The SAP IDM Replacement Decision Most Mid-Market Organizations Are Getting Wrong


The evaluation starts. Three options get compared: SAP GRC for HANA 2026, a large enterprise IGA vendor, and potentially a purpose-built mid-market platform. The comparison framework focuses on SAP coverage, brand recognition, and cost. The enterprise IGA vendor has the most comprehensive capability set. SAP GRC is the familiar path. The mid-market platform is underweighted because it is less well-known.

The decision gets made. Then eighteen months later the compliance team starts asking why the governance posture looks the same as it did under SAP IDM — or why the implementation is still not complete.

The framework is the problem.

What the evaluation is missing

The standard comparison of SAP IDM replacement options focuses on capabilities. The comparison that produces the right decision focuses on three things the capability comparison misses.

The first is prerequisites. SAP GRC for HANA 2026 requires SAP HANA database and S/4HANA Foundation as prerequisites. Organizations on non-HANA databases face an additional database migration before upgrading to GRC 2026. That is not one migration, it is two sequential migrations. The timeline implication is significant and is frequently not surfaced until after the evaluation is complete.

The second is team fit. Enterprise IGA platforms are designed for organizations with dedicated IAM teams and 12 to 18 month implementation budgets. For a mid-market organization without a dedicated IAM function, the capability set is comprehensive and the implementation complexity frequently exceeds the team's capacity to operationalize it. A capable platform that is underutilized because the implementation exceeded the team's bandwidth is not a compliance success.

The third is governance scope. SAP IDM governed the SAP boundary. SAP GRC for HANA 2026 governs the SAP boundary. An evaluation that starts from SAP IDM parity will select a replacement that replicates the existing governance scope. Organizations that also run Microsoft 365, ServiceNow, Salesforce, and Workday alongside SAP have a governance gap that extends beyond the SAP boundary. The migration is the right moment to close that gap, not to replicate it.

What SAP IDM actually left ungoverned

SAP IDM provisioned access based on roles. It did not detect whether the combination of roles a user holds creates a Segregation of Duties violation. It did not govern access to any system outside SAP. It produced no cross-system access visibility and generated no SoD detection capability. Organizations that have been running SAP IDM for a decade have been running a governance architecture that was never designed to catch the conflicts auditors most commonly cite.

The migration from SAP IDM is an upgrade opportunity. Evaluations that frame the decision as replacing like-for-like are leaving that opportunity on the table.

The timeline math

SAP IDM mainstream maintenance ends December 31, 2027. A purpose-built mid-market replacement deploys in 6 to 12 weeks. Evaluation and procurement typically adds 4 to 8 weeks. An organization starting its evaluation now completes the migration in early 2027, with a full audit cycle on the new platform before the deadline.

An organization that treats this as a 2027 problem completes the migration under pressure, at or after the deadline, without audit runway.

The difference in outcome is significant. The difference in effort to avoid it is starting the evaluation in 2026 rather than 2027.

What path are organizations currently running SAP IDM leaning toward, and what is driving the decision? The experiences of teams mid-evaluation would be worth hearing.

Tap on the link below to know more:
https://www.openiam.com/soluti....ons/sap-compliance/s

How Pre-Built SAP SoD Rules Eliminate the Cold-Start Problem for Manufacturing Companies


For manufacturing companies running SAP, Segregation of Duties compliance sits at the intersection of two uncomfortable realities. The first is that SAP S/4HANA and ECC compliance obligations — under SOX, IFC, or COBIT-aligned frameworks — require demonstrable access controls that prevent any single individual from completing a financial transaction without independent oversight. The second is that building those controls from scratch, in a live SAP environment, takes longer than most audit calendars allow.

This is the cold-start problem. And it's why so many manufacturing SoD programs produce their first meaningful results the quarter after the audit that found the violations — rather than the quarter before.

Why SAP Access Control Violations Stay Hidden Without a Governance Layer

A common misconception is that SAP's role-based authorization model handles SoD. It doesn't — not in the way compliance programs require.

SAP ECC's authorization framework controls what a user can do. It does not analyze whether the combination of things a user can do creates a conflict. Roles are assigned based on job function, and over time — through promotions, temporary access, emergency grants that are never revoked, and role copies during upgrades — users accumulate access combinations that individually are appropriate but together create genuine fraud exposure.

SAP access control violations of this kind are invisible to SAP itself. There is no native mechanism that flags a user who holds both vendor creation and payment approval access, or both journal entry posting and approval. Detecting these conflicts requires a dedicated governance layer that continuously analyzes role assignments against a structured library of conflict rules — mapped to specific T-codes and authorization objects — and produces output that auditors can use directly.

