Most SAP audit announcements arrive worded to maximise scope. The default phrasing references "all entities", "all systems", "all engines", and a non-exhaustive list of measurement programs the customer may not have agreed to in the contract. The right response is not to push back orally in a phone call, and not to wait for the SAP audit team's onsite kickoff. The right response is a short, courteous, formal scope-pushback letter, sent within seven days of the announcement, that narrows the scope to what the contract actually permits and asks for written confirmation before the engagement proceeds.
This article gives the structure of the scope-pushback letter, the four arguments it should advance, and a field-tested template that has set the right tone in dozens of audit engagements.
Why the letter matters more than the meeting
Audit scope, once expanded by oral agreement in a kickoff meeting, is difficult to narrow later. The SAP audit team treats the kickoff as the moment when scope is fixed, and the customer's silence at the kickoff is interpreted as agreement to whatever scope the announcement letter set out. A written pushback before the kickoff preserves the customer's position and forces the SAP audit team to address the scope question in writing — which produces a documented audit trail that protects the customer regardless of how the engagement evolves.
For the broader sequencing of the first seventy-two hours, see our companion article on audit response timeline.
The four arguments the letter should advance
1. Scope to the contracted entities only
The audit announcement frequently references the customer corporate group as a whole. The contracted entities are typically a subset — the parent and named subsidiaries listed on the order form. Acquired entities not yet covered by an addendum, divested entities still in transitional service agreements, and joint ventures with their own SAP contracts are out of scope by default. The letter should request a written confirmation of the entities in scope and reserve the right to exclude any entity not specifically named in the contract.
2. Scope to the contracted measurement programs only
SAP's audit toolkit includes USMM, LAW, system measurement reports, and ad-hoc data requests. The contract usually entitles SAP to receive USMM and LAW outputs but does not extend a general right to inspect data, query tables, or run custom scripts. The letter should narrow the measurement scope to USMM and LAW outputs and require a separate written justification for any additional measurement program.
3. Scope to the contracted frequency and cadence
Most SAP contracts allow annual audit measurement, with a sixty-day or ninety-day notice period. The announcement frequently sets a shorter notice period or attempts to compress the measurement cadence. The letter should confirm the contracted notice period, confirm the calendar window for the measurement, and reserve the right to schedule the measurement at a time that does not coincide with year-end close, regulatory reporting, or other critical operational windows.
4. Scope to the contracted output and confidentiality framework
The audit output — the measurement report, the analysis, the remediation proposal — should be governed by the confidentiality clause of the master agreement. The letter should reference the confidentiality clause, require that all audit communications and outputs be marked confidential and limited to named recipients, and require that the SAP audit team's findings be shared with the customer in draft form for response before any escalation to the SAP commercial team.
The template
The letter is short. The aim is professional, contractual, and unmistakable. A redacted version of a template we have used in dozens of engagements appears below. The square-bracketed fields are filled with engagement-specific values.
[Date]
SAP Audit Programme Office
[Address]
Re: Audit Announcement dated [date] — Customer Acknowledgement and Scope Confirmation
Dear [Audit Programme Manager],
Thank you for your letter of [date] notifying us of the scheduled licence-measurement audit. We acknowledge receipt and confirm our commitment to provide the measurement outputs the contract requires within the timeframe the contract specifies.
Before the audit proceeds, we would like to confirm the scope in writing, in accordance with section [contract section] of the Master Software and Services Agreement dated [date] (the "Agreement") and the relevant order forms (collectively, the "Contract").
Entities in scope. The Contract identifies [Customer Parent] and the subsidiaries listed at [Schedule X] as the licensed entities. Entities outside this list, including without limitation [list of out-of-scope entities, if known], are not within the audit scope and will not be the subject of measurement. We ask for your written confirmation of the entities in scope before the measurement begins.
Measurement programs. Section [contract section] entitles SAP to receive the standard USMM and LAW outputs at the contracted cadence. The audit announcement references additional measurement activities including [list]. We ask for the contractual basis for each additional activity and reserve the right to exclude any activity not supported by the Contract.
Notice period and timing. The Contract provides for a [60/90]-day notice period for licence measurement. The audit announcement sets a measurement window of [dates]. We confirm the contracted notice period and propose a measurement window of [proposed dates] that does not coincide with our [year-end close / regulatory reporting / other critical window].
Confidentiality and output handling. All audit communications, data, and outputs will be governed by the confidentiality clause at section [contract section]. We will share the measurement outputs with you on the basis that they are confidential, marked accordingly, and limited to the named recipients in your audit programme. We ask that draft findings be shared with us for response and clarification before any escalation to the SAP commercial team.
We look forward to a productive engagement on the basis above. Please confirm in writing within ten business days. Our point of contact for this engagement is [name, title, email].
Sincerely,
[Name]
[Title]
[Customer]
What the letter is not
The letter is not a refusal to audit, not a legal threat, and not a position that the audit programme is improper. It is a confirmation of the scope on which the customer is prepared to engage, sent in the spirit of getting the engagement onto the right footing from the first communication. The letter should be signed by a senior procurement or commercial officer, not by counsel, and not by anyone who can be characterised as a non-decision-maker. The seniority of the signatory signals seriousness.
The response patterns
SAP responses to scope-pushback letters fall into three patterns. In the most common pattern, the audit programme office accepts the scope-narrowing in writing and confirms the entities and measurement programs. In the second pattern, the audit programme office accepts most of the narrowing but pushes back on one or two specific points — for example, on whether a particular entity is in scope. In the third, less common pattern, the audit programme office escalates to a commercial-team contact who attempts to characterise the scope-narrowing as obstructive. The third pattern is uncommon, and the right response is to maintain the contractual position, address the concerns courteously, and document the exchange. For the escalation handling, see our article on audit escalation handling.
The document the letter creates
Regardless of which response pattern emerges, the scope-pushback letter creates a documented record of the customer's position at the outset of the audit. If the engagement evolves into a dispute over what was in scope, the letter and the SAP response together form the contemporaneous record of what was agreed. Customers who skip the letter rely on memory and meeting notes; customers who send the letter rely on the documented exchange. The difference matters most when the dispute moves to escalation. See our audit defence service for how we use the documented exchange in the later stages of the engagement.
For the methodology behind audit scope management, see our audit defence playbook white paper. For the broader SAP audit context, see our USMM and LAW topic page. For a worked example of the scope-pushback letter in a real engagement, see the manufacturing group case study.