SAP Audit Defence
Letter-stage response, document control, and through-the-line negotiation. The protocol that turns an audit notification into a manageable commercial conversation.
Read the brief →A tone-disciplined letter sequence took a $7.4M opening to $1.9M closed. The work was in the prose, not the pricing.
Every result on this site is anonymised at the client’s request. Specific figures are real and verifiable through a confidentiality-protected reference call arranged on request.
The audit letter arrived during the second week of the retailer’s peak trading quarter. It carried a fourteen-day response demand and a request for a USMM run accompanied by full role-collection and authorisation-object exports. The retailer’s SAM team had a holiday-rotation skeleton crew on duty.
Internal counsel’s draft response was firm in tone, structured around a refusal of the request scope and a demand for clause-by-clause justification. The draft would have triggered an escalation. The audit history at this retailer included two prior escalations, both of which had cost more time and more legal spend than the original claim warranted.
We were brought in with a brief to rewrite the response. The brief was specifically a tone brief, not a content brief: the same factual content needed to be delivered in language that prevented escalation rather than invited it.
SAP’s opening claim landed at $7.4M. The structure suggested a junior analyst had built the claim from a template rather than a senior auditor from evidence — a useful indicator of how much of the claim was actually defensible.
Four tactics, four letters. Each letter carried specific evidence, was sent on a defined cadence, and was followed by an analyst-to-analyst call rather than an executive escalation.
We acknowledged the letter, confirmed receipt, confirmed the company’s commitment to compliance, and proposed a measurement window that excluded the peak trading quarter. The letter was three paragraphs long. It set the tone for the entire sequence. The peak-quarter exclusion was framed as a measurement-accuracy concern, not a refusal.
We submitted a reclassification analysis covering the 1,800 ESS users. Of those, 1,400 had no transactional activity that would justify reclassification under SAP’s own published definitions. The remaining 400 were confirmed at higher bands and settled at the contracted price. The $3.1M moved to $0.6M on this letter alone.
We submitted a document-flow analysis showing that the e-commerce platform routed orders through an integration layer that aggregated them before posting to SAP. The aggregation reduced the document count by sixty-eight percent. We proposed Digital Access conversion on the residual, at a fixed annual document allowance. The $2.8M moved to $0.9M.
We presented the SD engine measurement on a twelve-month rolling basis rather than the peak-quarter snapshot. The contractual measurement clause supported the twelve-month treatment. The $1.5M moved to $0.4M.
The settlement closed at $1.9M against the $7.4M opening. The named-user component settled at $0.6M, the indirect-access component at $0.9M, and the engine component at $0.4M. The settlement was paid as a single invoice within the same fiscal year.
The settlement letter included two contract amendments: (1) a measurement clause confirming twelve-month rolling-average treatment for the SD engine, and (2) a Digital Access definition tied to the e-commerce platform with a fixed annual document allowance. The amendments removed two of the three recurring exposure lines.
No escalation occurred during the engagement. The audit closed on the original timeline. The relationship with the SAP account team remained workable for the renewal conversation that opened nine months later.
The four-letter sequence was drafted under privilege, with each letter reviewed by external counsel before issue. The reclassification analysis used a twelve-month transaction-history window with documented exclusions for system-generated activity, scheduled-job activity, and integration-layer pass-through activity. The aggregation analysis on the e-commerce platform used the integration-layer log files as the primary evidence source, with cross-validation against the platform’s message broker. The engine-metric resmoothing was supported by the master agreement’s measurement clause, which had been negotiated at the prior renewal but never invoked during measurement.
We thought the first letter needed to be strong. The advisor showed us the first letter needed to be small. We never raised our voice for the entire eleven weeks. The number came down anyway.
Letter-stage response, document control, and through-the-line negotiation. The protocol that turns an audit notification into a manageable commercial conversation.
Read the brief →Document-flow rebuild, Digital Access conversion modelling, and the per-document price benchmarking that protects the next true-up.
Read the brief →Why letter tone determines settlement value. The disciplined sequence that preserves negotiation room.
The document flow, the deduplication pass, and the conversion decision. Where indirect access risk is actually controlled.
How a CFO-escalated $19.4M opening closed at $4.1M after a disciplined letter sequence.
Further reading: related white paper · cluster pillar · topic page
An audit notification is not an invoice. It is the opening position of a negotiation. The first conversation is at no cost and under privilege.
Contact Us →Every Wednesday. Field reports from active matters, decoded SAP communications, and what to look for in the next audit cycle. Work email only.