# SAP Role Change Request Form Template

> Source: https://netray.co/tools/sap-role-change-request-form-template
> Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems.
> Section: Free Tools

## Short answer

A fill-in change request for adding or removing authorizations in an SAP role, with SoD check and test evidence sections.

## Category

sap

## Erp

SAP ECC / S/4HANA

## Audience

- SAP security administrator
- GRC analyst
- Role owner

## Tool

**Kind:** template

**Output:** document

**Fields:**

#### Company

**Key:** company

**Type:** text

**Default:** Acme Precision Ltd

#### Change request number

**Key:** req_no

**Type:** text

**Default:** RCR-2026-0312

#### Role name

**Key:** role

**Type:** text

**Default:** Z_MM_PURCHASER_PLANT1000

#### Role type

**Key:** role_type

**Type:** select

**Options:**

- Single role
- Composite role
- Derived role
- New role

**Default:** Single role

#### Requester

**Key:** requester

**Type:** text

**Default:** A. Patel, Procurement manager

#### Role owner

**Key:** owner

**Type:** text

**Default:** A. Patel

#### Business need

**Key:** need

**Type:** textarea

**Default:** Buyers must be able to display vendor evaluation results to support quarterly supplier reviews. They currently ask a colleague to print them.

#### Requested change

**Key:** change

**Type:** textarea

**Default:** Add display-only access (activity 03) to the vendor evaluation transaction for plant 1000 and purchasing organization 1000. No change, create or delete access.

#### Transactions or services affected

**Key:** tcodes

**Type:** text

**Default:** ME6H, ME6G

#### Users affected (count)

**Key:** impact

**Type:** number

**Default:** 14

#### Test system and client

**Key:** test_system

**Type:** text

**Default:** QAS / client 200

**Blocks:**

#### Role Change Request {{req_no}}

**Body:** Company: {{company}}
Role: {{role}}
Role type: {{role_type}}
Requester: {{requester}}
Role owner: {{owner}}
Users affected: {{impact}}
Test system: {{test_system}}

#### Business need

**Body:** {{need}}

#### Requested change

**Body:** {{change}}

Transactions or services: {{tcodes}}

#### Authorization detail

**Table:**

**Columns:**

- Authorization object
- Field
- Current value
- Requested value

**Rows:**

#### Risk and test checks

**Table:**

**Columns:**

- Check
- Result
- Evidence reference

**Rows:**

**0:** SoD or access risk analysis run on changed role

**0:** Critical authorization objects reviewed

**0:** Derived roles and organizational values updated

**0:** Tested with a test user in the test system

**0:** Transport request number

**0:** Rollback plan documented

#### Approvals

**Signatures:**

- Requester
- Role owner
- Security administrator
- Risk or compliance reviewer

**Notes:** Keep one request per role change so the transport and the approval stay linked. Adjust fields to match your own change procedure. This is a starting point, not legal advice.

## Content

**Intro:** Most SAP access problems start with a role that was edited quickly and never documented. This form puts the business need, the exact authorization change, the risk check and the test evidence on one page.

**Sections:**

#### How to use the form

**Body:** The requester states the business need in plain language. The security administrator translates that into the exact authorization objects and field values in PFCG, and fills in the table. The risk reviewer runs an access risk analysis on the modified role before it moves, and the tester confirms the change with a test user. Export the finished form and attach it to the transport or the ticket.

**Bullets:**

- Describe the need in business terms, not just a transaction code
- Record current and requested values for each authorization field
- Run the risk analysis on the role, not only on a user
- Reference the transport request that carries the change

#### Why the detail matters

**Body:** A role is a bundle of authorization objects with field values such as activity, organizational levels and ranges. A change to one value, for example activity 02 instead of 03, changes what a person can do. Derived roles inherit authorization objects from a parent and only differ in organizational values, so a parent change reaches every child. The form forces you to name which roles are affected and who owns them.

#### Testing and evidence

**Body:** Test in a non-production system with a user who holds only the changed role plus a baseline, then confirm both the new access and the absence of anything extra. The authorization trace (transaction STAUTHTRACE or ST01) and SU53 for a failed check help show which object a user is missing. Attach screenshots or trace exports as evidence. Auditors sample changes and ask for exactly this trail.

#### Common mistakes

**Body:** Frequent errors include adding a full authorization to solve one missing object, editing a role directly in production, skipping the profile generation, and forgetting that a composite role may have other single roles that conflict with the new access. Another is approving without running the risk analysis because the change looks small.

**Cta:** If your role changes are slow because requests and risk checks live in email, Netray can help design a read-only reporting layer over your SAP security data.

**Faq:**

#### Should every role change use this form?

**Answer:** Any change to authorization values in production roles should be documented. Many teams use a lighter version for emergency fixes and complete the full form afterwards, but the record should always exist.

#### Who approves a role change?

**Answer:** At minimum the role owner, who understands the business need, and a security or risk reviewer who checks access conflicts. The requester should not be the only approver.

#### Do I need a separate form for derived roles?

**Answer:** Not usually. Name the parent role and list the derived roles affected. If organizational values change for only one derived role, mention that explicitly in the requested change field.

#### Where do I attach the transport number?

**Answer:** In the risk and test checks table. Linking the request to the transport lets an auditor trace from the approval to the change that reached production.

## Search terms

sap role change request form, sap authorization change request template, pfcg role change form, sap role modification request, sap security change request template, sap role owner approval form, sap authorization request excel

---
Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json