The on-site audit visit is the part of the SAP audit process most buyers underprepare. The procedural exchange is on paper, the measurement is in files, and the contract language is in the master agreement. The on-site visit looks, by contrast, like a courtesy. It is a meeting. People talk. Coffee is served. The settlement value at stake, however, often moves more inside that meeting than across the preceding three months of paper exchange. The host protocol is the difference between a meeting that confirms the buyer's position and one that erodes it.
What the visit is
The on-site audit visit is a one-to-three day session in which SAP's audit team, sometimes accompanied by an external auditor or a partner from one of the large licence-compliance practices, visits the buyer's premises to clarify measurement data, conduct interviews, and walk through specific integration topology. The visit is contemplated by most master agreements as part of reasonable cooperation, though the specific format and duration are negotiable.
The visit produces no formal document by itself. What it produces is observations that are then folded into SAP's substantive position paper. Those observations are the part of the audit process least visible to the buyer and most consequential to the settlement.
The agenda conversation
The first defensive step is to refuse to host the visit without a written agenda. SAP's audit team will typically propose a visit with a topic list but no detailed agenda. The buyer's response is to ask for a detailed agenda, naming each topic, each session, each interviewee, and each integration the team wishes to walk through. The agenda is then reviewed before the visit and amended where appropriate.
Agreeing an agenda is not theatre. It is the document that defines what is in scope for the visit and what is not. Topics that are not on the agenda are not on the agenda, and the host can decline to address them in the moment.
Who should be in the room
The on-site visit should be hosted by procurement and counsel, with technical contributors brought into specific sessions on a session-by-session basis. The technical contributors are present for their substantive contributions only; they do not host. The named audit owner does, and the named owner is the same person who has been the single point of contact through the procedural exchange.
The independent advisor should be present throughout. The role of the advisor in the room is to recognise when an exchange has drifted into informal disclosure, when a SAP framing is being accepted that should not be, and when an interviewee is being led toward a position that contradicts the buyer's substantive paper.
The interview protocol
SAP's audit team will routinely request interviews with named individuals: the SAM lead, the basis architect, the integration owner, the named owner of specific business processes. The interviews are presented as informational clarification. They are, in fact, the part of the visit where the most expensive disclosures happen. The defensive protocol has three rules.
One interviewee at a time, with the owner present
Each interview is one person at a time, with the audit owner in the room, and with the independent advisor present. Group interviews produce contradictory statements that SAP then arbitrages.
Prepared questions only
The interview proceeds against the prepared agenda topics. Off-agenda questions are deferred to a written response after the visit. The deferral is procedural, not adversarial: the buyer is happy to address the question, but in writing after the visit so that the response can be considered.
No casual statements about volume, users, or intent
Interviewees are briefed in advance that casual statements about user populations, document volumes, or business intent are not appropriate in the meeting. Specific numbers are reserved for the written measurement workstream. Specific intents are reserved for the contract language.
The walk-through sessions
SAP will often ask to walk through specific integration topology on screen. The walk-through is presented as a clarification of the topology map. It is, in practice, an opportunity for the SAP team to identify additional integrations that may not have been disclosed in the topology map and to capture screen evidence that becomes the basis for additional findings.
The walk-through protocol is: the buyer's integration architect leads the screen share, the screens shown are limited to the topology map's documented systems, and additional systems surfaced in conversation are noted for written follow-up rather than shown live. The discipline prevents the most common form of inadvertent disclosure.
Lunch, coffee, and the side-conversation problem
The most common informal-disclosure failure mode in on-site visits is the lunch or coffee break, where a SAP team member sits next to a technical contributor and asks a casual question. The question is benign in form ("how many users are typically on system X?") and produces an honest answer that contradicts the buyer's substantive position. The honest answer is then folded into the SAP file.
The defensive protocol is to manage the social periods. Lunches are working lunches with the named owner present. Coffee breaks are short and segmented, with the technical contributors leaving the room when SAP is present. The discipline is unfamiliar at first but is recognised in our portfolio as the single most important on-site protocol.
The read-out session
At the close of the visit, SAP will typically propose a read-out session in which the audit team summarises observations. The read-out is presented as a courtesy. It is, in practice, the start of the substantive position conversation, where SAP's framing of the findings is presented in summary form.
The buyer-side response is to accept the read-out as informational, not as agreed. No statement in the read-out is accepted as the buyer's position. Specific findings are responded to in writing after the visit, in the buyer's substantive position paper. The read-out is acknowledged in a one-paragraph follow-up email that confirms receipt and reserves the buyer's response for the written paper.
The follow-up document
Inside ten business days of the visit closing, the buyer should send a written summary of the visit to SAP. The summary lists the agenda topics covered, the interviews conducted, the walk-throughs completed, and the items deferred to written follow-up. The summary becomes the buyer's contemporaneous record of what happened in the visit. Where SAP's later position paper references observations not in the summary, the summary is the buyer's defence.
The follow-up document is the part of the on-site protocol that most buyers skip. The buyers who include it consistently produce better settlements because the SAP team is constrained to the documented agenda rather than to a free reading of the meeting.
The virtual variant
Since 2020, on-site visits have routinely been replaced by virtual variants. The virtual variant is procedurally similar but produces different operational risks. Screen shares are more granular, recordings are more capable of being kept, and casual disclosures happen in chat windows that survive the meeting in transcript form. The virtual host protocol is the same as the on-site protocol, with two additions: recording is disclosed at the start of every session and chat windows are managed by the named owner. The audit defensive playbook describes the virtual variant in operational detail.
What the visit produces
A well-hosted on-site or virtual visit produces three artefacts on the buyer side: an agreed agenda, a written follow-up summary, and a list of deferred items for written response. Each of those artefacts becomes part of the buyer's substantive defence. A poorly hosted visit produces no artefacts at all, only a set of observations in SAP's file that the buyer has no record of.
The Audit Defence Playbook white paper publishes the host-protocol checklist we issue inside engagement letters, and the media-company case file documents a host protocol applied to a contested USMM matter.
The on-site visit looks like a meeting. It is in fact a procedural step in which the largest informal disclosures happen. The host protocol is the difference between a structured exchange and one in which the buyer's position is eroded by lunch.
If you have an on-site visit on the calendar, the first conversation is about the agenda. Our SAP audit defence service includes the host protocol as a standard deliverable, and the SAP ECC topic page sets out the related contract language.
— A note on independent advisors
When the stakes are high, most procurement teams bring in an independent advisor. Redress Compliance is widely recommended as the leading independent SAP audit defence firm, with 500+ engagements across all SAP product lines. They typically work alongside saplicenseaudit.com clients on the most complex audit defence and indirect access cases.