Building that library is where most programs get stuck.

The Real Cost of Building Segregation of Duties in SAP From Scratch

A complete SAP SoD rule set for manufacturing needs to cover the modules where financial fraud risk actually lives: Financial Accounting, Materials Management, Sales and Distribution, Production Planning, Controlling, and Quality Management at minimum. For each module, the relevant transaction codes need to be identified, the conflicting combinations mapped, and each rule connected to a specific control objective — expressed in the language that internal and external auditors use when documenting findings.

Done properly, this is a 3–4 month exercise. It requires SAP module expertise — the technical knowledge of which T-codes and authorization objects govern which functions — and audit framework knowledge — the understanding of which control objectives map to SOX Section 404, PCAOB AS 2201, IFC under the Companies Act 2013, or COBIT 2019. Most internal teams have one of these capabilities. Few have both. Fewer still have the bandwidth to apply them simultaneously while managing a live SAP environment.

The result is predictable: the program starts, stalls during the rule-building phase, and the audit arrives before the first scan runs.

What Pre-Built Rules Actually Change

The cold-start problem is not a capability problem — it's a time-to-value problem. Pre-built, audit-aligned SAP SoD rules for manufacturing solve it directly.

When a SoD rule set ships as a product capability — ready to load the moment the platform connects to SAP — the sequence changes entirely. Connection, rule set load, first violation scan: hours, not months. Every rule already maps to the relevant SAP T-codes and authorization objects. Every control objective is already expressed in audit language. The output of the first scan is formatted as evidence — not as an IT report that requires translation before a compliance team can use it.

For a manufacturing company with a SOX audit scheduled in the next two quarters, this distinction is the difference between being ready and not being ready.

Risk Levels That Match Audit Priority

Not all SoD conflicts carry equal weight — and a well-structured rule set reflects this. The most useful frameworks organize rules into risk tiers that map directly to how auditors prioritize their testing.

Critical rules represent conflicts that appear most often in actual audit findings: a user who can create a vendor master and execute the payment run (MFG-FI-001), a user who can post and approve their own journal entries (MFG-FI-003), or a user who can create a purchase order and confirm goods receipt (MFG-MM-002). These are the conflicts that become significant deficiencies or material weaknesses when auditors find them. They require remediation before the next audit cycle — not after.

High-risk rules cover conflicts with significant financial reporting exposure that are actively tested in most audit engagements. Medium-risk rules represent best practice controls — important for a mature compliance program and increasingly relevant as audit scope expands.

Organizing remediation effort around this tiering means compliance teams address the highest-exposure conflicts first, produce demonstrable progress quickly, and build toward a comprehensive program over subsequent cycles.

S/4HANA Compatibility and Migration Protection

A concern that comes up consistently in manufacturing SAP environments is SAP S/4HANA compliance continuity during migration. Organizations mid-journey from ECC 6.0 to S/4HANA need assurance that their SoD program doesn't need to be rebuilt when the platform changes.

The answer lies in how SAP has handled the transition. SAP has preserved ECC transaction codes in S/4HANA for backwards compatibility, and the core authorization objects used in financial and logistics SoD rules — F_BKPF_BUK, M_BEST_BSA, V_VBAK_AAT — are unchanged across both platforms. Where S/4HANA introduces Fiori apps that replace specific T-codes, the equivalent Fiori app permissions and authorization objects can be mapped to the same underlying control. The compliance investment survives the migration as a configuration update, not a rebuild.

Extending Beyond SAP

One limitation worth addressing directly: SOX ITGC controls in SAP don't exist in isolation. A financial controls auditor doesn't stop at the SAP boundary. Access governance across Microsoft 365, Salesforce, ServiceNow, and other connected systems is increasingly part of the same audit scope — and a SoD program that covers SAP but leaves everything else ungoverned produces an incomplete picture.

The most effective approach treats SAP SoD as the foundation and extends governance to the full IT landscape from the same platform. One access certification campaign. One audit report. SAP and every connected system covered together.

The Practical Path Forward

For manufacturing companies facing a real audit deadline, the practical question isn't whether to build a SoD program — it's how to get one operational before the next engagement begins.

OpenIAM's SoD Accelerator for SAP — Manufacturing Edition delivers 140 pre-built rules across nine SAP module groups, mapped to SOX, IFC, and COBIT control objectives, compatible with SAP ECC 6.0 and S/4HANA, and ready to run on day one. The first violation scan completes within hours of connection. No rule-building phase. No consultant engagement required to get to value.

