SAP License Audits Contact Us
Home · Case Studies · Case File 012 · Audit Letter Response

$7.4M opening. $1.9M closed.

A tone-disciplined letter sequence took a $7.4M opening to $1.9M closed. The work was in the prose, not the pricing.

Global retail flagship store interior
Industry
Global Retail
Geography
UK · EU · North America
SAP Estate
ECC + S/4HANA + Ariba
In Scope
28,000 SAP users
— Case File 012 · Audit Letter Response

The headline numbers, on the record.

Every result on this site is anonymised at the client’s request. Specific figures are real and verifiable through a confidentiality-protected reference call arranged on request.

Opening claim
$7.4M
audit letter position
Settlement
$1.9M
final close
Reduction
74%
vs. opening claim
Duration
11wk
letter to close
Section I · The Brief

The letter

The audit letter arrived during the second week of the retailer’s peak trading quarter. It carried a fourteen-day response demand and a request for a USMM run accompanied by full role-collection and authorisation-object exports. The retailer’s SAM team had a holiday-rotation skeleton crew on duty.

Internal counsel’s draft response was firm in tone, structured around a refusal of the request scope and a demand for clause-by-clause justification. The draft would have triggered an escalation. The audit history at this retailer included two prior escalations, both of which had cost more time and more legal spend than the original claim warranted.

We were brought in with a brief to rewrite the response. The brief was specifically a tone brief, not a content brief: the same factual content needed to be delivered in language that prevented escalation rather than invited it.

Section II · The Opening Claim

The opening position

SAP’s opening claim landed at $7.4M. The structure suggested a junior analyst had built the claim from a template rather than a senior auditor from evidence — a useful indicator of how much of the claim was actually defensible.

The $7.4M breakdown

Section III · The Defence

The defence

Four tactics, four letters. Each letter carried specific evidence, was sent on a defined cadence, and was followed by an analyst-to-analyst call rather than an executive escalation.

1. Letter one — scope acknowledgement

We acknowledged the letter, confirmed receipt, confirmed the company’s commitment to compliance, and proposed a measurement window that excluded the peak trading quarter. The letter was three paragraphs long. It set the tone for the entire sequence. The peak-quarter exclusion was framed as a measurement-accuracy concern, not a refusal.

2. Letter two — named-user evidence

We submitted a reclassification analysis covering the 1,800 ESS users. Of those, 1,400 had no transactional activity that would justify reclassification under SAP’s own published definitions. The remaining 400 were confirmed at higher bands and settled at the contracted price. The $3.1M moved to $0.6M on this letter alone.

3. Letter three — indirect-access scoping

We submitted a document-flow analysis showing that the e-commerce platform routed orders through an integration layer that aggregated them before posting to SAP. The aggregation reduced the document count by sixty-eight percent. We proposed Digital Access conversion on the residual, at a fixed annual document allowance. The $2.8M moved to $0.9M.

4. Letter four — engine-metric smoothing

We presented the SD engine measurement on a twelve-month rolling basis rather than the peak-quarter snapshot. The contractual measurement clause supported the twelve-month treatment. The $1.5M moved to $0.4M.

Section IV · The Settlement

The settlement

The settlement closed at $1.9M against the $7.4M opening. The named-user component settled at $0.6M, the indirect-access component at $0.9M, and the engine component at $0.4M. The settlement was paid as a single invoice within the same fiscal year.

The settlement letter included two contract amendments: (1) a measurement clause confirming twelve-month rolling-average treatment for the SD engine, and (2) a Digital Access definition tied to the e-commerce platform with a fixed annual document allowance. The amendments removed two of the three recurring exposure lines.

No escalation occurred during the engagement. The audit closed on the original timeline. The relationship with the SAP account team remained workable for the renewal conversation that opened nine months later.

Section V · Lessons Applicable

The lessons

Section VI · Methodology Note

The methodology behind the letter sequence

The four-letter sequence was drafted under privilege, with each letter reviewed by external counsel before issue. The reclassification analysis used a twelve-month transaction-history window with documented exclusions for system-generated activity, scheduled-job activity, and integration-layer pass-through activity. The aggregation analysis on the e-commerce platform used the integration-layer log files as the primary evidence source, with cross-validation against the platform’s message broker. The engine-metric resmoothing was supported by the master agreement’s measurement clause, which had been negotiated at the prior renewal but never invoked during measurement.

We thought the first letter needed to be strong. The advisor showed us the first letter needed to be small. We never raised our voice for the entire eleven weeks. The number came down anyway.

Director of Procurement TechnologyGlobal Retail Group · Q1 2026
Continue with the firm

The two services this matter drew on.

I.

SAP Audit Defence

Letter-stage response, document control, and through-the-line negotiation. The protocol that turns an audit notification into a manageable commercial conversation.

Read the brief →
V.

Digital Access Negotiation

Document-flow rebuild, Digital Access conversion modelling, and the per-document price benchmarking that protects the next true-up.

Read the brief →
Related reading

From the research desk.

— Audit Letter Response

Audit letter tone and language patterns

Why letter tone determines settlement value. The disciplined sequence that preserves negotiation room.

Article
— Indirect Access

Indirect access, the buyer-side view

The document flow, the deduplication pass, and the conversion decision. Where indirect access risk is actually controlled.

Topic
— Case Studies

Manufacturing conglomerate audit escalation defence

How a CFO-escalated $19.4M opening closed at $4.1M after a disciplined letter sequence.

Case File

Further reading: related white paper · cluster pillar · topic page

Speak with a specialist.

An audit notification is not an invoice. It is the opening position of a negotiation. The first conversation is at no cost and under privilege.

Contact Us →
— Subscribe

SAP Audit Alerts · The weekly briefing

Every Wednesday. Field reports from active matters, decoded SAP communications, and what to look for in the next audit cycle. Work email only.