The annual measurement, the enhanced system audit, and what SAP actually looks at. Three knowledge checks along the way, and 4 clips from a senior licensing analyst.
This is a taught session, not a talking head. The instructor works through analyst grade slides, and three times the video stops on a question with four options on screen. Pause, commit to an answer, and the next slide explains which option is right and why each of the others is wrong. 4 times in the session the frame splits and a senior licensing analyst gives the view from inside real SAP negotiations, and the instructor picks the clip apart when the slides return.
The full narration of this session, section by section, for reading and reference. Guest analyst clips are marked.
Welcome back. Session thirty one, and this opens module seven, which is audits and compliance defence. I want to start by separating two things that share a word, because almost everybody conflates them and the conflation is expensive. There is the annual measurement, which you run yourself on your own systems and submit. And there is the enhanced audit, which SAP runs, with their team, their scope and a finding at the end. Today: how each one works, what actually gets measured and where the exposure really sits, what tends to bring an audit forward, and what you owe versus what you do not. Three knowledge checks. Let's begin.
Five objectives. First, separate the two events, because the annual measurement is a routine you run and the enhanced audit is an engagement SAP runs, which is different work and very different risk. Second, treat the submission as a document, since whatever you send becomes the baseline everybody argues from, including in the years after. Third, read the triggers commercially, because escalation follows the commercial calendar far more often than it follows suspicion. Fourth, know what is actually measured, as users, engines and digital access carry very different exposure and preparation should follow the exposure. And fifth, know your obligations precisely, because cooperation is contractual while unlimited access to everything on request generally is not.
Four things to frame it. You run one: the annual measurement is self executed on your systems, on your schedule, and submitted by you. They run one: the enhanced audit brings SAP's audit team, their scope, their scripts and a finding. The first shapes the second, because your submitted figures are the baseline, and four years of the same error is a pattern rather than a slip. And both are commercial, since the output is a number that lands in a negotiation, which is where it gets settled. Let me expand on that third point, because it is the reframe that matters most in this module.
Guest analyst clip.
A document you author, not a button somebody presses in November. That is the standard, and notice what it implies about who should be involved. A measurement treated as an IT task gets a technically correct run of a tool. A measurement treated as a declaration gets reviewed by somebody who understands what the numbers will be used for. Those produce very different submissions. So, the routine itself.
Four things about the annual measurement, and this is the part of compliance where your influence is greatest. You execute it, so the measurement runs on your systems, typically USMM per system with LAW consolidating the results, and session thirty two is entirely about doing that well. You submit it, meaning the output goes to SAP as your declaration, and nothing is verified independently before it lands. It becomes the baseline, because this year's submission is next year's comparison and the trend line is what gets questioned. And over usage becomes a bill, since where the declaration exceeds entitlement SAP prices the gap, usually at prevailing list less your discount. Everything you can do cheaply happens before the submit step. Afterwards you are correcting a statement you already made.
Now the enhanced audit, five points. It is a defined engagement with notice: a named audit team, a stated scope, a timetable and a closing report, so it is a project rather than a request for a file. It goes deeper than the measurement, with additional scripts and questions aimed at what the standard run does not see. Interfaces get attention, because third party systems connecting to SAP are where digital access findings originate, so expect an interface inventory request early. The output is a draft rather than a verdict, since a finding is an opening position from a team that does not know your estate as well as you do. And it settles commercially, because findings are resolved in a negotiation and almost always alongside something you wanted to buy anyway.
First knowledge check. Your measurement run shows four hundred more Professional users than you hold. What is that number? A, an invoice for four hundred licences. B, a draft you can review and correct before it becomes your declaration. C, an automatic breach of the agreement. D, irrelevant until SAP opens a formal audit. Pause here and pick an answer before you continue.
B. The measurement output is a system report, not a bill and not a legal finding, and reviewing it is exactly what the pre submission window is for. Most large gaps at this stage are leavers, dormant accounts and stale classifications rather than genuine over consumption, which is session twenty two's work arriving with a deadline attached. A treats a draft as a demand. C skips the part where the number gets corrected. And D is the expensive one, because an uncorrected figure submitted for four years is not a mistake you can quietly fix in year five. By then it is the pattern everybody negotiates from.
So what tends to bring an audit forward? Five things. A stalled conversation, and an S four HANA or RISE proposal that went quiet is the most common precursor I see in practice. Third party support, because evaluating Rimini or Spinnaker changes the relationship and compliance attention frequently follows. Corporate activity, since acquisitions and divestments move populations and entitlements and both sides know it. An unexplained swing, because a measurement that jumps or drops sharply invites a question and the answer should already exist. And the renewal calendar, since compliance findings arrive most usefully, from a vendor's point of view, shortly before you need something. Let me be careful about how to read that list.
Guest analyst clip.
Having known the answer for the last two years. That is the defence, and it is worth noticing how unexciting it is. There is no clever argument that rescues an estate nobody was measuring. There is only the ordinary discipline of knowing your own numbers, which costs a few hours a quarter and removes most of the fear from this entire module.
Second knowledge check. SAP asks for direct access to your production systems as part of an audit. What is the right response? A, grant it, since the contract requires cooperation. B, provide what the agreement actually requires, and check the clause before granting anything more. C, refuse all requests and escalate to legal. D, grant read only access, which carries no risk. Pause here before you continue.
