SAP license audit survival guide. Measure first, then answer the findings letter.

An SAP license audit starts with a measurement you can run yourself. The findings letter is SAP's opening position, and buyers who measure first, clean their user data and contest the indirect document count settle well below it.

Every SAP license audit ends in a findings letter that proposes a shortfall. That letter is SAP's opening position, and the work you do before you answer it decides most of the final number.

How does an SAP license audit work, from measurement request to findings letter?

It follows a fixed, mechanical sequence. You run USMM, SAP's user and system measurement tool, in each system in scope. The results are consolidated in the License Administration Workbench (LAW), SAP compares the consolidated figures with your contract, and it issues a findings letter with a proposed shortfall.

What does USMM count in each system?

USMM counts dialog users by the license type recorded on the License Data tab of the user master record in SU01. It also reads engine consumption for the packages you license on business metrics instead of users. A few counting rules decide how clean that number is.

• Unclassified users. A dialog user with no license type assigned is measured at the most expensive type, so every gap in classification inflates the count.
• Locked users. Locking an account does not take it out of the measurement. Deleted users, and users whose validity period has ended, are not counted.
• Background users. System and service users that run batch jobs or SAP to SAP connections are normally classified as technical users. Look hard at the ones that post data on behalf of outside systems, because that is where indirect use sits.
• Engines. Engine results sit beside the user count and are compared with the engine metrics in your order form.

What does LAW add to the USMM results?

LAW, delivered as transaction SLAW or SLAW2 in current releases, consolidates the USMM results from every system and counts each person once. It can only merge accounts it can match to the same person, so inconsistent user IDs or names across systems appear as separate people. The consolidated LAW figures are what SAP compares with your entitlement.

Our guide to USMM, LAW, SLAW and STAR covers the tooling and its settings in more detail.

Which SAP named user types get overclassified in an audit?

Professional users are the most common overcount. Many people hold a Professional license, the most expensive type, while they only perform Employee self service tasks or Productivity lookups. Reclassifying them to the correct lower type removes cost the audit assumed, which makes this both the most common finding and the most recoverable one.

SAP defines each user type in its software use rights material, and your order form may carry its own definitions that override them. Map what each person did in the measured period to those definitions and write down the basis for each change. A documented reclassification survives SAP's challenge, while an undocumented one tends to be reversed.

Our guide to SAP named user license types sets out the definitions in full.

Which accounts should not carry a named license at all?

Remove these before you reclassify anyone. Each one is a full license the audit has assumed.

• Dormant accounts. Users with no logon in the measured period. End their validity period or delete them.
• Duplicates across systems. One person with separate accounts in ECC, BW and other systems. Align user IDs or names so LAW merges them into one.
• Technical and test service accounts. Batch, interface and test users that no person logs on with. Classify them under the technical or test type your contract provides.
• Leavers still marked valid. Staff who left before the measurement date but whose accounts were never closed. HR exit dates are your evidence.

Worked example: cleaning a hypothetical 600 user shortfall

Say you hold 2,000 Professional and 500 Employee licenses. The raw measurement shows 2,600 Professional users and 400 Employee users, so the findings letter claims a shortfall of 600 Professional users.

The Employee count rises to 440, still inside the 500 you own, so the reclassification costs nothing. The shortfall falls from 600 to 420 users, a 30 percent reduction, before anyone has discussed price. Every step rests on evidence you produced yourself: logon dates, LAW matching, account purposes and activity records.

How does indirect access drive the SAP audit exposure?

Indirect access is usually the largest dollar line in an SAP audit, 40 to 70 percent of the total exposure in order driven businesses. It is also the most contestable line. The exposure comes from third party systems that read from or write to SAP, and ecommerce platforms, CRM and automation tools are the usual sources.

The Diageo judgment made the risk concrete. In 2017 the UK High Court held that people using Diageo's Salesforce based systems connected to SAP needed named user licenses. Digital access now counts the documents outside systems create instead of the users behind them, so the indirect question becomes a document count you can reconcile.

What should you strip from the raw document count?

SAP's opening number rests on the raw count, which duplicates and follow on records inflate. Only the initial creation of a document by an outside system counts; reading, changing or deleting one does not. SAP's adoption program material concedes that its estimation report counts follow on documents created by the same technical users, which you must adjust out by hand.

The counting rules are set out in our digital access complete guide, and current prices in the SAP indirect access pricing guide for 2026.

SAP publishes digital access estimation reports for ECC and S/4HANA through SAP Notes 2992090 and 2999672. Run them yourself before SAP's team asks, then reconcile the output against your integration inventory. The liability arithmetic is worked through in our indirect access pillar, and the digital access document guide explains each document type.

