BUSINESS SOLUTIONS
WORKFLOW AND ARCHIVING
SECURITY
E-COMMERCE
MARKETING
ANALYTICSTRAINING: SAP SECURITY
SAP Authorization Governance Framework
Build a robust decision-making, accountability, and access control model in SAP.
Training description
Lack of a clearly defined governance model in SAP leads to decision-making chaos, excessive permissions, SoD conflicts, and low auditability.
The SAP Authorization Governance Framework is a structure that organizes who decides, what they are responsible for, and under what rules regarding SAP access before GRC, SoD, or control tools are introduced.
The training focuses on organizational and process fundamentals, without which SAP security does not work:
Role ownership, business accountability, decision making model (RACI), JML processes, exceptions, emergency access, and recertification.
The workshops guide participants step-by-step through a structural governance model that can be directly adapted within an organization – regardless of its size, industry, or stage (ECC / S/4HANA).
About the speaker
Tomasz Jurgielewicz
Head of Security Development
It implements comprehensive security and license cost optimization projects, focusing on areas such as:
- Identification of authorization conflicts and reorganization of authorization,
- SAP vulnerability identification,
- Integration of SIEM solutions with SAP,
- SAP license optimization.
Key information
Who is the training intended for?
We target training to:
• SAP Security / Authorization Teams
Process and data owners
• IT, Security, and Compliance Managers
• Internal audit and financial control
• SAP Transformation and S/4HANA Migration Leaders
• Organizations planning the implementation of SAP GRC or Access Control
No programming knowledge is required – the training focuses on organizational and process logic, not on technical role building.
Training objectives
Upon completion, the participant is able to:
Build a complete SAP Authorization Governance Framework.
Identify and document ownership of roles, processes, and risks.
Separate business responsibility from technical responsibility.
Design a RACI decision model for SAP access.
Develop processes: JML, change, exceptions, and emergency access.
Prepare the organization for SoD, GRC, and audits.
Ensure full auditability of access decisions.
Scope of training
The training covers all key elements of the SAP Authorization Governance Framework:
1. Organizational structure – ownership and responsibility
• Identification of business process owners
Mapping processes to T-codes
• Rules for accepting access to T-codes
- Standardization of job names and verification with HR
Distinction
– functional roles (technical / business / process),
Position roles (job roles – composite)
• Ownership:
– of functional roles,
– official positions,
– approval of role content (key to governance)
2. Authorization Processes (Operational)
• Approval of role assignments to users
• Approval of changes in job role
• Changes in role content – who decides and why
• JML (Joiner–Mover–Leaver) process initiated in HR
Principle: no technical changes without a business decision
3. Preparation for risk management
• Definition of critical objects and T-codes
• Functions, processes, and SoD matrix
Risk Ownership and Business Accountability
4. Decision Model (RACI)
• RACI for: access to T-codes, content of functional roles, positional roles, SoD exceptions
• Practical examples of division of responsibilities
Elimination of the „gray zone of decision-making”
5. Exception Management
Who can approve an exception
For how long is the exception valid?
• Exception logging and auditing
• Business risk responsibility
When is it permissible to deviate from a standard (e.g., SoD)
6. Emergency Access / Firefighter
• Emergency role – design principles
• Rules for giving and receiving
Login and audit trail
Retroactive access approval
7. Access Review
Periodic user role reviews
• Recertification of job roles
Recertification of critical T-codes
Frequency and responsibility
Consequences of non-acceptance
8. Role Lifecycle Management
Application for a new role
Role Design
Business Acceptance
• Implementation and testing
Role retirement
9. Role design principles
• One function = one functional role
• Lack of T-codes in job roles
• No wildcards
Naming conventions
• Clearly defined scope of role responsibility
10. Auditability and Decision Trail
• Recording decisions: who approved, when, on what basis
• Preparation for internal, external, and SOX audits
Why is it worth it?
Governance and then you will introduce GRC and SoD
A coherent, practical model based on real-world implementations
Clear division of responsibilities – the end of „nobody knows who”
Ready-made structures, RACI, and processes
Full auditability of access decisions
Training format
Project workshops in an organization (framework development)
1:1 consulting sessions for leaders and process owners
The end result for your organization
After training, the organization has knowledge on how to build a SAP Authorization Governance Framework, covering:
Ownership and responsibility model,
authorization processes and JML,
exception and emergency access rules,
structure under SoD, GRC, and audit,
full audit trail.
This is a solid foundation for:
access ordering,
SAP GRC implementations,
S/4HANA migration,
audit transitions without „firefighting”.
Let's talk about the details of training for your company
Your needs, our support.
Your Digital Transformation?
Your needs, our support. Let's talk