SAP Segregation of Duties Residual Risk Score Calculator
SoD reports list conflicts but rarely tell leadership whether things are getting better. This calculator gives a weighted risk score before and after mitigating controls, and a remediation hours estimate for the work that remains.
Your numbers
Share of conflicts with a documented, operating compensating control.
Your results
The weights are a simple scoring convention, not a standard. Align severity definitions and weights with your own risk framework and external auditor expectations.
Residual risk points vs mitigation coverage
Sweeps Conflicts covered by mitigating controls from 0 to 100, holding your other inputs fixed.
Review your SoD metrics approach
Get a short second opinion on weights, scope and mitigation evidence. Optional.
Optional. The tool and every export work without this. No spam.
How to use it
Run your access risk analysis for the in-scope population and enter the number of conflicts by severity. Set weights that reflect your ruleset, then estimate how many conflicts are covered by a mitigating control that is documented and actually operating. The output shows inherent points, residual points and a per 100 user figure that lets you compare business units or quarters of different size.
- Count user-level conflicts, not rule definitions
- Count a mitigation only if it has an owner and evidence
- Keep weights constant between periods so trends are meaningful
- Report critical share separately, it often drives audit attention
Scoring logic
Inherent risk is the sum of conflicts multiplied by their severity weights. Residual risk scales that by the share not covered by mitigating controls. Dividing by users and multiplying by 100 normalises the figure. Open conflicts are the unmitigated count and the effort estimate multiplies that by an hours per conflict assumption, which should come from your own role redesign and approval cycle history.
Worked example
40 critical, 180 high and 520 medium conflicts with weights 10, 5 and 2 give 400 + 900 + 1,040 = 2,340 inherent points. With 30 percent mitigated, residual is 1,638. Across 1,200 users that is about 136.5 points per 100 users. Open conflicts are 518, and at 1.5 hours each the remediation effort is about 777 hours. Moving mitigation coverage to 60 percent halves the residual in the chart, but only if the controls can be evidenced.
Common mistakes
Mitigation coverage is often overstated because a control exists on paper but nobody performs it. Another trap is comparing scores across periods after the ruleset changed, which makes the trend meaningless. Do not use a single number to replace the detailed conflict review. It is a communication tool for steering committees, and each critical conflict still needs a named decision: remove, redesign or formally accept with a control.
Frequently Asked Questions
Is this an official SAP GRC metric?
No. It is a transparent weighted score you can adapt. SAP GRC Access Control reports conflicts and mitigations, and this tool helps summarise those counts into a trend figure that management can follow.
How should I choose the weights?
Use values that reflect relative impact in your organisation, for example financial risk versus operational risk. Keep them fixed across reporting periods and document them so auditors can reproduce your numbers.
What counts as a mitigating control?
A documented compensating control with a named owner, a defined frequency and retained evidence that it operates, such as a periodic review of postings by an independent person. A control that is only planned should not be counted.
Why report per 100 users?
It normalises for population size so a large business unit is not unfairly compared to a small one, and it keeps the trend meaningful as headcount changes.
Netray can help automate extraction of role and conflict data into a private, on-prem reporting layer, with human approval on any change.
Related Tools
SAP User License Optimization Calculator
Model annual savings from cleaning up inactive SAP users and moving Professional users to a lower license type.
Compliance & ContractsSAP Firefighter ID Usage Review Log
An editable log of emergency access sessions with duration totals and reviewer outcome, ready for audit evidence.
Developer ToolsSAP ABAP AUTHORITY-CHECK Snippet Generator
Fill in an authorization object, activity and organisational field and get a ready ABAP AUTHORITY-CHECK block with error handling.
More Compliance & Contracts tools
See all- IBM i (AS/400) User Profile Access Review Worksheet
- SyteLine Security and User Access Audit Checklist
- Infor XA (MAPICS) User Access Review Worksheet
- China ERP Data Security and Compliance Assessment
- ERP Vendor Data Processing Agreement Outline
- GDPR ERP Data Migration Checklist
- EU Machinery Regulation 2023/1230 Readiness Checklist
- ERP Contract Clauses Glossary Reference
- Aerospace Certificate of Conformance Template