SAP IDM Is Ending. The Decision Most Manufacturers Are About to Make Will Determine Their Compliance Posture for the Next Decade.


Planning and migration for complex manufacturing environments typically require 18 to 36 months. An organization that begins evaluating options in mid-2026 completes the migration with time to validate the new platform and run at least one audit cycle before the December 2027 mainstream maintenance deadline. An organization that treats this as a 2027 problem makes the decision under deadline pressure, with less time to evaluate alternatives and less capacity to design a governance model rather than execute a migration path.

The organizations that navigate SAP IDM end-of-maintenance well are not those that execute the most efficient migration. They are those that use the forced migration as a forcing function to build the governance model they should have had years ago. The migration timeline is fixed. The governance decision made within it is not.

For a full treatment of the governance capabilities manufacturing companies need from an SAP IDM replacement, including the planning questions, the governance model, and the seven-step framework, visit

https://www.openiam.com/blog/s....ap-idm-replacement-g

Your SAP access review is done. Your auditor is not impressed.

Here is a scenario that plays out more often than most manufacturing security teams want to admit.

The quarterly access review is complete. Managers signed off. The spreadsheet is filed. The GRC team closes the ticket.

Six weeks later, an auditor asks why a plant procurement analyst held the ability to both create a vendor record and approve a purchase order for the better part of two years.

The answer — reconstructed from email threads, SAP exports, and a ticket that was closed without evidence of remediation — takes three days to pull together. It is not convincing.

This is not an SAP problem. It is a governance problem.

The conflict was never the issue

SAP SoD conflicts manufacturing security teams face are well understood. The dangerous SAP role combinations — vendor master plus payment run, production order creation plus confirmation, payroll bank account plus payroll execution — have been documented, debated, and flagged in GRC systems for years.

What manufacturing security teams consistently underestimate is how much work comes after the detection.

An auditor does not want to know that you found a conflict. An auditor wants to know:

Who reviewed it?
When?
What did they decide?
Was the access removed, or was a compensating control documented?
Where is the evidence?

A spreadsheet that was reviewed, approved, and filed tells you none of those things clearly. It tells you a list existed and someone ticked boxes. That is not audit evidence. That is audit theater.

The real gap is the evidence trail

The ten most dangerous SAP access conflicts in manufacturing are not secrets. What is less visible is the gap between detecting them and proving — to an external examiner, months later — that the right people reviewed them and the right actions were taken.

That gap is where audit findings are born.

It is also where the conversation about SAP access governance needs to go. Not just: do we have SAP SoD rules manufacturing teams can rely on? But: when a conflict is found, does our process produce a defensible, timestamped record of what happened next? The full SAP access risk manufacturing environments carry goes well beyond what a GRC scan captures. And they build SAP access control manufacturing programs around structured governance records, not closed tickets and archived spreadsheets.

What this looks like in practice

The manufacturers who handle this well share a few things in common. They validate SAP Segregation of Duties violations at the access request stage — before access is assigned, not after. They connect their HR lifecycle to their SAP environment, so role changes and terminations actually trigger access reviews. And they build SAP access control in manufacturing around structured governance records, not closed tickets and archived spreadsheets.

The result is not just better audit outcomes. It is a program that can answer the auditor's question in minutes, not days.

If you are working through SAP access risk in a manufacturing environment — or preparing for an audit that will go beyond SAP — the full breakdown of the ten most dangerous SAP SoD conflicts, and what the right governance response looks like for each, is worth reading:

The 10 Most Dangerous SAP Access Conflicts in Manufacturing →

https://www.openiam.com/blog/d....angerous-sap-access-

What has your experience been with SAP access reviews under audit pressure? Happy to discuss in the comments.

The SAP IDM Replacement Decision Most Mid-Market Organizations Are Getting Wrong


The evaluation starts. Three options get compared: SAP GRC for HANA 2026, a large enterprise IGA vendor, and potentially a purpose-built mid-market platform. The comparison framework focuses on SAP coverage, brand recognition, and cost. The enterprise IGA vendor has the most comprehensive capability set. SAP GRC is the familiar path. The mid-market platform is underweighted because it is less well-known.

The decision gets made. Then eighteen months later the compliance team starts asking why the governance posture looks the same as it did under SAP IDM — or why the implementation is still not complete.

The framework is the problem.

What the evaluation is missing

The standard comparison of SAP IDM replacement options focuses on capabilities. The comparison that produces the right decision focuses on three things the capability comparison misses.

The first is prerequisites. SAP GRC for HANA 2026 requires SAP HANA database and S/4HANA Foundation as prerequisites. Organizations on non-HANA databases face an additional database migration before upgrading to GRC 2026. That is not one migration, it is two sequential migrations. The timeline implication is significant and is frequently not surfaced until after the evaluation is complete.