How does a RISE conversation change the indirect access finding?

SAP account teams may offer to fold the indirect finding into a RISE with SAP conversion while the audit is still open. Agree the document count on its own evidence first, then judge the RISE offer on its own price and terms. The conversion side is covered in our RISE negotiation tactics.

What should your SAP audit response protocol look like?

Measure, clean and contest before you send anything, and send it through one person. These are the five rules we run in every defense, and the fuller method sits in our SAP audit defense guide.

• Measure internally first. Run USMM in a controlled internal pass before you share anything, and read the output the way SAP will read it.
• Clean before you send. Reclassify users, remove dormant, duplicate and technical accounts, and reconcile the indirect document count, so what reaches SAP is a position you have already tested.
• Contest the indirect count. Strip duplicates and follow on records, which converts an open ended argument about indirect use into a specific document total.
• Control the channel. Route all communication with SAP through one owner. An offhand remark from a basis administrator or a project lead can be held against you later.
• Prepare the baseline before the letter. Without one, every disputed number has to be rebuilt under time pressure. A prepared buyer closes the audit in a few months.

What should you do at each stage of the audit?

What will SAP's audit team say, and what should you say back?

• "Please send the measurement results as they are." Classifying users in the measurement is the customer's task. Tell SAP you will submit after your review, with the basis for each classification documented.
• "The tool counted these users, so they stay in." Send the logon records showing no activity in the measured period and ask for those accounts to be removed from the count.
• "Every order from your web shop needs a license." Ask SAP to name the interfaces and document types behind its figure and to show how it counted them. Then reconcile against your own extract.
• "We can make the finding go away inside a larger deal." Keep the two apart. Agree the gap first, then price any new purchase on its own order form.

What should the settlement paperwork say?

1. Scope. The systems, products and measurement period the settlement covers, so the same period cannot be reopened.
2. Release. SAP's confirmation that the settlement resolves all compliance claims for that scope and period.
3. Accepted user mix. The agreed classification, so the next measurement starts from it and not from the raw count.
4. Document count method. Which documents were excluded and why, so the next indirect measurement uses the same rules.

What have we seen in SAP audit defenses in 2024 and 2025?

Across roughly 30 to 40 SAP audit defenses we ran between 2024 and 2025, the first findings letter overstated the gap in nearly every case. The overstatement was large enough that a clean internal measurement changed the negotiation entirely.

Why we advise against handing SAP the raw USMM output early

The usual advice is to respond quickly, cooperate fully and hand SAP the raw USMM output to show good faith. We disagree with both the speed and the raw output. In our defenses, output sent without review locked buyers into an inflated baseline that took months to unwind. Cooperate on your own timetable, because speed without preparation favors the vendor.

SAP builds its opening number on whatever you send it, so the first thing you send should already be clean.

Which mistakes push the settlement up?

• Leaving scope open. If the measurement request does not list the systems, clients and legal entities, users from systems outside your contract can end up in the count. Fix the scope in writing before the first run.
• Reclassifying in bulk by role. Moving hundreds of users to Employee because of their job title, with no per user activity record, invites SAP to reject the whole batch and return to the raw count.
• Accepting the estimation report total. The report counts follow on documents created by the same technical users, so its raw figure sits above your chargeable count until you adjust it.

How does the work differ for a single system and a multi system SAP customer?

A company with one ECC or S/4HANA system and a few hundred users can often finish the internal pass with its own basis team. Its exposure usually sits in a handful of misclassified users and one or two integrations, and one person can own the whole response.

A group with many production systems, several legal entities and a busy integration layer has more work to do. It needs LAW matching rules agreed early and an owner for each system. Indirect access usually dominates there, so start the document reconciliation first.

What to do next

1. Before any letter arrives. Run USMM internally in every system in scope, and read the output the way SAP will.
2. Consolidate. Run LAW over the results, check that each person counts once, and fix user IDs that fail to match.
3. Reclassify. Move users to the correct type and document the basis for each change against SAP's user definitions.
4. Clean the account list. End validity or delete dormant accounts, merge duplicates, and move technical and test accounts off named licenses.
5. Reconcile indirect use. Run the digital access estimation report and strip non chargeable records from the document count.
6. Name one owner. Route all communication with SAP through a single person for the whole audit.
7. Get independent help before you respond. Engage independent SAP audit defense before your response goes out. Our SAP practice runs the defense with you, and the SAP audit readiness plan covers the year before a letter.

Frequently asked questions