SAP User Access Review Sample Size Calculator
How many users do you need to test to say an access control works? This calculator gives the sample size for attribute sampling with no expected errors, which is the common starting point for IT general control testing.
Your numbers
Number of users, assignments or change records in the period.
The highest error rate you would accept and still conclude the control works.
Your results
This uses a simple zero-deviation attribute sampling formula. If you find any deviation, you must evaluate it under your audit methodology and may need a larger sample. Follow your internal audit or external auditor policy where it differs.
Sample size vs tolerable deviation rate
Sweeps Tolerable deviation rate from 1 to 20, holding your other inputs fixed.
Get complete SAP populations for audit testing
Optional: we can discuss read-only extracts of users, roles and change records for your testing.
Optional. The tool and every export work without this. No spam.
How to use the calculator
Enter the population you are testing, for example the number of users with a given role or the number of user changes in the quarter. Choose a confidence level and a tolerable deviation rate. A lower tolerable rate means a larger sample. The result is the number of items to select at random and test against the control, such as evidence of approval before access was granted.
- Define the population before sampling, from a complete system report
- Select items randomly, not just the first rows of a list
- Test each item against the same written attribute
- Plan time using the effort estimate
The formula
With zero expected deviations, the sample size is the natural log of one minus the confidence level, divided by the natural log of one minus the tolerable deviation rate. At 95% confidence and a 5% tolerable rate this gives 59 items, and for 90% and 10% it gives 22. For small populations the finite correction divides the result by one plus the sample over the population size, which reduces it. If the corrected sample would exceed the population, test everything.
Reading the result
If you test the sample and find no deviations, you can say with your chosen confidence that the true deviation rate is below the tolerable rate. If you find one or more deviations, the conclusion changes: expand the sample, test another control, or report the exception according to your methodology. Always document how the population was obtained and how items were selected.
Common mistakes
Common errors include sampling from an incomplete population such as a spreadsheet maintained by hand, using non-random selection, treating the sample size as a target for how many errors are acceptable, and applying results to a different period. For automated controls, a test of one instance may be enough if general controls are effective, so check your methodology.
Frequently Asked Questions
Why does a lower tolerable deviation rate need a larger sample?
To be confident the true error rate is very small, you need more evidence. Halving the tolerable rate roughly doubles the sample size when expected deviations are zero.
What if I find a deviation in the sample?
Stop treating the result as a pass. Investigate the cause, then follow your methodology, which may require a larger sample, a different control test or a reported exception.
Does this apply to a full user population review?
If you review every user, no sampling is needed. Sampling applies when you test evidence such as approvals or change records for a subset of a larger population.
Is this the same as the sample table my auditor uses?
It may differ. Many firms use tables based on frequency of the control and risk. Treat this as a statistical starting point and follow the sample guidance you have been given.
If you test access on a spreadsheet extract each quarter, Netray can help produce complete, read-only populations straight from SAP so your sample starts from the source.
Related Tools
SAP SoD Mitigating Control Register Worksheet
An editable register of accepted SoD conflicts and the compensating controls behind them, with risk score and review dates. Exports to Excel.
SAPSAP Role Change Request Form Template
A fill-in change request for adding or removing authorizations in an SAP role, with SoD check and test evidence sections.
SAPSAP Firefighter Emergency Access Request Template
A fill-in emergency access request and post-use review form for SAP firefighter or privileged IDs. Exports to PDF or Word for your audit file.
SAPSAP System Landscape Inventory Worksheet
An editable inventory of your SAP systems and clients: SID, tier, release, database, owner and patch dates. Exports to Excel.
More SAP tools
See all- SAP Sales Document Types Reference
- SAP Pricing Procedure Design Worksheet
- SAP Item Category Determination Reference
- SAP Delivery Block Reasons Template
- SAP Credit Management Checklist
- SAP Output Determination Checklist
- SAP Billing Types Reference
- SAP Incompletion Log Checklist
- SAP SD Tables Reference (VBAK, VBAP, LIKP, VBRK and More)