The second is team fit. Enterprise IGA platforms are designed for organizations with dedicated IAM teams and 12 to 18 month implementation budgets. For a mid-market organization without a dedicated IAM function, the capability set is comprehensive and the implementation complexity frequently exceeds the team's capacity to operationalize it. A capable platform that is underutilized because the implementation exceeded the team's bandwidth is not a compliance success.

The third is governance scope. SAP IDM governed the SAP boundary. SAP GRC for HANA 2026 governs the SAP boundary. An evaluation that starts from SAP IDM parity will select a replacement that replicates the existing governance scope. Organizations that also run Microsoft 365, ServiceNow, Salesforce, and Workday alongside SAP have a governance gap that extends beyond the SAP boundary. The migration is the right moment to close that gap, not to replicate it.

What SAP IDM actually left ungoverned

SAP IDM provisioned access based on roles. It did not detect whether the combination of roles a user holds creates a Segregation of Duties violation. It did not govern access to any system outside SAP. It produced no cross-system access visibility and generated no SoD detection capability. Organizations that have been running SAP IDM for a decade have been running a governance architecture that was never designed to catch the conflicts auditors most commonly cite.

The migration from SAP IDM is an upgrade opportunity. Evaluations that frame the decision as replacing like-for-like are leaving that opportunity on the table.

The timeline math

SAP IDM mainstream maintenance ends December 31, 2027. A purpose-built mid-market replacement deploys in 6 to 12 weeks. Evaluation and procurement typically adds 4 to 8 weeks. An organization starting its evaluation now completes the migration in early 2027, with a full audit cycle on the new platform before the deadline.

An organization that treats this as a 2027 problem completes the migration under pressure, at or after the deadline, without audit runway.

The difference in outcome is significant. The difference in effort to avoid it is starting the evaluation in 2026 rather than 2027.

What path are organizations currently running SAP IDM leaning toward, and what is driving the decision? The experiences of teams mid-evaluation would be worth hearing.

Tap on the link below to know more:
https://www.openiam.com/soluti....ons/sap-compliance/s

How Pre-Built SAP SoD Rules Eliminate the Cold-Start Problem for Manufacturing Companies


For manufacturing companies running SAP, Segregation of Duties compliance sits at the intersection of two uncomfortable realities. The first is that SAP S/4HANA and ECC compliance obligations — under SOX, IFC, or COBIT-aligned frameworks — require demonstrable access controls that prevent any single individual from completing a financial transaction without independent oversight. The second is that building those controls from scratch, in a live SAP environment, takes longer than most audit calendars allow.

This is the cold-start problem. And it's why so many manufacturing SoD programs produce their first meaningful results the quarter after the audit that found the violations — rather than the quarter before.

Why SAP Access Control Violations Stay Hidden Without a Governance Layer

A common misconception is that SAP's role-based authorization model handles SoD. It doesn't — not in the way compliance programs require.

SAP ECC's authorization framework controls what a user can do. It does not analyze whether the combination of things a user can do creates a conflict. Roles are assigned based on job function, and over time — through promotions, temporary access, emergency grants that are never revoked, and role copies during upgrades — users accumulate access combinations that individually are appropriate but together create genuine fraud exposure.

SAP access control violations of this kind are invisible to SAP itself. There is no native mechanism that flags a user who holds both vendor creation and payment approval access, or both journal entry posting and approval. Detecting these conflicts requires a dedicated governance layer that continuously analyzes role assignments against a structured library of conflict rules — mapped to specific T-codes and authorization objects — and produces output that auditors can use directly.

Building that library is where most programs get stuck.

The Real Cost of Building Segregation of Duties in SAP From Scratch

A complete SAP SoD rule set for manufacturing needs to cover the modules where financial fraud risk actually lives: Financial Accounting, Materials Management, Sales and Distribution, Production Planning, Controlling, and Quality Management at minimum. For each module, the relevant transaction codes need to be identified, the conflicting combinations mapped, and each rule connected to a specific control objective — expressed in the language that internal and external auditors use when documenting findings.

Done properly, this is a 3–4 month exercise. It requires SAP module expertise — the technical knowledge of which T-codes and authorization objects govern which functions — and audit framework knowledge — the understanding of which control objectives map to SOX Section 404, PCAOB AS 2201, IFC under the Companies Act 2013, or COBIT 2019. Most internal teams have one of these capabilities. Few have both. Fewer still have the bandwidth to apply them simultaneously while managing a live SAP environment.

The result is predictable: the program starts, stalls during the rule-building phase, and the audit arrives before the first scan runs.

