Why Manufacturing Auditors Are Moving Beyond SAP — And What That Means for Access Governance

Author : Tushar Pansare | Published On : 12 Aug 2026

For most manufacturing companies, the identity governance conversation starts with SAP. That makes sense. SAP sits at the center of procurement, production, quality, plant maintenance, payroll, and finance. It is where the most visible SAP Segregation of Duties violations live, and it is where auditors have traditionally focused their attention. Managing SAP access risk in manufacturing environments has become a board-level concern — and for good reason.

But something has changed in how audits are being conducted — and manufacturers who have invested heavily in SAP access controls are discovering that a strong SAP posture is no longer sufficient to satisfy an audit examiner.

The question auditors are increasingly asking is not simply "does a conflict exist?" It is: "what did you do about it, when did you do it, and can you prove it?"

The access evidence problem

Manufacturing organizations sit on enormous volumes of identity data. SAP exports, directory snapshots, HR records, ticket approvals, spreadsheet reviews — data exists in many places across the enterprise. The problem is not access data. The problem is access evidence.

Evidence is data connected to decisions. It is the audit trail that shows a responsible business owner reviewed a high-risk access combination, made a determination, and either removed the access, split the role, or documented a compensating control with a rationale and a timestamp. That chain — from risk identification to decision to outcome — is what auditors now expect to see in a single, coherent record.

Most manufacturing companies cannot produce it without reconstructing the story manually from exports, emails, and disconnected systems.

Why SAP-native controls have a blind spot

SAP access controls are designed to govern the SAP environment. They were never designed to govern the identity lifecycle that surrounds it.

Consider a straightforward example: a procurement analyst holds a dangerous access combination in SAP — the ability to create a vendor record and approve a purchase order. An SAP GRC scan will detect that conflict. But the same analyst also transitioned from a plant in Germany to a regional headquarters role six months ago. Their SAP access was never updated to reflect the new role. The HR system recorded the transfer; the access was never changed.

The SAP control found the conflict. The governance process failed to prevent it — because the joiner-mover-leaver lifecycle that should have triggered an access review when the role changed is managed outside SAP, in HR and identity infrastructure that no SAP-native tool governs.

This is the blind spot. And it is not an edge case. The full scope of SAP access risk manufacturing environments carry is significantly broader than what any SAP-native tool can see — multiple plants, frequent role changes, contractor populations, and legacy access accumulation make this the norm, not the exception.

The ten conflicts that matter most

Not all SAP SoD conflicts carry equal weight. In manufacturing, the highest-risk combinations are cross-functional — they span two separate business processes, giving a single user the ability to initiate and complete a transaction without any independent check. These dangerous SAP role combinations are at the core of what auditors test first, and they represent the most serious SAP SoD conflicts manufacturing security teams need to address.

The most dangerous include the vendor master and payment run combination, where a single user can introduce a fictitious supplier and release funds to it without review; the production order creation and confirmation conflict, where fictitious manufacturing activity can be recorded and costs charged without corresponding physical work; and the SAP Basis conflict, where a user who can create accounts and assign roles effectively holds a master key to the entire SAP environment.

Each of these conflicts is well understood. What is less well understood is that finding them is only the beginning. The control objective — and the audit objective — is to demonstrate what happened next. For a complete breakdown of the ten most dangerous SAP access conflicts in manufacturing and the governance response each requires, the full analysis is available here: The 10 Most Dangerous SAP Access Conflicts in Manufacturing.

What modern manufacturing governance requires

Closing the evidence gap requires more than better SAP tooling. It requires a governance layer that connects the SAP environment to the identity lifecycle around it — HR systems, directory services, contractor management, privileged access, and the plant applications that auditors are increasingly testing alongside SAP. SAP access control in manufacturing cannot operate effectively as an island; the SAP SoD rules manufacturing teams rely on need to extend into the systems and processes that surround SAP. SAP access control manufacturing teams build today must be enterprise-wide, not SAP-only.

The practical model is one in which access requests are validated for SoD conflicts before they are fulfilled, not after. Where joiner, mover, and leaver events in HR automatically trigger access reviews in SAP and connected systems. Where every review decision — approve, revoke, accept risk, document compensating control — is retained in a single audit trail that does not require manual reconstruction when an examiner asks for it.

This is not a vision of the future. It is the operating model that manufacturing companies under active audit pressure are building now, often accelerated by the end-of-maintenance timeline for SAP Identity Management and the need to modernize identity infrastructure before that window closes.

The conversation has shifted

Manufacturing CIOs and CISOs who frame identity governance as an SAP problem will continue to find gaps. The audit surface has expanded — not because SAP has become less important, but because auditors have become more thorough.

The manufacturers who are best positioned are those who have stopped treating SAP governance and enterprise identity governance as separate programs, and started building the evidence trail that spans both.

That is where the audit is going. The governance program needs to follow.

For the full breakdown of the ten highest-risk SAP access conflicts in manufacturing — including why each is hard to detect and what the right governance response looks like — read the full article: The 10 Most Dangerous SAP Access Conflicts in Manufacturing.