# ABAP Code Review Checklist > Source: https://netray.co/tools/abap-code-review-checklist > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Free Tools ## Short answer A practical review checklist for ABAP changes: database access, security, error handling, structure and S/4HANA compatibility. ## Category sap ## Erp SAP ECC / S/4HANA ## Audience - ABAP developer - SAP development lead - SAP quality manager ## Tool **Kind:** checklist **Groups:** #### Database access and performance **Items:** **Text:** No SELECT inside LOOP, DO or WHILE loops **Critical:** true SELECT lists only the needed fields, no SELECT * on wide tables **Text:** WHERE clause uses key or index fields in a supported order **Critical:** true **Text:** FOR ALL ENTRIES driver table is checked as not empty **Critical:** true SELECT SINGLE is used only with the full primary key Large reads use package size or a restricted selection Internal tables read in loops are sorted or hashed with the right key Runtime checked with SAT or ST05 on realistic data volumes #### Security and authorization **Items:** **Text:** AUTHORITY-CHECK exists for sensitive data and actions **Critical:** true **Text:** sy-subrc of every AUTHORITY-CHECK is evaluated **Critical:** true **Text:** No hard-coded user names, passwords or system URLs **Critical:** true **Text:** Dynamic SQL and dynamic calls are protected against injection **Critical:** true Client handling is correct for cross-client tables Sensitive data is not written to logs or spool #### Error handling and robustness **Items:** **Text:** sy-subrc is checked after READ TABLE, CALL FUNCTION and file statements **Critical:** true Class-based exceptions are used for new code and caught at the right level **Text:** BAPI RETURN tables are evaluated for types E and A **Critical:** true BAPI_TRANSACTION_COMMIT or ROLLBACK is used correctly No COMMIT WORK inside loops or user exits without a clear reason Messages are meaningful and come from a message class Empty input and no-data cases are handled #### Structure, readability and testing **Items:** Naming follows the team standard Methods are short and have one purpose No dead code, commented-out blocks or unused variables Logic sits in classes, not in a long FORM or report body Unit tests exist for new business logic Comments explain why, not what No magic numbers, constants are named #### Release and S/4HANA readiness **Items:** **Text:** Code Inspector or ABAP Test Cockpit checks pass with no new priority 1 findings **Critical:** true **Text:** No access to obsolete tables or removed structures (check the simplification list) **Critical:** true Custom code migration checks (ATC for S/4HANA readiness) are reviewed Transport contains all dependent objects and is in the right package Texts are translatable and not hard-coded Test evidence is attached to the change **Scoring Note:** Count ticked items. Fix every unticked critical item before the transport moves forward. Below 80% ticked usually means the change needs another round. ## Content **Intro:** A short, consistent review checklist catches most ABAP defects before they reach quality or production. This list focuses on the issues that actually cause incidents: database access in loops, missing authority checks, unchecked return codes and code that will not survive a move to S/4HANA. **Sections:** #### How to use the checklist **Body:** Open the change in the editor or ADT, run the ABAP Test Cockpit on the objects, and work through the groups with the author in the room or on a call. Tick items that pass and leave failed items unticked, then export the checklist as evidence for the transport. Items marked critical are those where a miss tends to cause a production incident, so they must be fixed before release rather than logged as technical debt. #### Where ABAP defects come from **Body:** In practice most problems come from the same short list. Reads in loops cause slow jobs, missing sy-subrc checks cause wrong data to flow forward, absent authority checks create audit findings, and unchecked BAPI return tables cause documents that were never created. Static checks find some of these, but a person who knows the business process finds the rest. Combine automated ATC results with a human review of logic and data access. #### S/4HANA readiness **Body:** Custom code moving to S/4HANA must account for changed data models, such as the material number extension, business partner replacing customer and vendor master, and removed or replaced tables listed in SAP's simplification list. Run the custom code migration checks to get the findings, then use review time to confirm that fixes are correct, not just silent. Prefer released APIs and CDS views over direct table access in new code. #### Common mistakes **Body:** Reviews fail when they only check style, when reviewers see code without the functional context, or when criticals are waived under time pressure. Another is reviewing only the changed lines and missing the effect on callers. Keep the checklist short, run it every time, and track which items fail most often so your standards and training can target them. **Cta:** If you have a large legacy custom code base, we can discuss how AI-assisted analysis could help prioritise what to review, rewrite or retire. **Faq:** #### Does this replace the ABAP Test Cockpit? **Answer:** No. ATC finds rule-based issues automatically and should run on every change. This checklist adds the human review of business logic, data access choices and risk, which tools cannot judge. #### Who should review ABAP code? **Answer:** A second developer who did not write the change, ideally with knowledge of the business process. For authorization or financial postings, include a functional consultant or key user to confirm the behaviour. #### How long should a review take? **Answer:** For a typical change of a few hundred lines, 30 to 60 minutes is realistic. Larger changes should be split. Rushed reviews that skip data access and error handling are the ones that miss the problems that matter. #### What should I check first for performance? **Answer:** Look for database access inside loops, missing WHERE clauses, SELECT of unneeded fields and repeated reads of the same data. Then measure with SAT or ST05 on realistic volumes, because development systems rarely show the problem. ## Search terms abap code review checklist, abap peer review checklist, abap performance checklist, abap code inspector checks, abap security review authority check, s/4hana custom code review checklist, abap test cockpit review --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json