What Pre-Built Rules Actually Change

The cold-start problem is not a capability problem — it's a time-to-value problem. Pre-built, audit-aligned SAP SoD rules for manufacturing solve it directly.

When a SoD rule set ships as a product capability — ready to load the moment the platform connects to SAP — the sequence changes entirely. Connection, rule set load, first violation scan: hours, not months. Every rule already maps to the relevant SAP T-codes and authorization objects. Every control objective is already expressed in audit language. The output of the first scan is formatted as evidence — not as an IT report that requires translation before a compliance team can use it.

For a manufacturing company with a SOX audit scheduled in the next two quarters, this distinction is the difference between being ready and not being ready.

Risk Levels That Match Audit Priority

Not all SoD conflicts carry equal weight — and a well-structured rule set reflects this. The most useful frameworks organize rules into risk tiers that map directly to how auditors prioritize their testing.

Critical rules represent conflicts that appear most often in actual audit findings: a user who can create a vendor master and execute the payment run (MFG-FI-001), a user who can post and approve their own journal entries (MFG-FI-003), or a user who can create a purchase order and confirm goods receipt (MFG-MM-002). These are the conflicts that become significant deficiencies or material weaknesses when auditors find them. They require remediation before the next audit cycle — not after.

High-risk rules cover conflicts with significant financial reporting exposure that are actively tested in most audit engagements. Medium-risk rules represent best practice controls — important for a mature compliance program and increasingly relevant as audit scope expands.

Organizing remediation effort around this tiering means compliance teams address the highest-exposure conflicts first, produce demonstrable progress quickly, and build toward a comprehensive program over subsequent cycles.

S/4HANA Compatibility and Migration Protection

A concern that comes up consistently in manufacturing SAP environments is SAP S/4HANA compliance continuity during migration. Organizations mid-journey from ECC 6.0 to S/4HANA need assurance that their SoD program doesn't need to be rebuilt when the platform changes.

The answer lies in how SAP has handled the transition. SAP has preserved ECC transaction codes in S/4HANA for backwards compatibility, and the core authorization objects used in financial and logistics SoD rules — F_BKPF_BUK, M_BEST_BSA, V_VBAK_AAT — are unchanged across both platforms. Where S/4HANA introduces Fiori apps that replace specific T-codes, the equivalent Fiori app permissions and authorization objects can be mapped to the same underlying control. The compliance investment survives the migration as a configuration update, not a rebuild.

Extending Beyond SAP

One limitation worth addressing directly: SOX ITGC controls in SAP don't exist in isolation. A financial controls auditor doesn't stop at the SAP boundary. Access governance across Microsoft 365, Salesforce, ServiceNow, and other connected systems is increasingly part of the same audit scope — and a SoD program that covers SAP but leaves everything else ungoverned produces an incomplete picture.

The most effective approach treats SAP SoD as the foundation and extends governance to the full IT landscape from the same platform. One access certification campaign. One audit report. SAP and every connected system covered together.

The Practical Path Forward

For manufacturing companies facing a real audit deadline, the practical question isn't whether to build a SoD program — it's how to get one operational before the next engagement begins.

OpenIAM's SoD Accelerator for SAP — Manufacturing Edition delivers 140 pre-built rules across nine SAP module groups, mapped to SOX, IFC, and COBIT control objectives, compatible with SAP ECC 6.0 and S/4HANA, and ready to run on day one. The first violation scan completes within hours of connection. No rule-building phase. No consultant engagement required to get to value.

The cold-start problem is solved before the audit calendar forces the issue.

Explore the full SAP SoD rule set for manufacturing →
https://www.openiam.com/soluti....ons/sap-compliance/s

Why SAP SoD Programs Stall Before They Start — and the Cold-Start Problem Nobody Talks About
The audit finding arrives and the narrative is always the same. A user in accounts payable had the ability to both create a vendor master record and execute the automatic payment run. No individual role assignment was wrong. No one deliberately built the conflict. It accumulated quietly over two years of normal business operations — a role copied for convenience, temporary access from a previous position that was never revoked, an organizational change that nobody mapped back to the access model.

The conflict sat undetected. The auditor found it.

This is not an unusual scenario. It is the standard pattern for how SoD violations surface in mid-market SAP environments. And the reason it happens is not that organizations are negligent about access control. It is that most SoD programs never actually get started, for a reason that is almost never named directly in the conversation about why the finding occurred.

The Cold-Start Problem

Ask any IT Audit Manager who has tried to implement SoD detection in SAP without a GRC consulting engagement and the description of the experience is consistent. They understand what SoD means and why it matters. They can point to the specific control objective the violation is tied to. What they cannot easily produce is a practical, implementable set of rules that maps SAP transaction codes to audit control objectives — structured in a way that can be loaded into a detection tool and run against actual role assignments without months of internal build work.

