SAP audit privilege and counsel engagement

Most SAP audit matters that settle badly were not lost on the measurement work. They were lost in the email thread. An internal note between the basis lead and the SAP account manager surfaces six weeks later in the negotiation file, and the buyer’s formal position is contradicted by a sentence that was never meant to be a position. The structural answer to that pattern is not better email discipline. It is privilege. An audit routed through outside counsel under a written engagement letter is in a different procedural category from one routed through procurement alone, and that category change carries through every stage of the defence.

What privilege actually protects

Privilege is a doctrine of evidence. In the jurisdictions that matter for most SAP audits — the United States, the United Kingdom, the EU, and the major commercial centres in Asia — communications between a client and outside counsel for the purpose of obtaining legal advice are not discoverable in the ordinary course. The doctrine has variants, exceptions, and waivers, but the substantive rule is robust: a letter from the General Counsel to outside counsel asking for a legal view on the contractual exposure of a particular SAP measurement output is, in nearly every relevant venue, protected.

The corollary is what privilege does not protect. An email between the SAP basis team and the SAP account manager is not protected, regardless of how informal the tone or how well-intentioned the writer. A spreadsheet sent from the SAM team to the procurement category lead without counsel involvement is not protected. A WhatsApp message between two technical leads about indirect-access exposure is not protected. The distinction is not about content. It is about routing.

Why the routing matters in SAP matters specifically

SAP’s audit-compliance group is methodical. The notification letter, the data-exchange protocol, and the substantive negotiation are all conducted on the basis of a paper file. The opening claim is built from extracts, file notes, and communications that the SAP team has assembled from documented sources. If those sources include a casual admission from an internal buyer email — “we’ve known about that integration for a while, we just haven’t classified it” — that admission becomes part of the claim.

We have seen settlements rise by figures in the high seven and low eight digits because an unprivileged internal communication entered the SAP file. The communication is rarely dramatic. It is almost always a sentence written by a technical lead who did not realise that the audit channel and the account channel were not separate. Privilege is the structural barrier that prevents that sentence from becoming a position.

The mechanics of the engagement letter

The engagement letter is the document that creates the privileged channel. It is signed between the buyer entity and outside counsel, names the matter, defines the scope of the engagement, and attaches the independent advisor as a sub-consultant working under the direction of counsel. The structure has been used in audit, regulatory, and dispute work for decades. For an SAP matter, the standard template includes a few elements that matter operationally.

Naming the matter narrowly

The engagement letter should name the SAP audit notification specifically, by date and reference. A broad engagement letter (“SAP licensing advisory”) is weaker than a narrow one (“Advice in connection with the 11 March SAP audit notification regarding the European entities”). Narrowness anchors the privilege claim to a defined matter.

Attaching the advisor under counsel

The independent advisor — the firm running the substantive measurement and negotiation — is engaged as a sub-consultant under counsel, not as a direct contractor of the buyer. Communications between the advisor, counsel, and the buyer team are then within the privileged perimeter. Communications between the advisor and the buyer team without counsel are within the perimeter if the advisor was retained for the purpose of providing legal advice and is acting under counsel’s direction. This is the standard Kovel structure in US matters and is recognised in most other relevant jurisdictions in some form.

Defining the channel

The engagement letter should define the communication channel: who corresponds with SAP, in what form, and through what email domain. The cleanest structure is that all substantive communications with SAP are signed by counsel or are routed through a single named individual on the buyer side acting under counsel’s direction. Technical conversations between the basis team and the SAP solution architects are confined to non-audit topics or are routed through the channel.

What the buyer’s teams need to know on day one

Privilege is only as strong as the discipline of the people inside the perimeter. On day one of the audit response, the buyer’s extended team — basis, SAM, procurement, CIO, finance — needs to be briefed in a single session on the channel structure. The briefing covers three rules. All audit-related communications go through the named channel. No audit topic is discussed with any SAP contact outside the channel, including informal conversations, conference encounters, and account-team check-ins. Any document, spreadsheet, or extract that touches the audit topic is marked as prepared at the direction of counsel for the purpose of obtaining legal advice.

The marking is procedural but matters. A spreadsheet headed “Prepared at the direction of counsel — privileged and confidential” that was actually prepared at counsel’s direction is in a different category from one without the heading. The marking does not create privilege where none exists, but it signals the perimeter and supports the claim if challenged.

The limits of privilege

Privilege is robust, not absolute. Three categories of limit matter in SAP matters. First, privilege does not protect facts. The fact that a particular integration exists, the fact that a particular user has a particular role, the fact that a particular document was produced — those facts are discoverable through other means even if the communication discussing them is privileged. Privilege protects the conversation, not the underlying reality. Second, privilege can be waived. Sharing a privileged document with a third party outside the perimeter waives privilege for that document and may waive it for related documents on the same subject matter. The discipline of the perimeter is what prevents inadvertent waiver. Third, privilege does not apply to communications that are part of a fraud or crime. This exception almost never matters in audit work but is worth knowing.

The advisor under counsel: practical effects

The substantive defence work runs the same way under privilege as it would without privilege, with three differences. The measurement and analysis outputs are addressed to counsel, not the buyer team directly, and are then communicated by counsel to the buyer with the legal view. The negotiation positions are framed as counsel’s positions taken on the buyer’s instruction. The final settlement memorandum is recorded in the privileged file. The substantive work — the USMM cleanup, the indirect-access topology mapping, the digital-access document count — is unchanged. The wrapping is different.

The work products that come out of the engagement are described in the defensive playbook article and in the firm’s audit defence playbook white paper. The topology mapping discipline is set out in the SAP ECC topic page. The audit defence service sets out how we structure the engagement for clients running this protocol.

When privilege is not available

In some jurisdictions and some corporate structures, classical privilege through outside counsel is not available or is sharply limited. In-house counsel privilege is recognised differently in the EU than in the US and UK. State-owned entities and certain regulated industries have disclosure obligations that override privilege in defined circumstances. In those cases, the protective structure is different. Communications are still routed through a defined channel, the substantive work is still done under careful documentation, and the buyer accepts that the audit file is more exposed than it would be under a privileged perimeter. The insurer case file ran without classical privilege under EU rules and the defence was structured accordingly.

How privilege shapes the final settlement

The settlements that come out of privileged matters look different in three ways. They are negotiated on the basis of the formal positions only, without the noise of inconsistent internal communications. They are documented in a settlement memorandum that records the contractual basis of the resolution without admissions of historical breach. And they include contract-clause changes that survive the audit and improve the position for the next cycle. The pattern is consistent across the matters in our case-file library, including the global-manufacturer 68 per cent reduction and the retailer indirect-access matter.

For more on the procedural footing of the first ten days, see responding to the SAP audit notification letter. For the substantive measurement that runs in parallel, see preparing the license position statement.