The cold-start problem is solved before the audit calendar forces the issue.

Explore the full SAP SoD rule set for manufacturing →
https://www.openiam.com/soluti....ons/sap-compliance/s

Why SAP SoD Programs Stall Before They Start — and the Cold-Start Problem Nobody Talks About
The audit finding arrives and the narrative is always the same. A user in accounts payable had the ability to both create a vendor master record and execute the automatic payment run. No individual role assignment was wrong. No one deliberately built the conflict. It accumulated quietly over two years of normal business operations — a role copied for convenience, temporary access from a previous position that was never revoked, an organizational change that nobody mapped back to the access model.

The conflict sat undetected. The auditor found it.

This is not an unusual scenario. It is the standard pattern for how SoD violations surface in mid-market SAP environments. And the reason it happens is not that organizations are negligent about access control. It is that most SoD programs never actually get started, for a reason that is almost never named directly in the conversation about why the finding occurred.

The Cold-Start Problem

Ask any IT Audit Manager who has tried to implement SoD detection in SAP without a GRC consulting engagement and the description of the experience is consistent. They understand what SoD means and why it matters. They can point to the specific control objective the violation is tied to. What they cannot easily produce is a practical, implementable set of rules that maps SAP transaction codes to audit control objectives — structured in a way that can be loaded into a detection tool and run against actual role assignments without months of internal build work.

Building a SAP SoD rule set from scratch in a mid-size environment means mapping transaction codes to authorization objects, assigning risk levels, connecting each rule to a specific control objective, and writing audit-ready remediation guidance for every conflict. The realistic estimate for a team with genuine SAP authorization expertise is three to four months. Most mid-market IT audit teams do not have that expertise in-house, and most do not have three to four months of capacity to allocate to a rule-building project before the next audit cycle begins.

The result is that the SoD program gets deferred. Not cancelled — deferred. The intention to implement it remains. The tool that will eventually run it may even be selected. But because the rule set does not exist, the first scan cannot run, and because the first scan cannot run, the violations that already exist in the environment continue to accumulate undetected. By the time the program is actually implemented, the remediation effort is significantly larger than it would have been eighteen months earlier.

This is the cold-start problem. It is the primary reason most mid-market SAP SoD programs fail before they produce a single violation report. The conversation about the audit finding rarely mentions it because by the time the finding occurs, the question of why the program was never implemented has been replaced by the more immediate question of what to do about the finding.

Why SAP Alone Cannot Solve This

Understanding why SoD violations accumulate in SAP environments requires understanding what SAP's authorization framework was and was not designed to do.

SAP's authorization model is built around individual role assignments. When a user is assigned a role, SAP validates that the role exists and that the assignment follows the defined process. What SAP does not evaluate is whether that user already holds another role that, in combination with the new one, creates a conflict — a situation where a single person can execute both sides of a transaction that should require independent oversight.

This is not a flaw in SAP. It is a design boundary. SAP is an enterprise resource planning system. Segregation of duties enforcement is a governance control that sits above the ERP layer. SAP manages what users can do individually. SoD detection determines what users can do in combination across their full role portfolio — a different and analytically more complex question that requires a rule set, cross-role analysis, and audit-ready output. None of these three elements ships with SAP.

SAP GRC Access Control can provide SoD enforcement within the SAP boundary, but only after a rule set has been built. It also stops at the SAP boundary — it does not detect conflicts created by the combination of SAP access and access to Microsoft 365, Salesforce, or other connected systems. For organizations where the same users who hold SAP financial roles also hold administrative access in connected systems, the SoD picture that SAP GRC produces is incomplete by design.

What the T-Code Level Actually Means for Audit Evidence

There is a specificity question in SoD detection that is worth understanding before evaluating any detection tool. SOX audit findings are documented at the transaction code level. IFC management assertions reference T-codes. PCAOB audit workpapers reference T-codes. When an auditor finds an SoD conflict, the finding names the specific SAP transaction codes that created it, the control objective at risk, and the remediation required.

A detection tool that works above the T-code level produces output that needs to be translated before an auditor can use it. That translation step is where audit cycles are lost and where the conversation between the IT audit team and the external auditor becomes unnecessarily complex.

Detection at the T-code level means the output of a scan is directly usable by an auditor without transformation. The violation names the specific T-codes in conflict. The control objective is mapped. The remediation guidance is included. The auditor receives a document that matches the format and specificity of the finding they would write themselves.

