SAP audit readiness in 2026. Twelve months of work before the letter arrives.

An SAP audit settlement can land anywhere from zero to 15 to 30 percent of next year's contract value. Twelve months of preparation on users, indirect access and engines decides where you land.

The eight to ten months after an SAP audit letter arrives decide what you pay, and the settlement becomes the starting point for your next renewal. For the wider SAP picture, see the SAP knowledge hub and our SAP advisory practice.

How often does SAP audit customers, and what brings an audit forward?

Expect a full SAP license audit every 3 to 5 years, plus a request to run and submit a system measurement, which most on premises customers receive every year. SAP schedules audits by its audit team's workload and each customer's profile, and five situations move a customer up the list ahead of the normal rotation.

The five SAP audit triggers and what to do about each

• Mergers and acquisitions. A new legal entity in your SAP systems raises audit interest. Map the acquired users to your license types before the deal closes.
• Headcount growth. A material rise in users without a matching license purchase prompts an audit. Reconcile the user list against your entitlement every quarter.
• Integration projects. A new third party system connecting to SAP raises the indirect access question. Document the integration design, including the SAP documents it creates, before go live.
• RISE with SAP conversations. SAP often runs a license measurement before it prepares a RISE proposal. Read the measurement clause in any RISE paperwork carefully, and see our RISE negotiation reference for the commercial side.
• Existing indirect access exposure. Bots, mobile apps and customer portals that call SAP may each consume a license. Map that traffic before SAP does.

What do USMM and LAW measure, and what goes to SAP?

USMM, the system measurement transaction, runs on each SAP system and counts named users by license type. The License Administration Workbench (LAW, or SLAW in current releases) consolidates those results across all your SAP systems and produces the file SAP receives. Both reports go to SAP at the audit window.

Engine consumption is counted separately from users, through engine measurement programs or, for some engines, your self declaration. Our guide to USMM, LAW, SLAW and STAR covers the tooling in more detail, and the engine and package license guide covers engine metrics.

How to run a USMM dry run

Run it every quarter, on the systems SAP will ask about. It finds inactive users, wrong license types and duplicates across systems, and takes about one week of internal effort.

1. Pull last logon dates for dialog users with report RSUSR200 or the user information system (SUIM), and lock dormant accounts.
2. Check the license type on the License Data tab in SU01 for every active user. SAP typically treats unclassified users as Professional, the most expensive common type.
3. Compare each user's actual activity with the user type definitions in your own contract.
4. Consolidate in LAW so a person with accounts on several systems counts once.
5. List technical users (system, communication and service types) and what each does. Busy communication users are where indirect access questions start.

Worked example: what a dry run changes in a 4,000 user count

Say a company holds 2,400 Professional, 600 Limited Professional and 800 Employee licenses. Its raw measurement shows 4,000 dialog users, all left at the Professional default. On paper that is a shortfall of 1,600 Professional users, and that is the number an audit report would start from.

After cleanup the company needs 2,050 Professional licenses and holds 2,400, a surplus of 350. A higher user type can normally cover a lower one, so 300 of that surplus covers the 900 Limited Professional users against 600 licenses. The 600 Employee users fit inside 800. The shortfall disappears without a purchase.

Where does SAP indirect access exposure come from?

The exposure comes from third party systems that read from or write to SAP, which SAP calls indirect access. The classic case is a customer portal that writes orders into SAP's sales order tables. It is usually the largest item in an SAP audit, and the accuracy of your documentation decides the outcome.

How to build the indirect access traffic map

For every third party system that calls SAP, record the calling identity, the document type it creates and the annual volume. Score the result under both the named user model and the digital access document model. The lower number becomes your negotiating position.

• Interfaces. IDoc, BAPI, RFC and OData connections, with the technical user each one runs under.
• Middleware. Platforms that pass many external users through one SAP account. SAP counts the users behind them.
• Portals and apps. Customer, supplier and employee portals and mobile apps.
• Automation. Robotic process automation bots and scheduled jobs from outside SAP that post transactions.

Do this twelve months before an expected letter, while the numbers are still yours to set. Our SAP indirect access guide goes further into the legal and commercial history.

How does the SAP digital access conversion work, and when does it pay?

SAP introduced the digital access document license in 2018 as the alternative to counting indirect users as named users. Instead of licensing the people or systems behind an integration, you license the documents those systems create in SAP. Converting is a one time commercial decision, and there are three ways to handle it.

1. The Digital Access Adoption Program (DAAP). SAP discounts digital access by up to 90 percent for customers who convert voluntarily. The discounted option requires you to license at least 100 percent of your current estimated document use, measured first. It does not apply to SAP S/4HANA Cloud, and SAP can withdraw it, so confirm current terms in writing. See our DAAP evaluation guide.
2. Conversion inside an audit settlement. SAP will discount the conversion as part of settling an audit, but the discount is lower than under DAAP.
3. No conversion. You stay on the named user model. The exposure remains, and the next audit reopens the same question.

Only the initial creation of a document counts. Reading, updating or deleting a document does not, and sales, invoice, purchase, material and financial documents are counted at line item level. The digital access document guide explains each type.

