0MUSD 1.2M92%
“Redress Compliance’s support during our SAP audit was critical in mitigating financial risks and strengthening our compliance processes. Their expertise not only saved us millions but also ensured our licensing strategy aligned with our growth plans. We are now better prepared for the future.” — CFO, US Food Manufacturer

8. Governance Implementation: Preventing Future Audit Exposure

The settlement resolved the immediate liability, but the manufacturer needed a governance framework that would prevent similar exposure from recurring — particularly as the company progressed toward S/4HANA and continued expanding its digital supply chain.

💻

Real-Time Licence Monitoring

We deployed automated monitoring that tracked SAP user account status, transaction activity, and licence type alignment in real time. The system generated alerts when user counts approached entitlement thresholds, when new interfaces were created that might trigger indirect access requirements, and when seasonal worker accounts were not deactivated within five business days of contract end.

👥

Seasonal Workforce Controls

We designed role-based access templates for seasonal workers that automatically assigned the correct licence type (Limited Professional or Employee Self-Service) based on job function, and automatically deactivated accounts based on employment contract end dates synchronised from SuccessFactors. This eliminated both the over-licensing and the phantom-account exposure that had contributed to SAP’s inflated claim.

🔗

Indirect Access Register

We created a comprehensive register documenting every external system that interfaced with SAP, including the data flow type (read-only, transactional, batch), the licensing treatment (named user, digital access, exempt), and the business owner responsible for maintaining the interface. Any new integration required review against this register before deployment.

🎓

Training and Internal Audit Process

We delivered training for IT, procurement, and operations teams covering SAP licensing fundamentals, indirect access rules, and the seasonal workforce lifecycle. We established quarterly internal licence reviews and an annual independent assessment to ensure ongoing compliance as the SAP estate evolved.

9. Key Lessons: What Every Food Manufacturer Should Learn

This engagement reinforced patterns that are consistent across food and beverage manufacturer SAP audits. The specific figures vary, but the structural dynamics — inflated indirect access claims driven by supply chain integrations, seasonal workforce misclassification, and legacy entitlement documentation gaps — appear in virtually every major food manufacturer audit we defend.

🔍

1. Indirect Access Is the Highest-Value Battleground

Indirect access claims accounted for 55% of this audit (USD 8.2M of USD 15M) and were reduced by 96%. Food manufacturers with customer portals, distributor platforms, supplier interfaces, and IoT production systems are particularly exposed. Every external integration should be documented, classified, and defended proactively — before an audit turns it into a multi-million-dollar claim.

👥

2. Seasonal Workforce Requires Specific Controls

4,200 seasonal worker accounts contributed USD 1.9 million to SAP’s claim in this audit. Food manufacturers with harvest-cycle, seasonal-production, or campaign-driven workforce fluctuations must implement automated account lifecycle management that activates and deactivates SAP access in sync with employment contracts. Without these controls, every seasonal worker becomes a full-year licence liability.

📄

3. Historical Entitlements Are Hidden Gold

USD 2.03 million in legitimate entitlements were missing from SAP’s records — acquired company licences, technology refresh bundles, and included module components. Every food manufacturer with 10+ years of SAP history and any acquisitions should conduct a comprehensive entitlement archaeology exercise before their next audit or renewal.

🤖

4. IoT and Automation Are Not Users

SAP claimed USD 1.4 million for 850 IoT sensors that fed data into SAP QM. Automated machine-to-machine data feeds do not constitute user access. As food manufacturers deploy more IoT, sensor, and automation technology, ensuring that SAP’s audit methodology does not misclassify these as licensable users becomes increasingly important.

💰

5. Frame Audits in the Context of Future Investment

The manufacturer’s planned S/4HANA migration was a powerful negotiation lever. SAP’s long-term revenue from a successful platform transition far exceeded any one-time audit penalty. Positioning the audit resolution as a prerequisite for continued investment — rather than a punitive endpoint — consistently yields better outcomes.

🤝

6. Independent Advisory Delivers Outsized Returns

The advisory investment represented approximately 2% of the USD 13.8 million in claim reduction achieved. Without independent technical analysis and negotiation expertise, the manufacturer would have been negotiating from SAP’s inflated USD 15 million position. The information asymmetry between SAP’s audit team and an unrepresented customer is substantial and consistently works in SAP’s favour.

10. Why Independent Advisory Transforms SAP Audit Outcomes

SAP audits in the food manufacturing sector are high-stakes engagements where the initial claim routinely exceeds the verified compliance position by 5–10x. Independent advisory closes the information and expertise gap that gives SAP a structural advantage, ensuring the manufacturer negotiates from a position of independently verified data rather than SAP’s inflated audit findings.

In this engagement, the manufacturer’s internal IT and procurement teams were capable but lacked the specific SAP licensing expertise needed to challenge indirect access calculations, reclassify user accounts against SAP’s complex user type hierarchy, recover historical entitlements from 18 years of agreement documentation, and negotiate from a position of verified data. The difference was USD 13.8 million.

Value 1

SAP Licensing Expertise

Redress Compliance’s team includes professionals with deep SAP licensing knowledge who understand SAP’s audit methodology, LAW measurement behaviour, indirect access rules, digital access licensing options, and user classification frameworks. This expertise identifies errors that SAP’s audit team will not acknowledge without specific, technically grounded challenges.

