Editorial photograph of a finance and procurement team reviewing an SAP audit position in a meeting room
SAP / Audit Defense

US Food Manufacturer SAP audit defense. 89 percent exposure reduction.

A leading US food manufacturer faced an SAP measurement claim with a seven figure number on the table. A clean usage baseline and a named user reclassification took the final exposure down by 89 percent.

Contact Us SAP Practice
500+Enterprise clients
$2B+Under advisory
Industry Recognized
500+ Enterprise Clients
$2B+ Under Advisory
11 Vendor Practices
100% Buyer Side Independent

A leading US food manufacturer faced an SAP measurement claim with a seven figure number on the table. A clean usage baseline, a named user reclassification, and a document level audit took the final exposure down by 89 percent.

Key takeaways

  • The first SAP measurement number is a starting position, not a settled liability.
  • Named user overclassification was the single largest driver of the initial claim.
  • Indirect access counted duplicate and system generated documents that did not belong in the count.
  • A defensible usage baseline reframed the entire negotiation in the buyer favor.
  • The final settlement landed 89 percent below the opening SAP claim.
  • No new SAP licenses were purchased to close the audit.
  • The reclassification and document audit, not a discount fight, did most of the work.

This engagement followed that pattern. The manufacturer ran SAP ECC across finance, supply chain, and plant operations. A routine measurement turned into a large compliance claim. The number looked alarming. It was also soft.

What did the SAP audit actually claim?

SAP opened with a measurement based on the USMM and LAW output plus a digital access estimate. The combined claim implied a seven figure true up.

The named user line

Most of the claim sat in Professional user licenses. The measurement assigned the highest type to thousands of accounts, including dormant and shared ones.

The digital access line

The second large line was indirect, or digital, access. SAP counted documents created through connected systems. The count was high and unexamined. SAP publishes the model in its ERP product documentation, and the commercial terms sit in the SAP software agreements.

The method gap

The measurement reflected configuration, not real use. That distinction is the whole ballgame. A measurement counts what the system can do. A baseline counts what people and processes actually did.

How did a clean usage baseline change the position?

We rebuilt the usage picture independently before responding. The baseline pulled twelve months of activity and scored every account against contracted scope.

Building the baseline

We profiled login frequency, transaction depth, and module access per account. Dormant and duplicate accounts were tagged and removed from the chargeable population.

Reclassifying users

Each remaining account was mapped to the lowest license type its real activity supported. Many Professional accounts moved to limited or employee self service types.

From SAP claim to settled position

Line item SAP opening claim After baseline Driver
Professional usersVery highSharply reducedReclassification to lower types
Limited and self serviceUnderstatedRight sized upHonest classification
Digital access documentsLarge, unexaminedMaterially lowerDuplicate and system records removed
Net exposureSeven figures89 percent lowerBaseline plus document audit

Which named user reclassifications cut the exposure?

Named user type is where most SAP audit value is won or lost. The rules are precise and the buyer controls the evidence.

The type ladder

  • Professional: full operational use. The most expensive type and the most overassigned.
  • Limited or functional: bounded transaction sets. A large share of accounts belong here.
  • Employee self service: the lowest type, for occasional self service tasks.

Evidence wins reclassification

SAP accepts reclassification when the activity record supports it. The named user definitions sit in the SAP software use rights. We documented each move with usage data, which made the lower types defensible rather than asserted.

Where the common advice on SAP audit defense is wrong

The standard advice from many resellers, and sometimes from the account team, is to accept the measurement output from USMM and LAW at face value and negotiate only the discount. We disagree. In roughly nine out of ten SAP audits we defended, the raw measurement counted users and documents that did not belong in the claim, and the real work was correcting the baseline, not haggling on price. The buyer side move is to rebuild the usage picture independently, challenge every classification and every counted document, and only then discuss commercial terms against a number you can defend.

Editorial photograph of a procurement and finance team reviewing SAP license measurement data on a shared screen
A reclassification holds only when each move is backed by the activity record. Asserted types collapse under SAP review; evidenced types survive.
89%
Final exposure reduction
52%
Median named user overclaim removed
30+
SAP audits defended 2024 to 2025

Source: Redress Compliance advisory engagement file, 2024 to 2025.