Worked example: scoring a customer portal under both models

Say a distributor runs a portal that writes 40,000 sales orders a year into SAP, averaging 3 line items each, and posts 30,000 goods movements a year with 2 line items each. Under digital access, the count looks like this.

Under the named user model, SAP may open by claiming a named user for each of the 2,500 customer accounts placing orders. Price both totals at your contract rates. If digital access for 132,000 documents were quoted at $1,000,000, a 90 percent DAAP discount brings it to $100,000, the figure to compare with the named user claim.

Why we do not tell every client to convert to digital access

The usual advice is to convert to digital access quickly to close the indirect access question. We disagree until the scoring is done. Conversion happens once, DAAP makes you license your full measured volume, and a portal with few users but heavy volume can cost less under named users. Convert only where digital access is cheaper.

How long does an SAP audit take, from letter to settlement?

From audit letter to settlement typically takes eight to ten months. The settlement window itself is short: 6 to 8 weeks once SAP issues its gap report. That is why the response needs to be planned before the letter arrives.

What SAP's audit team will say, and what to say back

• "This is a routine measurement, not an audit." Ask in writing what the results will be used for. They feed the same compliance review, so give them the care you would give an audit.
• "Please submit the measurement as it stands." Classifying users is your job under the contract. Submit after your review, with the reasoning documented.
• "Every portal customer needs a named user." Ask SAP to identify the specific integrations and documents behind the claim, and ask for a digital access quote under DAAP for comparison.
• "The finding goes away if you sign RISE this quarter." Keep the finding and the offer separate. Verify the gap report first, then judge the cloud deal on its own merits.

Treat every measurement you send SAP as audit evidence, whatever SAP calls the request.

What have we seen in the SAP audits we have worked on?

The range of outcomes is wide. A well prepared customer settles at zero, while an unprepared one settles at 15 to 30 percent of the next year's contract value. When we build the filing independently from the same systems, it usually lands 20 to 50 percent below the figure SAP's own analysis produces.

The difference comes mostly from users left at the Professional default, inactive and duplicate accounts, and undocumented indirect access. All of it is fixable before the letter.

Common mistakes that raise the settlement

• Submitting the raw measurement. Unreviewed USMM output leaves every unclassified user at the Professional default.
• Letting SAP define the scope. Agree in writing which systems, entities and products the audit covers before data leaves your hands.
• Treating technical users as harmless. Communication users with heavy traffic are where SAP builds indirect access claims.
• Negotiating the settlement and the renewal in one conversation. SAP folds the finding into a larger deal, and you lose sight of what the compliance gap was worth.
• Forgetting engines. Engine metrics and self declarations are reviewed separately from users, and an outdated declaration can produce a finding of its own.

What should a twelve month SAP audit readiness program include?

A readiness program runs over twelve months, with a defined output each quarter. By the end you know your position, have the evidence to support it and have rehearsed the response.

• Q1. USMM dry run, lock of inactive users, reclassification of license types.
• Q2. Indirect access traffic map, integration design documentation, digital access volume scoring.
• Q3. Engine measurement dry run, review of engine consumption, audit position memo.
• Q4. Independent external validation, a settlement plan and a rehearsal of the filing before it goes to SAP.

How the program differs for a 500 user and a 20,000 user SAP customer

A 500 user company with one ERP system can often finish Q1 and Q2 in a few weeks. Its exposure usually sits in a few integrations and misclassified users, and one person can own the work.

A 20,000 user group with many SAP systems, several legal entities and past acquisitions needs the full twelve months. LAW consolidation takes real effort and the integration map may run to dozens of interfaces. Assign an owner per system and one person to sign off the consolidated position.

Contract terms to ask for before the next audit

• A notice period and frequency limit on audits. Gives you preparation time and stops audits becoming continuous.
• User type definitions attached to the order form. Classification disputes are then settled by the definitions you signed.
• A written definition of which digital access documents count. Settles in advance whether follow on documents SAP generates itself are counted.
• Credit for unused licenses in any settlement. Allows shelfware to offset a shortfall in another license type.
• Confidentiality and limited use of measurement data. Keeps audit data out of sales proposals.

How Redress works on SAP audit readiness

We run this work inside the Vendor Shield subscription, the Renewal Program, the Benchmark Program and the Software Spend Assessment. Every engagement is led by a former SAP commercial executive working for the customer, supported by our benchmarking data. Read more about us and our locations, see the SAP license audit process guide, or contact us.

What to do next

1. Run a USMM dry run. Repeat it quarterly: lock inactive users, reclassify license types and merge duplicates.
2. Map indirect access traffic. Cover every third party system calling SAP, with its calling identity, document type and volume.
3. Score the digital access exposure. Calculate it under both models and take the lower figure as your position.
4. Document engine consumption. Check measured engines and self declarations, which SAP reviews separately from users.
5. Write the audit position memo. Record your filing position, the supporting evidence and a log of items you expect to dispute.
6. Rehearse the settlement window. Plan the response to the gap report now, before the clock starts.
7. Bring in independent advisors twelve months out. A filing prepared from your own data starts below SAP's figure.

Frequently asked questions