SAP audit preparation toolkit. The ten step buyer side framework.

SAP runs annual audit measurement on every customer carrying an active maintenance agreement. The audit looks like a routine compliance exercise on the surface and behaves like an SAP commercial event in practice. Customers who treat audit measurement as a procurement exercise consistently turn it into a settlement that stays close to actual usage. Customers who treat it as an IT exercise hand SAP an opening to convert technical configuration drift (extra named user roles, indirect access on Salesforce or Workday, Digital Access on bot generated documents, engine consumption above contracted levels) into eight figure settlement bills. This pillar sets out the ten step audit preparation toolkit, the LAW report mechanics, named user mapping discipline, indirect and Digital Access defense, engine usage reconciliation, and the eleven move buyer side response that holds settlements to 15 to 50 percent of the SAP opening position. For surrounding context read the SAP services practice, the SAP knowledge hub, the SAP RISE Negotiation Guide, the SAP Audit Defense Service, and the SAP Indirect Access and Digital Access guide.

The ten step audit preparation toolkit

1. Inventory the SAP estate. Every system, every client, every named user category, every engine.
2. Run LAW (License Administration Workbench) internally. Generate the LAW report 90 days before SAP requests measurement.
3. Reconcile against contract. Compare LAW output line item against the Order Form named user pool and engine entitlements.
4. Cleanse named user assignments. Remove dormant accounts, reclassify users to lowest applicable license type.
5. Document Digital Access exposure. Map every external system that creates or queries SAP documents (orders, deliveries, invoices).
6. Audit engine consumption. Measure HANA memory, BW/4HANA memory, IS-U meter point counts against entitlements.
7. Document mitigations. Where shortfall exists, document remediation plan before submission.
8. Submit clean LAW. Submit the cleansed report as the customer position, not the raw extract.
9. Manage SAP follow up. Respond to SAP queries with documented evidence; resist scope expansion.
10. Negotiate any settlement against forward contract. Convert audit findings to forward consumption commit, not retroactive payment.

The LAW report: control the submission

The License Administration Workbench (LAW) is the SAP tool customers use to consolidate user and engine measurement across their estate. The output is the customer's official submission to SAP for annual audit measurement. Three principles matter. First, the LAW report is the customer's document, not SAP's; the customer chooses when to run it, what to include, and how to classify users. Second, raw LAW output without cleansing routinely overstates licensable consumption by 15 to 30 percent due to dormant users, misclassified roles, and orphan accounts. Third, SAP receives only the LAW output the customer submits; field measurement only happens if SAP escalates beyond LAW review. Run LAW 90 days before SAP requests it, cleanse the output, and submit the cleansed version.

Named user mapping discipline

SAP named user license types follow a hierarchy with material price differential. Professional User (typically $4,500 to $5,500 list per user) sits at the top with full transactional access. Limited Professional User (typically $2,500 to $3,500) covers production line and retail roles. Employee User (typically $250 to $400) covers self service ESS/MSS access. Developer User covers ABAP development access. The buyer side opportunity is to right size every assigned license against actual usage. Three structural patterns drive overcounting: assignment of Professional User where Limited Professional or Employee would suffice; orphan accounts left active after employee departure; users assigned to multiple SAP systems with the highest license type carrying across.

Indirect access defense

Indirect access is the SAP licensing rule that requires a Named User license for any human or system that "uses" SAP, even when accessing through a third party application. The classic example is Salesforce sales reps creating orders that flow to SAP for fulfillment; SAP's position is that every Salesforce user creating those orders requires an SAP Named User license. Indirect access settlements are routinely the largest line in SAP audit findings, sometimes running into eight figures for high transaction volume customers. Two structural defenses matter. First, document every integration architecturally with input volumes and user counts; vague integration scope favors SAP's expansive interpretation. Second, evaluate Digital Access conversion; SAP's Digital Access pricing converts indirect access exposure to per document pricing that is often more favorable than per user.

Digital Access document framework

Digital Access is SAP's 2018 successor licensing model for indirect access. Instead of licensing every external user touching SAP, customers license the documents created by external systems. Nine document types fall under Digital Access: sales documents, invoice documents, purchase documents, service and maintenance documents, manufacturing documents, quality documents, time management documents, financial documents, material documents. Pricing is typically $0.10 to $0.40 per document per year depending on volume tier. The Digital Access model is more favorable than per Named User indirect access for high volume bot driven document creation; less favorable for high user count low volume integrations.

Engine usage reconciliation

SAP engines (HANA database, BW/4HANA, IS-U for utilities, SAP Hybris, etc.) license separately from named users. Each engine has a distinct measurement metric. HANA licenses by memory (typically $5,000 to $7,000 per 64GB block at list). BW/4HANA licenses by memory similarly. IS-U licenses by meter point. The audit measures engine consumption against contracted entitlement. The buyer side preparation is to measure each engine quarterly, document the actual consumption against contract, and resolve any drift before SAP measurement begins.

Audit settlement benchmarks

For settlement modeling, the indicative anchors below reflect what we see on SAP audit settlements in 2026.

• Named user shortfall: Typically settles at 50 to 70 percent of list, often converted to forward commit at renewal
• Indirect access finding: Highly variable; cleansed positions typically settle at 25 to 50 percent of SAP opening claim
• Digital Access conversion: Often more favorable than indirect access; model both before settling
• Engine overconsumption: Typically settles at 60 to 80 percent of list, with HANA the highest leverage
• Audit finding bundled with renewal: Compounds with renewal discount, often delivering net better outcome

How we engage on SAP audit preparation

Redress runs a four phase SAP audit preparation engagement. Phase one is the proactive LAW review, which generates and cleanses the LAW report 90 to 180 days before SAP measurement. Phase two is the indirect and Digital Access exposure assessment, mapping every integration and modeling both pricing options. Phase three is the audit response when SAP measurement begins, managing the LMS engagement and resisting scope expansion. Phase four is the settlement negotiation, converting findings to forward consumption commit where possible and bundling with renewal discount. Read the Vendor Shield program, the SAP Audit Defense Service, and the SAP License Optimization Service.

Independent buyer side advisory

Redress is independent and 100 percent buyer side. Industry recognized, 500 plus enterprise clients, $2B plus under advisory across 11 vendor practices. Read the SAP services practice, the SAP knowledge hub, and the case studies library, or contact us to scope an SAP audit preparation engagement.