Value 2

Food Manufacturing Sector Knowledge

We understand the specific SAP licensing challenges in food manufacturing: seasonal workforce dynamics, supply chain partner integrations, IoT and production automation interfaces, food safety regulatory systems, and the complex data flows between SAP and external platforms. This sector knowledge enables targeted audit defence strategies that address the specific vulnerabilities SAP exploits in food manufacturer audits.

Value 3

Complete Vendor Independence

Redress Compliance has no commercial relationship with SAP — no partner status, no licence resale revenue, no referral commissions. Our recommendations are exclusively aligned with our clients’ interests. This independence is particularly important in audit defence, where advisory firms with SAP partnerships may face conflicts between their client’s interests and their vendor relationship.

“SAP audit claims against food manufacturers are overstated by 50–90% in virtually every engagement we defend. The combination of supply chain integrations misclassified as indirect access, seasonal workers counted as permanent users, and historical entitlements missing from SAP’s records creates a structural inflation that only independent technical analysis and negotiation expertise can counter.”

Frequently Asked Questions

How common is it for SAP audit claims against food manufacturers to be overstated?
Very common. In our experience, initial SAP audit claims against food manufacturers are overstated by 50–90%. Food manufacturers are particularly exposed because their operations involve extensive external integrations (customer ordering portals, distributor platforms, supplier quality systems, IoT sensors) that SAP classifies as indirect access, plus significant seasonal workforce fluctuations that inflate user counts. Independent verification consistently reveals that the genuine compliance shortfall is a fraction of the initial claim.
What is indirect access in SAP licensing, and why is it such a large audit category?
Indirect access occurs when users or systems interact with SAP data through a non-SAP interface — such as a customer ordering portal, a distributor inventory platform, or a third-party application that reads or writes SAP data. SAP has historically argued that every individual who could potentially access data through these interfaces requires a named SAP licence. In 2018, SAP introduced digital access licensing as an alternative, allowing customers to pay based on document types created rather than named users. In food manufacturing, where thousands of customers, distributors, and suppliers interact with SAP-managed data through portals and APIs, indirect access is consistently the largest audit claim category.
Do IoT sensors and automated production systems require SAP licences?
No. Automated machine-to-machine data feeds — such as IoT temperature sensors, production line monitors, and automated quality control systems — do not constitute user access under SAP’s licensing terms. However, SAP audits frequently include these systems in their counts. In this engagement, 850 IoT sensors were counted as “users” requiring licences worth USD 1.4 million. We challenged this classification successfully, and the claim was withdrawn entirely. Any food manufacturer with IoT or automation systems feeding data into SAP should proactively document these as machine-to-machine interfaces.
How should food manufacturers handle seasonal worker SAP licensing?
Seasonal workers should be managed through automated account lifecycle controls synchronised with employment contracts. Accounts should be activated when the seasonal employee starts and automatically deactivated within five business days of contract end. The licence type should match the worker’s actual SAP usage (typically Limited Professional or Employee Self-Service, not Professional). Without these controls, seasonal workers are counted as full-year Professional users — in this case, 4,200 seasonal accounts contributed USD 1.9 million to SAP’s inflated claim.
Can historical entitlements from acquisitions be applied to current SAP audits?
Yes. When you acquire a company that holds SAP licences, those entitlements transfer to the acquiring entity (subject to contract terms and proper notification to SAP). However, SAP’s records frequently fail to capture acquired entitlements, particularly if the acquisition occurred years earlier or the acquired company’s SAP licences were purchased through a different channel. In this case, USD 900,000 in acquisition entitlements were missing from SAP’s records. Comprehensive entitlement archaeology — reviewing all historical procurement documentation — is an essential audit defence activity.
How long does an SAP audit defence engagement typically take?
Typically 14–18 weeks from initial engagement to settlement. The phases are: audit report analysis (3–4 weeks), usage validation and independent measurement (3–4 weeks), corrected compliance report and negotiation (4–6 weeks), and governance implementation (2–3 weeks). We recommend engaging advisory support as early as possible — ideally when the audit notification is received, before submitting LAW data to SAP.
Does Redress Compliance have any commercial relationship with SAP?
No. Redress Compliance is a 100% independent advisory firm with no commercial relationship with SAP or any other software vendor. We do not resell SAP licences, hold SAP partner status, or earn referral commissions. This complete vendor independence ensures our audit defence, licensing analysis, and negotiation recommendations are exclusively aligned with our clients’ interests.

Facing an SAP Audit? Let’s Talk.

Redress Compliance delivers independent SAP audit defence for food manufacturers and enterprises worldwide — challenging inflated indirect access claims, correcting user misclassification, recovering historical entitlements, and negotiating settlements that reflect actual compliance positions. USD 15 million reduced to USD 1.2 million for this manufacturer. Complete vendor independence.

Related Resources

FF

Fredrik Filipsson

Fredrik Filipsson is the co-founder of Redress Compliance, a leading independent advisory firm specialising in Oracle, Microsoft, SAP, IBM, and Salesforce licensing. With over 20 years of experience in software licensing and contract negotiations, Fredrik has helped hundreds of organisations — including numerous Fortune 500 companies — optimise costs, avoid compliance risks, and secure favourable terms with major software vendors. He built his expertise over two decades working directly for IBM, SAP, and Oracle before founding Redress Compliance 11 years ago.