For mid-market organizations without dedicated audit support teams, the difference between output that requires transformation and output that does not is frequently the difference between a SoD program that produces audit value and one that produces reports nobody fully acts on.

What a Rule Set That Ships Pre-Built Actually Changes

The cold-start problem is structural, which means the solution is structural. The most direct way to eliminate a three-to-four month rule-building phase is to not require one.

A pre-built SoD rule set for a specific industry and SAP module coverage — curated from ISACA, PCAOB, and SAP authorization documentation, mapped to control objectives across SOX, IFC, and COBIT, validated against the conflict patterns that appear most consistently in actual audit findings — eliminates the cold-start delay entirely. The first scan runs on the day the tool connects to SAP. The violation report is formatted for audit review from the moment it is generated.

This changes the SoD program timeline in a way that is practically significant. An IT Audit Manager who connects a pre-built rule set to a SAP ECC environment on a Monday can have a violation report on that environment by Wednesday — not three months later. The violations that have been accumulating undetected can be surfaced and remediated before the next audit cycle rather than discovered by the auditor during it.

The audit finding that opened this piece — the accounts payable lead with vendor creation and payment execution access — would have been detected within hours of the tool being connected. The 26-month accumulation window that made the finding possible exists because the detection program was never implemented. The detection program was never implemented because the rule set was never built.

That is the problem the cold-start solution solves.

For pre-built SoD rule sets for SAP manufacturing and financial services environments, including T-code level detection mapped to SOX, IFC, and COBIT control objectives, visit
https://www.openiam.com/soluti....ons/sap-compliance/s

SAP Compliance in Manufacturing: The SoD Violations Your Team Missed

Every manufacturing company running SAP has been there. The audit wraps up, and the findings list lands on your desk — SoD conflicts, orphaned accounts, access that should have been revoked six months ago. Maintaining SAP compliance isn't just a checkbox exercise; it's an ongoing battle that most teams are fighting with the wrong tools. Your team didn't catch them. Your auditor did. And now you're spending the next quarter explaining why.

The frustrating part? None of this is a failure of effort. It's a failure of tools.

The Problem Isn't Your Team — It's the Gap in Your Toolset

SAP environments in manufacturing grow organically. Over years of promotions, role copies, and emergency access grants that never get cleaned up, users accumulate permissions that nobody consciously intended them to have. Someone ends up with the ability to both create a vendor and approve a payment run. Another person can post and approve journal entries. These are textbook Segregation of Duties (SoD) violations — and SAP's native role management doesn't prevent them from happening.

Manual quarterly reviews don't reliably catch them either. By the time your team runs a spreadsheet-based access review, the violations have been sitting there for months. SOX auditors, on the other hand, know exactly where to look.

This is the core challenge of SAP compliance for manufacturing: the tools most organizations rely on — native SAP role management, periodic manual reviews, and even SAP GRC — weren't built to close every gap. SAP GRC is a strong tool, but it governs the SAP boundary only. Every system outside SAP — Microsoft 365, Salesforce, ServiceNow, your SaaS applications — sits outside its reach.

The SAP IDM Problem Making Things Worse

If you're running SAP Identity Management, you already know the clock is ticking. SAP IDM is heading toward end of mainstream maintenance, and the replacement options most teams evaluate first aren't a clean fit for manufacturing companies.

SAP GRC expanded? It still won't govern your non-SAP systems. An enterprise IGA platform? Most of them are scoped and priced for organizations with a dedicated IAM team and an 18-month implementation runway. If your next SOX audit is in six months, neither of those options solves your immediate problem.

What manufacturing companies actually need is an SAP IDM replacement that delivers full functional parity — role-based provisioning, access certifications, lifecycle management — while extending governance beyond the SAP boundary instead of replicating the same limitation.

SuccessFactors Knows Who Works Here. Your Access Doesn't Reflect It.

Here's another gap that auditors consistently flag: the disconnect between HR records and actual system access.

When an employee joins, changes roles, or leaves, SuccessFactors records it immediately. But if that HR event doesn't automatically trigger access changes across SAP and connected systems, you end up with leavers who still have active accounts weeks after offboarding, new starters waiting days for Day 1 access, and role changes that never got reflected in permissions.

This is where SuccessFactors access management breaks down in most manufacturing environments — not because the HR system fails, but because nothing connects it to the governance layer. The result is a trail of ITGC findings that your auditor notices before your team does.

Automated joiner-mover-leaver workflows that treat SuccessFactors as the source of truth — and immediately act on every HR event across every connected system — are what close this gap for good.

