Prior to the submission deadline, the SAP auditors will contact the end users repeatedly in order to check the status of the measurement, and to remind them about the deadline. The measurements can be sent directly from the tools to SAP, or as email attachments formatted according to SAP requirements.
The auditors are responsible for evaluating the measurement results by performing:
- Analysis of the system landscape to make sure that all relevant systems (production and development) were measured. Systems that are not relevant for the measurement are java based, portals, dual stack, no longer used but not maintained properly on SAP Support Portal, test and training systems.
- Technical verification of the USMM log files: correctness of the client, price list selection, user types, dialog users vs. technical users, background jobs, installed components, etc.
- Technical verification of the LAW: users’ combination and their count, etc.
- Analysis of engine measurement – verification of the SAP Notes
- Additional verification of expired users, multiple logons, late logons, workbench development activities, etc.
- Verification of Self Declaration Products, HANA measurement and Business ObjectIf measurement errors are identified, the SAP auditor will contact the customer by email in order to request corrections. In this scenario, the deadline is usually extended by a week, so that the measurement can be updated.
The license auditors work closely with SAP license compliance managers to compare the measured figures with the contractual license entitlement. It is essential that customers understand their SAP contracts, since these can be quite complicated, and it can work to the disadvantage of the organization. Otherwise, how can one understand how SAP has evaluated the measurement and if the evaluation was performed correctly?
After the measurements have been received and evaluated by the SAP GLAC team, a Closure Notification Email is sent to the customer. This communication confirms that the audit was finalized and specifies if any compliance gaps have been identified. If there is a compliance gap, the SAP license compliance manager will personally engage with the end user. Typically, the license compliance manager will invite to consider an “additional purchase proposal”.
In some situations, the license compliance manager may also request to execute additional measurement checks. These checks may be performed by the end user independently, or they may be performed by the SAP supplementary audit services experts. Either way, the additional checks are likely to include complex technical verifications like:
- OpenHub measurement
- Single Sign On
- Multiple logons
- Expired Users
- Late Logons
- Workbench Development Activities
- System Data Extracts: Users’ last logon date, password change, etc.
- Order table extracts
These checks can expose further compliance gaps, triggering another (potentially costly) “additional purchase proposal”.
Enhanced audit
The enhanced audits are expert led, meaning that standard auditors are not usually involved. These audits are being led by license compliance managers, compliance team executives, and SAS experts. At the beginning, the scope of the audit is made clear to the end user. As a standard, enhanced audits include all checks required to complete a basic audit, plus the additional measurements required from the customers found to be non-compliant in a basic audit (as listed above). In addition, the enhanced audit incorporates a unique indirect access usage measurement.
An enhanced audit will involve SAP performing some checks remotely by logging into an end user’s systems and/or onsite. When SAP auditors come onsite, this is specifically to research the levels of indirect access usage. In order to verify this, SAP will check the following:
- interactions between SAP and non-SAP systems
- data flow direction
- details of how data is transferred between systems/users (EDI, iDoc, etc)
After the data is verified and evaluated, a report with the results is created. Again, a “Closure Notification Email” is sent, which may or may not indicate a compliance gap. In the event of a compliance gap, the SAP license compliance manager will present an “additional purchase proposal” based on the audit findings. At this point, an SAP sales executive may also be involved in the discussions, even though sales executives are nowadays formally excluded from the auditing process (prior to 2018 and the advent of GLAC, sales executives were heavily involved in the audit). However, sales executives continue to be the primary owners of the commercial customer relationship. Accordingly, when it comes to signing a new deal, they collaborate with the license compliance team in order to resolve the license compliance risk.
