# SAP User Access Review Sample Size Calculator > Source: https://netray.co/tools/sap-user-access-review-sample-size-calculator > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Free Tools ## Short answer Work out a defensible sample size for testing user access, role assignments or change records, using attribute sampling. ## Category sap ## Erp SAP ECC / S/4HANA ## Audience - Internal auditor - GRC analyst - SAP security administrator ## Tool **Kind:** calculator **Inputs:** #### Population size **Key:** population **Type:** number **Default:** 620 **Min:** 1 **Step:** 10 **Unit:** items **Help:** Number of users, assignments or change records in the period. #### Confidence level **Key:** conf **Type:** select **Default:** 0.95 **Options:** ##### 90% **Value:** 0.9 ##### 95% **Value:** 0.95 ##### 99% **Value:** 0.99 #### Tolerable deviation rate **Key:** tol **Type:** slider **Default:** 5 **Min:** 1 **Max:** 20 **Step:** 1 **Unit:** % **Help:** The highest error rate you would accept and still conclude the control works. #### Review effort per item **Key:** hours_item **Type:** number **Default:** 15 **Min:** 0 **Step:** 5 **Unit:** minutes **Outputs:** #### Sample size (large population) **Key:** n_inf **Expr:** ceil(ln(1 - conf) / ln(1 - tol / 100)) **Format:** integer **Description:** Items needed when the population is large, assuming zero expected deviations. #### Sample size (finite correction) **Key:** n_adj **Expr:** min(population, ceil(n_inf / (1 + n_inf / population))) **Format:** integer **Primary:** true **Description:** Adjusted for your population size and capped at the population. #### Share of population tested **Key:** pct **Expr:** n_adj / population * 100 **Format:** percent #### Estimated review effort **Key:** effort **Expr:** n_adj * hours_item / 60 **Format:** hours **Description:** Total hours at your stated effort per item. **Chart:** #### Sample size vs tolerable deviation rate **Type:** line **X:** tol **From:** 1 **To:** 20 **Steps:** 20 **Series:** - n_inf - n_adj **Disclaimer:** This uses a simple zero-deviation attribute sampling formula. If you find any deviation, you must evaluate it under your audit methodology and may need a larger sample. Follow your internal audit or external auditor policy where it differs. ## Content **Intro:** How many users do you need to test to say an access control works? This calculator gives the sample size for attribute sampling with no expected errors, which is the common starting point for IT general control testing. **Sections:** #### How to use the calculator **Body:** Enter the population you are testing, for example the number of users with a given role or the number of user changes in the quarter. Choose a confidence level and a tolerable deviation rate. A lower tolerable rate means a larger sample. The result is the number of items to select at random and test against the control, such as evidence of approval before access was granted. **Bullets:** - Define the population before sampling, from a complete system report - Select items randomly, not just the first rows of a list - Test each item against the same written attribute - Plan time using the effort estimate #### The formula **Body:** With zero expected deviations, the sample size is the natural log of one minus the confidence level, divided by the natural log of one minus the tolerable deviation rate. At 95% confidence and a 5% tolerable rate this gives 59 items, and for 90% and 10% it gives 22. For small populations the finite correction divides the result by one plus the sample over the population size, which reduces it. If the corrected sample would exceed the population, test everything. #### Reading the result **Body:** If you test the sample and find no deviations, you can say with your chosen confidence that the true deviation rate is below the tolerable rate. If you find one or more deviations, the conclusion changes: expand the sample, test another control, or report the exception according to your methodology. Always document how the population was obtained and how items were selected. #### Common mistakes **Body:** Common errors include sampling from an incomplete population such as a spreadsheet maintained by hand, using non-random selection, treating the sample size as a target for how many errors are acceptable, and applying results to a different period. For automated controls, a test of one instance may be enough if general controls are effective, so check your methodology. **Cta:** If you test access on a spreadsheet extract each quarter, Netray can help produce complete, read-only populations straight from SAP so your sample starts from the source. **Faq:** #### Why does a lower tolerable deviation rate need a larger sample? **Answer:** To be confident the true error rate is very small, you need more evidence. Halving the tolerable rate roughly doubles the sample size when expected deviations are zero. #### What if I find a deviation in the sample? **Answer:** Stop treating the result as a pass. Investigate the cause, then follow your methodology, which may require a larger sample, a different control test or a reported exception. #### Does this apply to a full user population review? **Answer:** If you review every user, no sampling is needed. Sampling applies when you test evidence such as approvals or change records for a subset of a larger population. #### Is this the same as the sample table my auditor uses? **Answer:** It may differ. Many firms use tables based on frequency of the control and risk. Treat this as a statistical starting point and follow the sample guidance you have been given. ## Search terms sap user access review sample size, audit sample size calculator attribute sampling, sap access review sampling, it general controls sample size, itgc sample size calculator, sap user access testing sample, attribute sampling zero deviations --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json