The audit data room — six artefacts that change the trajectory

An SAP audit data room is the standing artefact that converts an opening notification from a moment of asymmetric information into a structured exchange of documents. Built before the audit lands and maintained quarterly thereafter, the data room is the single most consequential investment a procurement or SAM team can make in audit defence. This article walks through the structure of a defensible data room, the data sources it draws on, the analyst-day budget, the governance discipline that keeps it current, and the way it changes the trajectory of an audit response.

What a data room contains

An SAP audit data room is organised into six standing artefacts. The named-user inventory, which lists every active and dormant user account against the relevant SAP licensing category. The role-to-category mapping, which documents how the named-user inventory is derived from the active-role assignment. The Digital Access baseline, which counts the chargeable documents by type, originating system, and month. The RFC-destination register, which lists every interface flow against its originating system and authorised document types. The contractual extract, which records the named-user definitions, the indirect-use clause, the audit-rights clause, and the entitlement schedule from the master agreement. And the prior-correspondence file, which preserves every USMM submission, every position paper, and every settlement document from prior audit cycles.

The six artefacts together describe the licensed posture of the estate. Built once, they take fifteen to thirty analyst-days. Maintained quarterly, they take three to six. The audit-time saving is consequential. The audit defence service page describes how we structure the engagement.

The named-user inventory

The named-user inventory is the most measurable of the six artefacts and the one that drives the largest opening-claim line in most audits. The inventory lists every account in USR02, with its active-role assignment, its last-login timestamp, its assigned licensing category, and its defensible category based on usage. The defensible category — usually a step below the assigned category, on the strength of the usage telemetry — is the single largest source of audit-time savings. The methodology is in the named-user buckets article and the named-user classification guide.

The dormancy split

A standard inventory carries between fifteen and forty per cent dormant accounts — users that have not logged in within the audit-relevant window. The dormancy split is the input to the harvesting decision, which is the operational decision that converts the inventory into a lower licensed cost. The harvesting article covers the operational mechanics.

The role-to-category mapping

Each SAP licensing category is, in principle, derived from the set of transactions and authorisations the user holds. In practice, the mapping is rarely documented and the assignment is rarely audited. The data room captures the mapping in a single artefact, with the licensing category determined by the highest-tier transaction in the user’s active-role assignment. The mapping is the basis on which any defensible re-classification can be argued at audit time. The role-mapping article describes the methodology.

The Digital Access baseline

The Digital Access baseline is the indirect-use companion to the named-user inventory. It counts the chargeable documents by type, originating system, and month, against the full attribution methodology described in our baseline measurement method article. The baseline is the artefact that bounds every conversation about indirect-use exposure or Digital Access pricing. Without it, the opening claim is the only number on the table. With it, the buyer’s number is the credible one.

The RFC-destination register

The RFC register is the operational complement to the Digital Access baseline. It lists every RFC destination, its purpose, its originating system, its technical user, and the document types it is permitted to post. The register is rarely complete on the first pass and should be maintained as a quarterly deliverable. Its value at audit time is that it converts the originating-system attribution from a forensic exercise into a documented lookup. The ECC topic page describes the broader context in which the register sits.

The contractual extract

The contractual extract is the procurement-side artefact in the data room. It records the named-user definitions from the master agreement, the indirect-use clause and any subsequent Digital Access amendment, the audit-rights clause and any negotiated narrowing, the entitlement schedule by product and metric, and any settlement clauses from prior audit cycles that bear on the current measurement. The extract is the document that frames the contractual reading of every measurement in the rest of the data room. Without it, the technical artefacts are unanchored. With it, they are bounded by the licensed posture the contract actually grants.

The contract clauses article documents the language patterns that recur across SAP master agreements and the buyer-side positions that close them.

The prior-correspondence file

Every prior USMM submission, every position paper, every settlement letter, and every email exchange with SAP’s audit team should be preserved in a structured file inside the data room. The file is the institutional memory of the licensing relationship. At audit time it is the source of three pieces of information that materially shape the response. The prior-period settled numbers, against which the current measurement is benchmarked. The prior commitments and undertakings, which limit the scope of what SAP can now contest. And the prior contacts, with whom the substantive negotiation will run.

The governance discipline

A data room is only as useful as the discipline that keeps it current. The standing governance pattern is a quarterly refresh, run by a single named owner in the SAM or procurement function, against a documented methodology and a versioned changelog. The refresh covers the named-user inventory, the Digital Access baseline, and the RFC register. The contractual extract and the prior-correspondence file are updated event-driven, on any new amendment or correspondence. The total quarterly burden is three to six analyst-days. The audit-time saving is, across our engagements, in the seven-figure range per engagement.

How the data room changes the audit response

An audit conducted against a current, maintained data room follows a different trajectory from the typical pattern. The opening notification is acknowledged inside the contractual window with a documented reference to the licensed posture. The SAP-supplied measurement is reconciled against the data room inside ten business days. The position paper goes back to SAP inside six weeks rather than ten. The negotiation closes at the buyer’s numbers, not SAP’s opening claim. Across our engagements where the data room existed before the notification, the average opening-claim reduction is higher than the headline sixty-eight per cent. The data room does not change SAP’s opening number. It changes the speed, the documentary basis, and the leverage of the buyer’s response.

The global-manufacturer case file documents one such engagement in full, including the role of the pre-existing data room. The defensive playbook article covers the broader response sequence.

The maturity stages

The data room evolves through three stages of maturity. The first-build stage produces the six artefacts at acceptable quality and runs fifteen to thirty analyst-days. The maintained stage holds the artefacts current through quarterly refresh and runs three to six analyst-days per quarter. The mature stage adds the trailing-period comparisons, the methodological version control, and the cross-artefact reconciliation that distinguish a defensive instrument from a static archive. Estates typically reach the maintained stage in the second quarter of the programme and the mature stage in the second year. The audit-time response performance improves at each stage, with the largest single uplift between the first-build and the maintained stages.

The KPI framework article describes how the maturity of the data room is measured against the seven-KPI dashboard, and the S/4HANA topic page covers the data-room considerations specific to estates in active migration.