SAP Tool Ecosystem for Internal Audit

Subject: Internal Audit -- SAP Fiori Access Assessment and Read-Only Access Request

Hi [Name],

I am reaching out on behalf of the Internal Audit function to better understand our current access to SAP Fiori analytical apps and to initiate a conversation about read-only audit access configuration.

Specifically, I would appreciate your help answering the following:

1. FIORI APP AVAILABILITY
   - Which Fiori analytical apps are currently activated in our S/4HANA environment?
   - Are the following standard apps available: Manage Journal Entries (F0718), Supplier Invoice List, Manage Purchase Orders, Manage Supplier Invoices, Sales Order Fulfillment, Display Billing Documents?
   - Is there a Fiori app catalog or tile catalog we can review?

2. CUSTOM ANALYTICAL QUERIES
   - Is the Custom Analytical Queries app (F1572) activated?
   - Can Internal Audit be granted access to build and run custom queries against CDS views?
   - What approval process is required for access to specific CDS data models?

3. QUERY AND REPORT WRITER
   - Are SAP Query (SQ01/SQ02) and Report Writer tools available?
   - Can Internal Audit be granted user-level access to build ad hoc queries without ABAP development?

4. READ-ONLY ROLE CONFIGURATION
   - What is the process for assigning read-only display roles to audit users?
   - Which authorization objects control display access to the FI, MM, and SD transaction data we need?
   - Is there an existing audit display role, or would one need to be created?

Our goal is to establish direct, read-only access to transaction data for audit purposes, consistent with IIA 2024 Standards (Standard 6.2 -- unrestricted access). We are not requesting write access or the ability to modify any records.

I am happy to schedule a working session to walk through this together. Please let me know your availability.

Thank you,
[Your name]
[Title]
Internal Audit

Subject: Internal Audit -- BIS and GRC Module Licensing and Activation Inquiry

Hi [Name],

I am reaching out from Internal Audit to understand the current licensing and activation status of several SAP modules that are relevant to our audit monitoring program.

Could you help us answer the following?

1. BUSINESS INTEGRITY SCREENING (BIS)
   - Is SAP Business Integrity Screening (FRA -- Fraud Management / Business Integrity Screening) included in our current S/4HANA license?
   - If licensed, is it currently activated and configured?
   - If not activated, what would activation require in terms of IT effort, configuration time, and any additional cost?
   - Who would own the BIS configuration on the IT side?

2. SAP GRC -- ACCESS CONTROL
   - Is SAP GRC Access Control licensed in our environment?
   - Is it currently active and connected to our S/4HANA system?
   - If not active, what is the activation path and estimated effort?
   - Is there a current SoD rule set configured, or would that need to be built?

3. SAP GRC -- PROCESS CONTROL
   - Is SAP GRC Process Control licensed?
   - Is it deployed for any current use (SOX, operational controls)?
   - Could Internal Audit gain read access to existing control monitoring data?

4. SAP ANALYTICS CLOUD (SAC)
   - Does our organization have SAC licenses, either standalone or as part of an enterprise agreement?
   - If yes, could Internal Audit obtain user licenses and connect to S/4HANA live data models?

We are not asking IT to build anything at this stage -- we are trying to understand what is available before making any investment decisions. If it would be helpful, I am happy to schedule a brief call to discuss.

Thank you,
[Your name]
[Title]
Internal Audit

Subject: Internal Audit -- Accounts Payable Data Access Request (Cross-Platform)

Hi [Name],

Internal Audit is planning a review of accounts payable activity and duplicate payment risk. Because AP transactions flow through multiple platforms in our environment, a complete population-level test requires data from each system.

We are requesting read-only access to or a structured data extract from the following:

1. SAP (ERP-processed invoices)
   - Table: BSEG / RBKP or equivalent S/4HANA view
   - Fields needed: Vendor number, invoice number, invoice date, posting date, amount, document number, company code, payment document
   - Period: [specify -- e.g., last 24 months]

2. CONCUR (T&E and employee expense transactions)
   - Transaction-level expense report data including: employee ID, vendor/payee, amount, expense date, payment date, expense report number
   - Period: [specify]

3. BANKING PLATFORM / CARD MANAGEMENT (P-card and merchandise card transactions)
   - Transaction-level data including: cardholder, merchant, amount, transaction date, card number (masked), approval reference
   - Period: [specify]

The objective is to perform a cross-platform duplicate payment analysis -- identifying instances where the same payee, amount, and approximate date appear in more than one system, which would not be detectable by testing any single platform in isolation.

We are not requesting access to configure, modify, or process any transactions. This is a read-only analytical exercise.

If a full data extract is not feasible, we would like to discuss what structured output each system can produce for this purpose, and whether a third-party cross-platform analysis tool (such as Detect by Oversight or equivalent) could be connected to the relevant data sources.

Please let me know who the appropriate contacts are for each system and the best path forward.

Thank you,
[Your name]
[Title]
Internal Audit