B. Cooperation clauses typically oblige you to run the measurement and provide its results, not to hand over system access on request, and the difference between those two is worth reading carefully in your own agreement rather than assuming in either direction. A concedes something you may never have owed. C is a posture rather than a position, and it damages a relationship you have to keep for years. And D is simply wrong on the facts, because read only access still exposes data beyond the audit scope and creates obligations under your own security policy. Cooperate fully, in writing, within the scope the contract defines.
Now what actually gets measured, and where the exposure sits. Named users, counted by licence type against your entitlement, bounded by headcount and usually the smallest gap. Engines, counted on the metric in the price list, so orders, spend or records, which is unbounded and moves with the business. Digital access, counted as documents created by non licensed access, and the largest findings in the market come from here. HANA and databases, runtime versus full use with memory in the contract, quiet until an architecture change makes it loud. And third party interfaces, meaning the systems connecting into SAP, which are the evidence trail behind a digital access finding. Look down that third column, because it should change how you spend your preparation time.
Guest analyst clip.
In proportion to the exposure rather than in proportion to how familiar the metric feels. That is the allocation rule, and most teams get it backwards, spending their preparation on the user count because it is the part they understand and arriving at the document question with nothing prepared.
Right, obligations and rights, five points. You owe an accurate measurement, so run it, review it and submit it on time, because a late or absent submission is the one genuinely indefensible position in this whole module. You owe cooperation within scope, which means reading the clause for frequency, notice period and what precisely must be provided. You are entitled to the method, so ask how a figure was derived, because a number without a method is not something you can verify or accept. One channel, in writing, meaning a single named contact and answers that exist as documents, since corridor answers get quoted back as findings. And findings are negotiable, because a closing report is an opening position and the settlement is a commercial conversation like any other.
Five traps. Submitting without reviewing, where the measurement runs, somebody forwards the file, and a number nobody read becomes your declaration. Stale classifications, so leavers, duplicates and users on the wrong type, which is session twenty two's work left unfinished and then priced at list. Answering informally, where a helpful engineer describes an interface in a workshop and that description reappears in the finding. No interface inventory, because if you cannot list what connects to SAP then the vendor's list becomes the accepted one. And treating the finding as a bill, when it is an opening number produced by people who do not know your estate, so verify every line before you discuss price.
Last knowledge check. You have one quarter to reduce audit exposure. What produces the most value? A, delay the measurement while the estate is cleaned up. B, run the measurement early yourself, correct what is wrong, then submit. C, negotiate a lower price per licence in advance. D, buy a licence management tool. Pause here, and think about which one changes the number you declare.
B. A dry run turns the measurement from an event into a draft, and every correction you make before submission is a correction you never have to argue for afterwards. A is the worst option available, because a late submission converts a defensible position into an obvious one and invites exactly the attention you were trying to avoid. C prices a number you have not yet reduced. And D is genuinely useful over years while doing nothing this quarter, since a tool reports the estate rather than fixing it. Let me describe what the dry run actually looks like, because it is less dramatic than people expect.
Guest analyst clip.
An accurate number in your favour beats a clever position on an inaccurate one. So, five things for running the posture all year. Measure quarterly and declare annually, so the annual run confirms what you already knew rather than telling you something new. Keep an interface inventory, meaning every system connecting into SAP, what it does and whether it creates documents, updated when the architecture changes. One named audit contact, with all requests and answers routed through them in writing and a log of what was asked and sent. Document every correction, so why this user was reclassified, when, and on what evidence, because a year later the evidence is the argument. And brief the people who get asked, since Basis, integration and application owners should know to route questions rather than answer them helpfully.
Three sentences. The annual measurement and the enhanced audit are different events, and the first is the one you control, because you run it on your own systems and submit the result yourself. Whatever you submit becomes the baseline for every later conversation, so the whole discipline is to run it early, correct what is genuinely wrong with dated evidence, and declare a number you can defend line by line. And prepare in proportion to exposure rather than familiarity, since named users are bounded by headcount while engines and digital access are not, and a closing finding is an opening position that settles commercially. Next session is the practical one: running the measurement itself, USMM and LAW, and controlling what the submission shows.
Homework before session thirty two, about two hours, and all of it uses documents you already hold. One, find your last submission, meaning the actual file that went to SAP, then read the numbers and ask whether anybody reviewed them before they were sent. Two, read the audit clause, so frequency, notice period, what must be provided, and whether system access is mentioned at all. Three, list your interfaces, everything that connects into SAP, and if no list exists then that absence is your most important finding today. Four, check the trend, putting three years of declared user counts side by side, and ask whether you can explain every movement in one sentence each. And five, name the contact, one person who owns audit correspondence, because if it is currently nobody then it is currently everybody.
Five guides, all on redresscompliance dot com. The SAP audit process explained walks through the annual measurement and the enhanced audit step by step, which is the reference version of today. USMM and LAW in practice is where session thirty two picks up, so running the tools and reading the output properly. SAP digital access explained covers the document metric behind the largest findings in the market, and session thirty three defends one. User classification and clean up covers the corrections that reduce a declaration before you submit it. And audit settlements and forward deals is how findings actually get resolved, which we cover fully in session thirty four.
That is session thirty one. The thing to take away is that the measurement is a document you author, so run it early, correct it with evidence, and submit a number you can defend. Next time, USMM and LAW in practice. See you then.