SAP Firefighter Emergency Access Request Template
Emergency access to production is one of the first things an auditor samples. This template captures the reason, scope, duration and approvals before a firefighter or privileged ID is used, and the log review afterwards.
Fill in
SAP Firefighter Emergency Access Request Template
Emergency Access Request EAR-2026-0147
Company: Acme Precision Ltd Requester: R. Kumar, Basis administrator System and client: PRD / client 100 Firefighter ID requested: FF_BASIS_01 Firefighter controller: S. Meyer, IT security manager Access start: 2026-10-20 Duration needed: 4 hours Reason category: Production incident
Business reason
Idoc queue blocked inbound sales orders. Needs to reprocess failed IDocs in the production client. Incident INC-48213 is open and the standard support role has no authorization to release the lock.
Planned activities
WE05, WE19, BD87 to inspect and reprocess IDocs. SM12 to remove stale locks. No master data changes planned.
Risk acknowledgement
The requester confirms that the access will be used only for the activities listed above, that the session is logged, that the ID will be checked in or locked when work ends, and that all changes will be referenced to the ticket above.
Post-use log review
| Check | Result | Reviewer initials |
|---|---|---|
| Session log matches planned activities | ||
| Changes referenced to ticket | ||
| No unplanned transactions executed | ||
| ID checked in or locked | ||
| Password or token reset after use |
Approvals
Adapt the wording to your own emergency access procedure. If you use SAP GRC Access Control Emergency Access Management the request and log review may be handled in workflow, in which case use this form as the offline or evidence copy. This is a starting point, not legal advice.
Automate emergency access log summaries
Optional: we can review how SAP audit and change data could feed a read-only summary for your reviewers.
Optional. The tool and every export work without this. No spam.
How to use the form
Complete the header fields, state the incident or ticket that justifies the access, and list the transactions you expect to use. The controller approves before the ID is released. After the work, the reviewer compares the session log against the planned activities and signs off. Export the document and attach it to the incident record so the evidence sits next to the change.
- One request per use of the privileged ID, not a standing approval
- Name the ticket number in the reason field
- List expected transactions so the reviewer has a baseline
- Keep the duration as short as the task allows
The control behind it
Firefighter or emergency access is a compensating mechanism: a person gets broad authorization for a short time, and the safeguard is logging plus an independent review. Auditors test whether every use has a reason, whether the approver is independent of the requester, and whether logs were actually reviewed within the stated period. In SAP GRC Access Control this is the Emergency Access Management function with a firefighter ID, a controller and a log report. Without GRC the same control can be run with a manual procedure and this form.
Reading the log review
The review is about differences. Compare what the requester said they would do with what the log shows: transactions, tables touched and any change documents. Anything unplanned needs an explanation in writing. If the log cannot be retrieved, treat that as a finding in its own right, because the control depends on it. Retention of the log should match your audit retention requirement.
Common mistakes
Teams often approve access after the work is done, which turns the control into paperwork. Others let the controller and requester be the same person, or leave the ID unlocked between uses. Another frequent gap is a reason such as "support" with no ticket. Treat these as red flags when you self-review before an audit.
Frequently Asked Questions
Do I need SAP GRC to use this form?
No. The form works as a manual control for any SAP system. If you run GRC Access Control the workflow covers the same steps, and this document is useful as an offline copy or for systems outside the GRC scope.
Who should be the firefighter controller?
Someone independent of the requester who understands the business impact, often an IT security manager or a process owner. The controller should not be the person using the ID.
How long should emergency access last?
As short as the task allows, commonly a few hours up to one working day. Longer needs usually mean a normal role is missing and should go through the role change process instead.
How soon should the log be reviewed?
Many organisations review within one to five working days of use. Set the period in your procedure and measure against it, because late reviews are a common audit finding.
If you want emergency access requests and log reviews summarised automatically from your SAP audit data, Netray can build that on-prem with read-only access.
Related Tools
SAP Role Change Request Form Template
A fill-in change request for adding or removing authorizations in an SAP role, with SoD check and test evidence sections.
SAPSAP SoD Mitigating Control Register Worksheet
An editable register of accepted SoD conflicts and the compensating controls behind them, with risk score and review dates. Exports to Excel.
SAPSAP Security Incident Report Template
A structured incident report for suspicious SAP activity such as misused accounts, unexpected RFC calls or unauthorized changes.
SAPSAP User Access Review Sample Size Calculator
Work out a defensible sample size for testing user access, role assignments or change records, using attribute sampling.
More SAP tools
See all- SAP Sales Document Types Reference
- SAP Pricing Procedure Design Worksheet
- SAP Item Category Determination Reference
- SAP Delivery Block Reasons Template
- SAP Credit Management Checklist
- SAP Output Determination Checklist
- SAP Billing Types Reference
- SAP Incompletion Log Checklist
- SAP SD Tables Reference (VBAK, VBAP, LIKP, VBRK and More)