What Closing the Gap Actually Looks Like

Effective SAP identity governance for manufacturing comes down to three things working together:

SoD enforcement that starts on day one. Building a complete SoD rule set from scratch typically takes internal teams three to four months — if they have the right SAP module expertise and audit framework knowledge. Pre-built, industry-specific rule sets mapped to SOX control objectives and SAP T-codes let you run your first scan and see violations immediately, without a months-long build phase.

An IDM replacement that extends beyond SAP. The goal isn't just replicating what SAP IDM did. It's replacing it with something that governs SAP, Microsoft 365, and every connected system from a single platform — so one access certification campaign covers everything, not just the SAP boundary.

HR-driven lifecycle automation. Every joiner, mover, and leaver event in SuccessFactors should automatically provision, adjust, or revoke access across all connected systems. Every action should be timestamped and logged as audit evidence. No manual compilation before audit cycles. No gaps between what HR records and what access reflects.

The Audit Doesn't Have to Find It First

Manufacturing companies using SAP face the same compliance obligations as the largest enterprises — SOX, ITGC, SoD requirements — but rarely with the dedicated IAM teams those enterprises have. The answer isn't a bigger, more expensive platform. It's one that's built for the environment you actually have.

OpenIAM is purpose-built for exactly this: SAP compliance for manufacturing companies, with native connectors across S/4HANA, ECC 6.0, SuccessFactors, Fiori, and UME, pre-built SoD rule sets that ship with the product, and deployment measured in weeks rather than quarters.

If your last audit found something your team didn't, it's worth looking at what's missing between your HR system, your SAP environment, and everything connected to it.

Explore OpenIAM's SAP compliance solution for manufacturing →
https://www.openiam.com/solutions/sap-compliance

The Reason Regulated CIAM Evaluations Produce the Wrong Outcome


Most regulated enterprises evaluate CIAM platforms the same way they evaluate every enterprise software category. Requirements are gathered. A shortlist is assembled. Demos are scheduled. Capabilities are scored. A selection is made.

The process is thorough. The outcome is frequently wrong.

Not because the evaluation teams are careless. Because the standard enterprise evaluation methodology was designed for selecting tools. A CIAM platform in a regulated environment is governance infrastructure. The criteria that determine whether it will perform under regulatory examination are largely invisible in a vendor demonstration.

The evaluation is shaped by the problem that initiated it. Usually, that is a login problem. Authentication is fragmented. The current platform cannot support modern credential standards. These are legitimate reasons to evaluate. They are not the right lens for selection.

The login problem is solved in the demo. The governance problem surfaces in the audit.

When a regulatory examination asks for the complete access and consent decision trail for a specific customer interaction at a specific point in time, the answer must come from a system that evaluated consent at the moment the access occurred and recorded that evaluation. A platform that stores consent and distributes it to downstream systems cannot produce this evidence. The enforcement decision was not made centrally. It was delegated to systems that applied their own logic to the records they received.

In a demonstration, this distinction is invisible. A preference center and a consent database look the same whether consent is enforced at authorization or merely stored. The difference only becomes visible when a specific enforcement evidence scenario is tested against the platform in a proof-of-concept environment, not when general consent capabilities are reviewed.

The same gap applies to deployment model. For regulated enterprises with data residency requirements, sovereign infrastructure mandates, or classified system boundaries, deployment model is not a preference. It is a hard constraint that determines whether a platform can be used at all. Standard evaluations assess this near the end of the process, after preferences have been established. When deployment incompatibility is discovered at that stage, the evaluation must restart or the organization must accept a model its legal team has already rejected.

Deployment constraint assessment belongs at the beginning. Any platform that cannot satisfy deployment requirements should be eliminated before functional evaluation begins.

A regulated CIAM evaluation that surfaces the right information looks different from a standard software selection. It begins with constraint documentation before any vendor is engaged. It uses governance scenarios defined by the evaluation team as the proof-of-concept structure, not vendor demonstration scripts. It weights governance criteria at least equally to authentication capabilities. It requires references who have operated the platform under real regulatory examination conditions, not demo environment conditions. And it builds a complete total cost of ownership model that includes the cost of any additional tools required for governance capabilities the base platform does not include.

This process takes longer. It also surfaces the information that determines whether the platform selected will perform when it matters.

For a structured evaluation framework covering the four most costly evaluation mistakes, twelve specific questions to ask every platform in evaluation, and scenario guidance for financial services, government, Entra-first environments, and India and SAARC, see: CIAM Buyer's Guide for Regulated Enterprises.
https://www.openiam.com/use-ca....ses/ciam-buyers-guid