Building a SAP SoD rule set from scratch in a mid-size environment means mapping transaction codes to authorization objects, assigning risk levels, connecting each rule to a specific control objective, and writing audit-ready remediation guidance for every conflict. The realistic estimate for a team with genuine SAP authorization expertise is three to four months. Most mid-market IT audit teams do not have that expertise in-house, and most do not have three to four months of capacity to allocate to a rule-building project before the next audit cycle begins.

The result is that the SoD program gets deferred. Not cancelled — deferred. The intention to implement it remains. The tool that will eventually run it may even be selected. But because the rule set does not exist, the first scan cannot run, and because the first scan cannot run, the violations that already exist in the environment continue to accumulate undetected. By the time the program is actually implemented, the remediation effort is significantly larger than it would have been eighteen months earlier.

This is the cold-start problem. It is the primary reason most mid-market SAP SoD programs fail before they produce a single violation report. The conversation about the audit finding rarely mentions it because by the time the finding occurs, the question of why the program was never implemented has been replaced by the more immediate question of what to do about the finding.

Why SAP Alone Cannot Solve This

Understanding why SoD violations accumulate in SAP environments requires understanding what SAP's authorization framework was and was not designed to do.

SAP's authorization model is built around individual role assignments. When a user is assigned a role, SAP validates that the role exists and that the assignment follows the defined process. What SAP does not evaluate is whether that user already holds another role that, in combination with the new one, creates a conflict — a situation where a single person can execute both sides of a transaction that should require independent oversight.

This is not a flaw in SAP. It is a design boundary. SAP is an enterprise resource planning system. Segregation of duties enforcement is a governance control that sits above the ERP layer. SAP manages what users can do individually. SoD detection determines what users can do in combination across their full role portfolio — a different and analytically more complex question that requires a rule set, cross-role analysis, and audit-ready output. None of these three elements ships with SAP.

SAP GRC Access Control can provide SoD enforcement within the SAP boundary, but only after a rule set has been built. It also stops at the SAP boundary — it does not detect conflicts created by the combination of SAP access and access to Microsoft 365, Salesforce, or other connected systems. For organizations where the same users who hold SAP financial roles also hold administrative access in connected systems, the SoD picture that SAP GRC produces is incomplete by design.

What the T-Code Level Actually Means for Audit Evidence

There is a specificity question in SoD detection that is worth understanding before evaluating any detection tool. SOX audit findings are documented at the transaction code level. IFC management assertions reference T-codes. PCAOB audit workpapers reference T-codes. When an auditor finds an SoD conflict, the finding names the specific SAP transaction codes that created it, the control objective at risk, and the remediation required.

A detection tool that works above the T-code level produces output that needs to be translated before an auditor can use it. That translation step is where audit cycles are lost and where the conversation between the IT audit team and the external auditor becomes unnecessarily complex.

Detection at the T-code level means the output of a scan is directly usable by an auditor without transformation. The violation names the specific T-codes in conflict. The control objective is mapped. The remediation guidance is included. The auditor receives a document that matches the format and specificity of the finding they would write themselves.

For mid-market organizations without dedicated audit support teams, the difference between output that requires transformation and output that does not is frequently the difference between a SoD program that produces audit value and one that produces reports nobody fully acts on.

What a Rule Set That Ships Pre-Built Actually Changes

The cold-start problem is structural, which means the solution is structural. The most direct way to eliminate a three-to-four month rule-building phase is to not require one.

A pre-built SoD rule set for a specific industry and SAP module coverage — curated from ISACA, PCAOB, and SAP authorization documentation, mapped to control objectives across SOX, IFC, and COBIT, validated against the conflict patterns that appear most consistently in actual audit findings — eliminates the cold-start delay entirely. The first scan runs on the day the tool connects to SAP. The violation report is formatted for audit review from the moment it is generated.

This changes the SoD program timeline in a way that is practically significant. An IT Audit Manager who connects a pre-built rule set to a SAP ECC environment on a Monday can have a violation report on that environment by Wednesday — not three months later. The violations that have been accumulating undetected can be surfaced and remediated before the next audit cycle rather than discovered by the auditor during it.

The audit finding that opened this piece — the accounts payable lead with vendor creation and payment execution access — would have been detected within hours of the tool being connected. The 26-month accumulation window that made the finding possible exists because the detection program was never implemented. The detection program was never implemented because the rule set was never built.

That is the problem the cold-start solution solves.

For pre-built SoD rule sets for SAP manufacturing and financial services environments, including T-code level detection mapped to SOX, IFC, and COBIT control objectives, visit
https://www.openiam.com/soluti....ons/sap-compliance/s