Are you ready for your next SAP audit?

A common misconception about software publishers is that they make all their revenue from software sales. In truth, a large portion of their revenue is also derived from auditing their customers. Every software publisher has their own rules regarding the auditing process and timelines. In general, publishers audit their customers at least once every few years. For SAP, the general rule is that in the first 2 years after signing your first contract with the vendor, there will be no audits. Then, the audits will take place annually.

It is important to realize that SAP contracts are seldom ‘standard’: rather, SAP typically concludes ‘bespoke’ contracts with customers. Depending on what you agreed with SAP and what is stated in your contract, there will sometimes be audits once every few years while other times you can be audited even multiple times a year. When it comes to audits, the contract is the leading document that you have to take into account and refer to.

How can you navigate the audit?

When you receive the measurement request from SAP, you might think that it’s just a routine matter and might hurry to send the results. Be aware that when SAP is requesting you to measure your data, this is with an intention to audit your usage. Therefore, you should always treat any request with utmost seriousness.

In our daily practice, we noticed that sometimes customers are not aware of what they need to submit exactly. They know they should submit USMM results, but is that all? The confusion comes because SAP is not stating clearly that USMM is not enough and that you should also use LAW and consolidate the reports.

Ideally, if you submit only the USMM reports, SAP should get back to you and advise on what else you need to do (e.g.: use LAW and consolidate the results). Unfortunately, this is not always the case. Hence, you need to pay attention to whatever you send towards SAP, as it can lead to unnecessary compliance issues. What you submit to SAP is your responsibility; as a customer you should analyze and review everything thoroughly, so that you have full knowledge of your measurement results and any potential cost implications arising.

To consolidate the USMM results with the LAW tool, more effort and knowledge is required from the customer’s side. Most times, this knowledge is not available in house, but that should not be an issue. There are many experienced consultants who can support you in this regard. Even if you might think that this is an additional investment, our experience is that you will find this an investment worth making. Working with specialists will help you avoid costs that otherwise SAP might unjustifiably charge you (e.g.: for additional licenses that you do not actually need).

Can you avoid the audit?

The short answer: yes, and no. The slightly longer answer involves an understanding of how SAP audits work. SAP runs two types of audits: basic and enhanced. Any of these audits will start by SAP requesting measurements of your data usage. The USMM (and LAW) reports that we discussed above are always part of the request. In addition, SAP will request measurement data of HANA, Database, Business Objects, self-declaration products and lately also Indirect Access.

The enhanced audit usually takes place on site, at the customer’s office. In some instances, this type of audit will be completed remotely, with the SAP auditors connecting to the customer’s systems. Usually there is additional data tackled and other actions performed, but what is requested always depends on the types of licenses that you are having.

Having an overview of how SAP audits work, you can see that avoiding the audit altogether is not entirely possible. However, you can postpone the audit by entering negotiations with SAP and getting into specific agreements or by changing the contract you are currently having to unlimited use (UDD). We recommend against this course of action. Remembering that there are no ‘free lunches’, our experience shows that even when SAP agrees to not proceed with a particular audit, you can expect that they will get back at you later with another request that might cost you more. As such, our recommendation would be to collaborate and go through the audit with a specialist on your side. Having someone who has the knowledge and can guide you through the audit process is an advantage that you can easily acquire; while it is also likely to be more cost effective than being ‘bounced’ into enhanced or revised contract from fear of the audit findings.

Even if you decide to go into negotiations with SAP in order to avoid the audit, it’s advisable to also do this with the support of a specialist.

How can you make sure that you are compliant?

Now that you know an SAP audit cannot be avoided without a (later) cost, you might wonder how you can make sure that you are compliant.

Firstly, before submitting any measurement results or any other input to SAP, have a specialist running through your reports. There is a high risk that the measurement seriously overstates the real value of your SAP license consumption. There can be a number of things that might cause this, such as notes not being implemented for engines or user clean-up not being carried out. An experienced consultant will know how to recognize when a report is not accurate and can support you to remediate the situation. This will help you to provide SAP with the real picture of what you have and what you actually use.

To make sure that you stay in control of your compliance, it is recommended that you have implemented guidelines within your organization. For example, performing regular user maintenance and engine checks, running measurements at least 3 months prior to the audit’s due date and being in control of connections with third party applications. Be aware that this is not a short term task that you can perform after you’ve received the measurement request from SAP, but a long term process that takes time and knowledge.