# SAP User Access Review Template for Periodic Recertification

> Source: https://netray.co/tools/sap-user-access-review-template
> Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems.
> Section: Free Tools

## Short answer

A fill-in document template for SAP user access reviews that records scope, method, findings and approvals, ready to hand to auditors.

## Category

sap

## Erp

SAP ECC and S/4HANA

## Audience

- GRC analyst
- Internal auditor
- SAP security analyst

## Tool

**Kind:** template

**Output:** document

**Fields:**

#### Company name

**Key:** company

**Type:** text

**Default:** Acme Precision Ltd

#### System and SID

**Key:** system

**Type:** text

**Default:** S/4HANA Production (P01)

#### Review period

**Key:** period

**Type:** text

**Default:** Q3 2026

#### Review date

**Key:** review_date

**Type:** date

**Default:** 2026-10-20

#### Reviewer

**Key:** reviewer

**Type:** text

**Default:** A. Sharma, GRC Analyst

#### Scope

**Key:** scope

**Type:** select

**Options:**

- All dialog users
- Finance roles only
- Critical access only
- Basis and technical users
- Terminated and inactive users

**Default:** All dialog users

#### Users in scope

**Key:** users_total

**Type:** number

**Default:** 412

#### Access removed

**Key:** users_removed

**Type:** number

**Default:** 23

#### Data source

**Key:** source

**Type:** text

**Default:** SUIM report export and USR02 last logon date

#### Key findings

**Key:** findings

**Type:** textarea

**Default:** 7 users held roles from a previous department. 5 users had not logged on for more than 90 days. 2 Basis users held both user admin and role maintenance.

#### Actions agreed

**Key:** actions

**Type:** textarea

**Default:** Remove unused roles by end of month. Lock users inactive over 90 days. Split Basis duties or add a monitored firefighter process.

**Blocks:**

#### SAP User Access Review

**Body:** Company: {{company}}
System: {{system}}
Review period: {{period}}
Review date: {{review_date}}
Reviewer: {{reviewer}}

#### Scope and method

**Body:** Scope: {{scope}}
Users in scope: {{users_total}}
Data source: {{source}}

The reviewer extracted users, assigned roles and last logon dates, sent them to role owners and line managers for confirmation, and recorded the response against each user.

#### Results summary

**Body:** Users reviewed: {{users_total}}
Access removed or reduced: {{users_removed}}

Key findings:
{{findings}}

#### Review checks performed

**Table:**

**Columns:**

- Check
- Result
- Evidence

**Rows:**

**0:** Role still required for current job

**0:** User active in last 90 days

**0:** Critical access held and approved

**0:** Segregation of duties conflicts reviewed

**0:** Terminated users locked or deleted

**0:** Generic and service users have an owner

#### Actions agreed

**Body:** {{actions}}

#### Approvals

**Signatures:**

- Reviewer
- Role owner
- IT security lead
- Internal audit (acknowledged)

**Notes:** This is a starting point for your own process, not audit or legal advice. Adapt scope, thresholds and sign-offs to your policy and your auditor's expectations. Keep the underlying user and role export with the signed review.

## Content

**Intro:** A periodic user access review proves that the right people still hold the right SAP access. Auditors want to see who reviewed what, from which data, what was found and who signed. This template gives you that record in one clean document.

**Sections:**

#### How to use the template

**Body:** Fill in the system, period, scope and data source first. Run your extraction, for example a user-to-role report from SUIM combined with last logon dates from the user master table USR02, and send it to role owners or line managers for confirmation. Record how many users were in scope and how many had access removed, then write the key findings and actions in plain sentences. The check table is for the reviewer to complete by hand or in Word after export. Finish with signatures. Save the signed PDF with the raw extract so the evidence stands up to testing.

**Bullets:**

- Define scope before extracting data
- Keep the raw export with the signed review
- Record the date and the reviewer's name

#### The method behind the review

**Body:** Most frameworks, including SOX-style IT general controls, expect access to be reviewed on a defined cycle: quarterly for critical access and annually for the rest is common. The control has three parts. First, the population must be complete and accurate, so state the source. Second, an independent owner must confirm each user's access, not just the IT team. Third, the exceptions found must be remediated and evidenced. If any part is missing, an auditor will usually treat the control as ineffective, even if the review itself was done.

**Bullets:**

- Complete and accurate population
- Review by an owner who understands the job
- Remediation tracked to closure

#### Reading and acting on findings

**Body:** Common findings are users who changed department and kept old roles, inactive users who still hold access, generic or service users without an owner, and users holding critical access without an approval record. Group findings by type and fix the cause. If many users keep old roles after transfers, the real fix is an offboarding step in the HR move process, not repeated cleanup. Track the number of removals per cycle. A falling count usually means the joiner-mover-leaver process works better.

**Bullets:**

- Group findings by cause
- Fix the process behind repeated findings
- Track removals per cycle

#### Common mistakes

**Body:** Reviewers often receive a list of role names that mean nothing to a manager, so they approve everything. Provide a plain description of each role. Other common mistakes are reviewing only active users and missing locked ones that can be unlocked, excluding technical and RFC users, and relying on an extract that was not tested for completeness. Finally, a review without a deadline stalls. Set a response date and escalate non-responders.

**Bullets:**

- Describe roles in business language
- Include technical and service users
- Set a deadline and escalate

**Cta:** If access reviews take weeks of spreadsheet work, Netray can build a private, read-only reporting layer over your SAP user and role tables, with the evidence kept in your environment.

**Faq:**

#### How often should SAP user access be reviewed?

**Answer:** Many organizations review critical and privileged access quarterly and all other access at least annually. The right frequency depends on your risk policy, your auditors and any regulation you follow. Record the cycle in your access control policy and keep evidence for each run.

#### Where do I get the data for an SAP user access review?

**Answer:** Common sources are the user information system (SUIM) for users and roles, the user master table USR02 for last logon and lock status, and table AGR_USERS for role assignments. Always state the source and extraction date in the review document.

#### Who should approve access during the review?

**Answer:** The business owner of the role or the user's line manager should confirm that access is still needed. IT can provide the data and perform the removals, but it should not be the only approver, because it cannot judge whether the business still needs the access.

#### Should locked and inactive SAP users be included?

**Answer:** Yes. Locked users can be unlocked and inactive users can be reactivated, so their roles still represent risk. Many reviews also list users with no recent logon so they can be locked or deleted under the policy.

## Search terms

sap user access review template, sap access recertification template, sap periodic user review, sap user access review report, sox sap user access review, sap quarterly access review, user access review documentation sap, sap role owner review form

---
Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json