A measurement counts what the system can do. A baseline counts what your people actually did. The gap between the two is where the audit is won.

How did the indirect access exposure get resolved?

The digital access line fell once we audited the documents behind it. Counting rules matter as much as the headline number.

Removing duplicates

Many counted documents were duplicates or internal system records. Under the digital access model these should not inflate the chargeable count.

Choosing the path

With a clean document count, the conversion math improved sharply. The manufacturer kept its named user position where it was cheaper and converted only where the S/4HANA digital access route made sense.

What did this engagement teach about SAP audit defense?

Five lessons carry to almost every SAP audit.

  • Respond slow, prepare fast: never react to the opening number before the baseline is built.
  • Classification beats discount: the largest savings come from correct user types, not a bigger percentage off.
  • Audit the documents: digital access counts are routinely inflated by duplicates.
  • Evidence everything: every reclassification needs an activity record behind it.
  • Independence pays: a buyer side baseline reframes the whole conversation.

Suggested reading

What should a buyer do next?

  1. Freeze the response. Acknowledge the audit but commit to no number yet.
  2. Pull twelve months of usage data across every SAP module in scope.
  3. Build an independent baseline and tag dormant, shared, and duplicate accounts.
  4. Reclassify every account to the lowest type its activity supports, with evidence.
  5. Audit the digital access document count and remove duplicates and system records.
  6. Rebuild the exposure against the defensible baseline before any commercial talk.
  7. Negotiate terms against the corrected number, not the opening claim.
  8. Engage independent SAP advisory before signing any settlement.

Frequently asked questions

Is the first SAP audit number final?

No. The first SAP measurement number is an opening position, not a settled liability. It reflects system configuration rather than real use, and it almost always falls once a clean usage baseline corrects user classification and the digital access document count.

What drove most of the exposure in this case?

Named user overclassification drove most of the claim. Thousands of accounts carried the Professional type when their actual activity fit a limited or employee self service type. Reclassifying them with evidence removed the largest share of the exposure.

How can named users be reclassified during an audit?

Named users can be reclassified when activity data supports a lower type. We profile login frequency, transaction depth, and module access per account, then map each account to the lowest type its real use justifies, documenting every move so SAP can verify it.

Why was the digital access count too high?

The digital access count was too high because it included duplicate and system generated documents. Under the model SAP publishes, internal and duplicate records should not inflate the chargeable count, so auditing the documents reduced the line materially.

Did the manufacturer buy new SAP licenses?

No new licenses were purchased to close the audit. The 89 percent reduction came entirely from correcting the baseline, reclassifying users, and auditing the digital access documents, not from buying additional entitlements.

How long does a defense like this take?

A defense of this size usually runs two to four months. Most of the time goes into building the independent baseline and assembling the activity evidence, which is the work that makes the lower numbers defensible.

What is USMM and why does it matter?

USMM is the SAP self measurement program that produces the license count, consolidated by LAW. It matters because its output is the starting claim. Reading it critically, rather than accepting it, is the first step in any SAP audit defense.

Can these results be repeated at other companies?

Results vary, but the method repeats. Across 30 to 40 SAP audits we defended in 2024 and 2025, a clean baseline, evidenced reclassification, and a document audit consistently cut the opening claim by a large margin.

SAP RISE Negotiation Guide

The full SAP RISE negotiation guide from the SAP Practice.

SAP RISE pricing benchmarks, the CVR framework, indirect access posture, and the buyer side moves across the full SAP estate.

Used across more than five hundred enterprise engagements. Independent. Buyer side. Built for procurement leaders running the next renewal cycle.

No spam. We will only email you about this download. Privacy.
Run the SAP RISE TCO calculator against your estate in under five minutes.
Open the Tool →

The opening SAP audit number is a negotiating posture. A buyer side baseline turns it back into a fact based conversation, and the fall from the first claim is almost always large.

Fredrik Filipsson
Co Founder and Group CEO, Redress Compliance