# SAP Segregation of Duties Residual Risk Score Calculator

> Source: https://netray.co/tools/sap-sod-residual-risk-score-calculator
> Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems.
> Section: Free Tools

## Short answer

Turn SoD conflict counts and mitigating control coverage into a weighted residual risk score and a remediation effort estimate.

## Category

compliance-legal

## Erp

SAP S/4HANA and ECC

## Audience

- GRC analyst
- Internal auditor
- SAP security administrator

## Tool

**Kind:** calculator

**Inputs:**

#### Users analysed

**Key:** users

**Type:** number

**Default:** 1200

**Min:** 1

**Step:** 10

**Unit:** users

#### Critical conflicts

**Key:** crit

**Type:** number

**Default:** 40

**Min:** 0

**Step:** 1

**Unit:** conflicts

#### High conflicts

**Key:** high

**Type:** number

**Default:** 180

**Min:** 0

**Step:** 1

**Unit:** conflicts

#### Medium conflicts

**Key:** med

**Type:** number

**Default:** 520

**Min:** 0

**Step:** 1

**Unit:** conflicts

#### Weight per critical conflict

**Key:** w_crit

**Type:** number

**Default:** 10

**Min:** 0

**Step:** 1

**Unit:** points

#### Weight per high conflict

**Key:** w_high

**Type:** number

**Default:** 5

**Min:** 0

**Step:** 1

**Unit:** points

#### Weight per medium conflict

**Key:** w_med

**Type:** number

**Default:** 2

**Min:** 0

**Step:** 1

**Unit:** points

#### Conflicts covered by mitigating controls

**Key:** mit_pct

**Type:** slider

**Default:** 30

**Min:** 0

**Max:** 100

**Step:** 1

**Unit:** %

**Help:** Share of conflicts with a documented, operating compensating control.

#### Remediation effort per open conflict

**Key:** hrs_per

**Type:** number

**Default:** 1.5

**Min:** 0

**Step:** 0.25

**Unit:** hours

**Outputs:**

#### Inherent risk points

**Key:** raw

**Expr:** crit * w_crit + high * w_high + med * w_med

**Format:** number

#### Residual risk points

**Key:** resid

**Expr:** raw * (1 - mit_pct / 100)

**Format:** number

**Primary:** true

#### Residual points per 100 users

**Key:** per100

**Expr:** resid / users * 100

**Format:** decimal

**Primary:** true

#### Open conflicts

**Key:** open

**Expr:** (crit + high + med) * (1 - mit_pct / 100)

**Format:** integer

#### Critical share of inherent risk

**Key:** crit_share

**Expr:** crit * w_crit / raw * 100

**Format:** percent

#### Remediation effort

**Key:** effort

**Expr:** open * hrs_per

**Format:** hours

**Chart:**

#### Residual risk points vs mitigation coverage

**Type:** line

**X:** mit_pct

**From:** 0

**To:** 100

**Steps:** 21

**Series:**

- resid

**Disclaimer:** The weights are a simple scoring convention, not a standard. Align severity definitions and weights with your own risk framework and external auditor expectations.

## Content

**Intro:** SoD reports list conflicts but rarely tell leadership whether things are getting better. This calculator gives a weighted risk score before and after mitigating controls, and a remediation hours estimate for the work that remains.

**Sections:**

#### How to use it

**Body:** Run your access risk analysis for the in-scope population and enter the number of conflicts by severity. Set weights that reflect your ruleset, then estimate how many conflicts are covered by a mitigating control that is documented and actually operating. The output shows inherent points, residual points and a per 100 user figure that lets you compare business units or quarters of different size.

**Bullets:**

- Count user-level conflicts, not rule definitions
- Count a mitigation only if it has an owner and evidence
- Keep weights constant between periods so trends are meaningful
- Report critical share separately, it often drives audit attention

#### Scoring logic

**Body:** Inherent risk is the sum of conflicts multiplied by their severity weights. Residual risk scales that by the share not covered by mitigating controls. Dividing by users and multiplying by 100 normalises the figure. Open conflicts are the unmitigated count and the effort estimate multiplies that by an hours per conflict assumption, which should come from your own role redesign and approval cycle history.

#### Worked example

**Body:** 40 critical, 180 high and 520 medium conflicts with weights 10, 5 and 2 give 400 + 900 + 1,040 = 2,340 inherent points. With 30 percent mitigated, residual is 1,638. Across 1,200 users that is about 136.5 points per 100 users. Open conflicts are 518, and at 1.5 hours each the remediation effort is about 777 hours. Moving mitigation coverage to 60 percent halves the residual in the chart, but only if the controls can be evidenced.

#### Common mistakes

**Body:** Mitigation coverage is often overstated because a control exists on paper but nobody performs it. Another trap is comparing scores across periods after the ruleset changed, which makes the trend meaningless. Do not use a single number to replace the detailed conflict review. It is a communication tool for steering committees, and each critical conflict still needs a named decision: remove, redesign or formally accept with a control.

**Cta:** Netray can help automate extraction of role and conflict data into a private, on-prem reporting layer, with human approval on any change.

**Faq:**

#### Is this an official SAP GRC metric?

**Answer:** No. It is a transparent weighted score you can adapt. SAP GRC Access Control reports conflicts and mitigations, and this tool helps summarise those counts into a trend figure that management can follow.

#### How should I choose the weights?

**Answer:** Use values that reflect relative impact in your organisation, for example financial risk versus operational risk. Keep them fixed across reporting periods and document them so auditors can reproduce your numbers.

#### What counts as a mitigating control?

**Answer:** A documented compensating control with a named owner, a defined frequency and retained evidence that it operates, such as a periodic review of postings by an independent person. A control that is only planned should not be counted.

#### Why report per 100 users?

**Answer:** It normalises for population size so a large business unit is not unfairly compared to a small one, and it keeps the trend meaningful as headcount changes.

## Search terms

sap sod risk score calculator, segregation of duties risk scoring, sap grc residual risk, sod conflict remediation effort, sap access risk analysis score, sod mitigation coverage, sap internal audit sod metrics, sap risk per user calculation

---
Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json