SAP License Audits Contact Us
Home/Journal/Audit Letter Response/Article
Audit Letter Response

Whether to disclose your external advisor in the audit letter.

Most procurement teams instinctively conceal their external advisor's involvement. The instinct is wrong — or at least wrong in the simple form most teams apply. A more nuanced playbook materially improves settlement outcomes.

May 2026 8 min read Editorial Desk · SAPLicenseAudits
A procurement team meeting with an external advisor reviewing the draft audit response strategy
— A procurement team meeting with an external advisor reviewing draft audit response strategy

The procurement team has retained an independent SAP audit advisor. The advisor has helped draft the response strategy, has reviewed the customer-side compliance position, and is sitting two seats over in the war room. The question every procurement lead asks at this point is simple: does the response letter to SAP disclose the advisor's involvement, or does it conceal it?

The instinct in most procurement teams is to conceal. The reasoning, when articulated, is that disclosing external advisory involvement signals weakness — an admission that the customer's internal team is not capable of handling the matter. The instinct is widespread, intuitive, and (in the simple form most teams apply it) commercially wrong. A more nuanced playbook on disclosure consistently improves settlement outcomes.

What the auditor is signalled by disclosure

SAP audit leads, on the record at industry events and off the record in informal conversations, are consistent on what disclosure of an external advisor signals to them. It signals three things: that the customer has invested in the defence (which raises the cost of escalation on SAP's side), that the customer's response is being shaped with reference to comparable settlements from prior matters (which constrains how aggressive an opening number is defensible), and that the customer is prepared to go long (which raises the discount factor SAP applies to its own opening position).

None of these signals are weakness signals. All three are leverage signals. The intuition that disclosure signals weakness comes from an analogy to litigation, where retaining external counsel is occasionally interpreted as defensive panic. In an SAP audit context, the analogy is wrong; the audit is a commercial negotiation, and the disclosure signals that the customer is treating it as one.

The cases where disclosure is the right move

1. When the customer's compliance position is strong

If the customer's internal analysis has produced a strong compliance position — the findings are weak, the methodology is questionable, the contractual interpretation favours the customer — disclosure of the external advisor amplifies the strength. The combined signal is "we have a strong position and we have invested in defending it." SAP's opening number tends to come in lower in this configuration.

2. When the matter is in escalation

Once a matter has reached the second escalation stage, disclosure of an external advisor is usually expected. Failing to disclose can read as either inexperience or as concealment, both of which are negative signals. The right move is to disclose explicitly, identify the advisor by firm (not by individual), and let the disclosure normalise the engagement of external support.

3. When the customer has board-level visibility on the matter

Audits that have reached the customer's board or audit committee benefit from explicit disclosure of external advisory involvement, because the board's principal concern is the management response, and external advisory engagement is a clear management-response signal. The disclosure in the audit letter pre-empts the question and stabilises the board narrative.

Field note — the "we're being assisted" line The most effective disclosure pattern, in our observation, is a single line in the letter: "In preparing this response, the company has been assisted by independent licensing advisors." The line discloses the involvement without naming the firm or the individual, signals investment without sounding defensive, and gives SAP's audit lead the information they need to recalibrate the opening number. Verbose disclosure — multiple sentences explaining who the advisor is, what they have done, what their qualifications are — tends to be counterproductive.

The cases where concealment is the right move

1. Early-stage matters where the advisor's role is preliminary

If the external advisor is reviewing the position but has not yet shaped a defence strategy — if the customer is still in the diagnostic phase — disclosure may be premature. The right pattern in this phase is to defer disclosure and use procedural language in early letters, then disclose once the defence strategy is firm.

2. Matters where the customer's compliance position is materially weak

When the customer's underlying compliance position is materially weak — clear findings, defensible methodology, contractual position against the customer — disclosure of an external advisor can crystallise the auditor's confidence that the matter is being handled at level rather than being slow-walked. In this configuration, the right move is often to negotiate quietly, settle quickly, and absorb the lesson into the customer's internal compliance programme rather than to make the matter visible.

3. Matters where the SAP account-team relationship is mid-cycle

If the audit is happening in the middle of a strategic renewal cycle where the customer's commercial relationship with SAP has near-term value — a pending S/4HANA conversion, a strategic RISE transition, a new module deployment — visible external advisory engagement may complicate the broader commercial conversation. The judgment call in this configuration is whether to disclose the audit advisor and risk colouring the commercial conversation, or to handle the matter more quietly. The trade-off is non-trivial and depends on the specific commercial context.

The phasing question — when in the cycle to disclose

The most common pattern in well-run defences is phased disclosure. The first letter is procedural and does not disclose the advisor. The second letter, after the customer-side analysis is complete, may disclose if the position is strong. The third letter, at the formal-finding stage, almost always discloses if the advisor is leading the dispute. The escalation letters always disclose.

The phasing serves two purposes: it preserves the customer's option to manage the matter internally if the findings turn out to be smaller than expected, and it builds the disclosure as a signal of seriousness at the point where the auditor is being asked to revise an opening position. See the related discussion in tone and language patterns for how the disclosure fits with the broader letter strategy.

What to say and what not to say about the advisor

68%
Average claim reduction
$180M+
Saved across active matters
500+
Engagements closed since 2018

If the customer chooses to disclose, the language matters. The right disclosure identifies the role generically (independent licensing advisors, independent SAP audit advisors) without naming a specific firm or individual. Naming creates personalisation in the SAP audit lead's mind that can be either helpful or distracting, depending on whether the named advisor has a reputation. Generic disclosure preserves the leverage of the signal without committing to a specific narrative.

The wrong disclosure language describes the advisor's qualifications in detail, lists the advisor's prior engagements, or characterises the advisor's view of the findings. These details cede information to the auditor without strategic benefit and occasionally produce friction with the advisor (who has their own preferences on how they are characterised externally). Keep the disclosure short and neutral.

The interaction with privilege and confidentiality

Disclosing the existence of an external advisor does not waive privilege over the advisor's work product. The customer's analysis, the advisor's recommendations, and the customer's internal deliberations remain protected even after disclosure of the advisor's existence. The customer's legal team should review the specific disclosure language to confirm that no privileged content is included, but the high-level disclosure pattern is uncontroversial. See the closely related discussion in legal review process.

The downstream impact on settlement

The empirical pattern across hundreds of matters is consistent: customers who disclose their external advisor at the appropriate phase tend to settle at lower percentages of opening positions than customers who conceal the advisor, holding the underlying compliance position constant. The difference is typically in the range of ten to twenty per cent of the settlement amount, which on a typical mid-sized matter is several hundred thousand to several million dollars.

The advisor disclosure is not the only variable that matters, and it is not the largest variable. But it is one of the few free moves available to the customer — a signal that costs nothing to send and that materially shifts the auditor's read of the engagement. See the audit defence service for the broader engagement model and the global retailer letter defence for the disclosure pattern in practice.

What good looks like

A well-managed advisor-disclosure decision is phased, deliberate, and aligned to the strength of the customer's underlying compliance position. Disclosure happens at the point where the signal is most valuable — usually the second or third letter. The disclosure language is short, generic, and does not waive privilege. The advisor's involvement is presented as evidence of seriousness rather than as evidence of need. Customers who handle disclosure this way consistently outperform customers who reflexively conceal. See the SAP S/4HANA topic page for the related cycle context, and the SAP Audit Response Letter Toolkit for the full disclosure language library.

— Subscribe

SAP Audit Alerts · The weekly briefing

Every Wednesday. Field reports from active matters, decoded SAP communications, and what to look for in the next audit cycle. Work email only.