ABAP Code Review Checklist (Free, Printable)

0%

0 of 34 items complete

11 critical items still open - these are the highest-risk gaps.

Download checklist:

Database access and performance

No SELECT inside LOOP, DO or WHILE loopsCRITICALSELECT lists only the needed fields, no SELECT * on wide tablesWHERE clause uses key or index fields in a supported orderCRITICALFOR ALL ENTRIES driver table is checked as not emptyCRITICALSELECT SINGLE is used only with the full primary keyLarge reads use package size or a restricted selectionInternal tables read in loops are sorted or hashed with the right keyRuntime checked with SAT or ST05 on realistic data volumes

Security and authorization

AUTHORITY-CHECK exists for sensitive data and actionsCRITICALsy-subrc of every AUTHORITY-CHECK is evaluatedCRITICALNo hard-coded user names, passwords or system URLsCRITICALDynamic SQL and dynamic calls are protected against injectionCRITICALClient handling is correct for cross-client tablesSensitive data is not written to logs or spool

Error handling and robustness

sy-subrc is checked after READ TABLE, CALL FUNCTION and file statementsCRITICALClass-based exceptions are used for new code and caught at the right levelBAPI RETURN tables are evaluated for types E and ACRITICALBAPI_TRANSACTION_COMMIT or ROLLBACK is used correctlyNo COMMIT WORK inside loops or user exits without a clear reasonMessages are meaningful and come from a message classEmpty input and no-data cases are handled

Structure, readability and testing

Naming follows the team standardMethods are short and have one purposeNo dead code, commented-out blocks or unused variablesLogic sits in classes, not in a long FORM or report bodyUnit tests exist for new business logicComments explain why, not whatNo magic numbers, constants are named

Release and S/4HANA readiness

Code Inspector or ABAP Test Cockpit checks pass with no new priority 1 findingsCRITICALNo access to obsolete tables or removed structures (check the simplification list)CRITICALCustom code migration checks (ATC for S/4HANA readiness) are reviewedTransport contains all dependent objects and is in the right packageTexts are translatable and not hard-codedTest evidence is attached to the change

Count ticked items. Fix every unticked critical item before the transport moves forward. Below 80% ticked usually means the change needs another round.

Custom code health check

Optional: send us a summary of your ATC findings and we will give a plain opinion on where to start.

Optional. The tool and every export work without this. No spam.

How to use the checklist

Open the change in the editor or ADT, run the ABAP Test Cockpit on the objects, and work through the groups with the author in the room or on a call. Tick items that pass and leave failed items unticked, then export the checklist as evidence for the transport. Items marked critical are those where a miss tends to cause a production incident, so they must be fixed before release rather than logged as technical debt.

Where ABAP defects come from

In practice most problems come from the same short list. Reads in loops cause slow jobs, missing sy-subrc checks cause wrong data to flow forward, absent authority checks create audit findings, and unchecked BAPI return tables cause documents that were never created. Static checks find some of these, but a person who knows the business process finds the rest. Combine automated ATC results with a human review of logic and data access.

S/4HANA readiness

Custom code moving to S/4HANA must account for changed data models, such as the material number extension, business partner replacing customer and vendor master, and removed or replaced tables listed in SAP's simplification list. Run the custom code migration checks to get the findings, then use review time to confirm that fixes are correct, not just silent. Prefer released APIs and CDS views over direct table access in new code.

Common mistakes

Reviews fail when they only check style, when reviewers see code without the functional context, or when criticals are waived under time pressure. Another is reviewing only the changed lines and missing the effect on callers. Keep the checklist short, run it every time, and track which items fail most often so your standards and training can target them.

Frequently Asked Questions

Does this replace the ABAP Test Cockpit?

No. ATC finds rule-based issues automatically and should run on every change. This checklist adds the human review of business logic, data access choices and risk, which tools cannot judge.

Who should review ABAP code?

A second developer who did not write the change, ideally with knowledge of the business process. For authorization or financial postings, include a functional consultant or key user to confirm the behaviour.

How long should a review take?

For a typical change of a few hundred lines, 30 to 60 minutes is realistic. Larger changes should be split. Rushed reviews that skip data access and error handling are the ones that miss the problems that matter.

What should I check first for performance?

Look for database access inside loops, missing WHERE clauses, SELECT of unneeded fields and repeated reads of the same data. Then measure with SAT or ST05 on realistic volumes, because development systems rarely show the problem.

If you have a large legacy custom code base, we can discuss how AI-assisted analysis could help prioritise what to review, rewrite or retire.

Talk to an Expert Explore More Free Tools

Related Tools

SAP

More SAP tools

See all

ABAP Code Review Checklist