Course Outline
Session 1 (4 hours)
Module 1 – R/3 Fundamentals for Auditors (2 hours)
- Basic architecture (ABAP stack, SAP GUI, client concept).
- Key differences from legacy systems (modular design: Financials, Materials Management, Sales and Distribution).
- Classic transactions and navigation for audit purposes.
Module 2 – Access, Roles, and Essential Segregation of Duties (2 hours)
- User management and authorizations using PFCG, SU01, SUIM, SU53, SU24.
- Role design and common audit-relevant functions.
- Basic segregation of duties matrix and typical findings (e.g., invoice creation and approval in the same role).
Session 2 (4 hours)
Module 3 – Security Logs and Traces (3 hours)
- Security Audit Log (SM19/SM20): activation, filters, and reporting.
- STAD and ST03N: usage statistics, sessions, and workload analysis.
- Best practices for evidence retention and export.
Module 4 – Configuration Changes and Sensitive Data (1 hour)
- SCU3 (change documents) and SCC4 (client settings).
- Critical system parameters (RZ10/RZ11): identification and monitoring.
Session 3 (4 hours)
Module 5 – Process Controls in R/3 for Financials, Materials Management, and Sales and Distribution (4 hours)
- Financials: tolerances, OB52 (posting periods), journal entry approvals.
- Materials Management: release strategies, purchase order limits, single supplier controls.
- Sales and Distribution: credit limits, pricing changes, conditions monitoring.
- Audit sampling techniques for process testing.
Session 4 (4 hours)
Module 6 – Comprehensive Laboratory + Reporting (3 hours)
- Review roles and authorizations for a critical user.
- Trace operations (purchase/sale) and obtain audit evidence (SM20/SCU3).
- Document findings with screenshots and exports.
- Preparation of working papers and traceability.
Module 7 – Closure and Action Plan (1 hour)
- Internal control checklist in R/3 for government.
- Prioritization of findings and recommendations.
Deliverables:
- Checklist of 20+ controls (Financials, Materials Management, Sales and Distribution).
- Quick guide to SM19/SM20, SUIM, SCU3, STAD/ST03N.
Summary and Next Steps
Requirements
- An understanding of fundamental auditing principles for government
- Experience with SAP systems in a public sector environment
- Familiarity with compliance and control frameworks relevant to governmental operations
Audience
- Auditors working within government agencies
- Internal control specialists for government entities
- SAP security consultants supporting public sector organizations
- Compliance officers in governmental roles
Testimonials (4)
Teacher knolage
Collin Sampson
Course - SAP S/4HANA Overview (S4H00)
I liked the fact that the trainer was very flexible and offered information about subjects that were not included in the initial material. I liked his experience in other projects and the tips and tricks resulted from this experience. The training was interactive and even though the exercises were predefined, we could take the exercise in another direction than previously defined.
Maria-Cristina Socol - NTT DATA Romania S.A.
Course - SAP S/4 Hana (S/4Hana)
We have learnt so many things that we didn't know before.
Lebogang Kgosiesele - Lucara Botswana
Course - SAP S/4 HANA PP (Production Planning)
Ayman was a very good trainer. He explained our doubts and was very easy to understand. He gave satisfactory answer to all questions we raised.
