SAP User Access Review Template for Periodic Recertification
A periodic user access review proves that the right people still hold the right SAP access. Auditors want to see who reviewed what, from which data, what was found and who signed. This template gives you that record in one clean document.
Fill in
SAP User Access Review Template
SAP User Access Review
Company: Acme Precision Ltd System: S/4HANA Production (P01) Review period: Q3 2026 Review date: 2026-10-20 Reviewer: A. Sharma, GRC Analyst
Scope and method
Scope: All dialog users Users in scope: 412 Data source: SUIM report export and USR02 last logon date
The reviewer extracted users, assigned roles and last logon dates, sent them to role owners and line managers for confirmation, and recorded the response against each user.
Results summary
Users reviewed: 412 Access removed or reduced: 23
Key findings: 7 users held roles from a previous department. 5 users had not logged on for more than 90 days. 2 Basis users held both user admin and role maintenance.
Review checks performed
| Check | Result | Evidence |
|---|---|---|
| Role still required for current job | ||
| User active in last 90 days | ||
| Critical access held and approved | ||
| Segregation of duties conflicts reviewed | ||
| Terminated users locked or deleted | ||
| Generic and service users have an owner |
Actions agreed
Remove unused roles by end of month. Lock users inactive over 90 days. Split Basis duties or add a monitored firefighter process.
Approvals
This is a starting point for your own process, not audit or legal advice. Adapt scope, thresholds and sign-offs to your policy and your auditor's expectations. Keep the underlying user and role export with the signed review.
Automate the access review extract
Optional: see how user, role and logon data can be pulled into a review pack from your own SAP tables, privately.
Optional. The tool and every export work without this. No spam.
How to use the template
Fill in the system, period, scope and data source first. Run your extraction, for example a user-to-role report from SUIM combined with last logon dates from the user master table USR02, and send it to role owners or line managers for confirmation. Record how many users were in scope and how many had access removed, then write the key findings and actions in plain sentences. The check table is for the reviewer to complete by hand or in Word after export. Finish with signatures. Save the signed PDF with the raw extract so the evidence stands up to testing.
- Define scope before extracting data
- Keep the raw export with the signed review
- Record the date and the reviewer's name
The method behind the review
Most frameworks, including SOX-style IT general controls, expect access to be reviewed on a defined cycle: quarterly for critical access and annually for the rest is common. The control has three parts. First, the population must be complete and accurate, so state the source. Second, an independent owner must confirm each user's access, not just the IT team. Third, the exceptions found must be remediated and evidenced. If any part is missing, an auditor will usually treat the control as ineffective, even if the review itself was done.
- Complete and accurate population
- Review by an owner who understands the job
- Remediation tracked to closure
Reading and acting on findings
Common findings are users who changed department and kept old roles, inactive users who still hold access, generic or service users without an owner, and users holding critical access without an approval record. Group findings by type and fix the cause. If many users keep old roles after transfers, the real fix is an offboarding step in the HR move process, not repeated cleanup. Track the number of removals per cycle. A falling count usually means the joiner-mover-leaver process works better.
- Group findings by cause
- Fix the process behind repeated findings
- Track removals per cycle
Common mistakes
Reviewers often receive a list of role names that mean nothing to a manager, so they approve everything. Provide a plain description of each role. Other common mistakes are reviewing only active users and missing locked ones that can be unlocked, excluding technical and RFC users, and relying on an extract that was not tested for completeness. Finally, a review without a deadline stalls. Set a response date and escalate non-responders.
- Describe roles in business language
- Include technical and service users
- Set a deadline and escalate
Frequently Asked Questions
How often should SAP user access be reviewed?
Many organizations review critical and privileged access quarterly and all other access at least annually. The right frequency depends on your risk policy, your auditors and any regulation you follow. Record the cycle in your access control policy and keep evidence for each run.
Where do I get the data for an SAP user access review?
Common sources are the user information system (SUIM) for users and roles, the user master table USR02 for last logon and lock status, and table AGR_USERS for role assignments. Always state the source and extraction date in the review document.
Who should approve access during the review?
The business owner of the role or the user's line manager should confirm that access is still needed. IT can provide the data and perform the removals, but it should not be the only approver, because it cannot judge whether the business still needs the access.
Should locked and inactive SAP users be included?
Yes. Locked users can be unlocked and inactive users can be reactivated, so their roles still represent risk. Many reviews also list users with no recent logon so they can be locked or deleted under the policy.
If access reviews take weeks of spreadsheet work, Netray can build a private, read-only reporting layer over your SAP user and role tables, with the evidence kept in your environment.
Related Tools
SAP Segregation of Duties Conflict Matrix Worksheet
Record SoD conflicts between SAP functions, score them by likelihood and impact, and log the mitigating control and owner for each.
SAPSAP Critical Authorization Objects Reference
A searchable table of sensitive SAP authorization objects with their key fields and the risk each one carries, useful for audits and role reviews.
SAPSAP Role Design Worksheet
An editable worksheet for designing SAP single, derived and composite roles with transaction counts, critical objects and an exposure score per role.
SAPSAP System Copy Checklist
A phased checklist for SAP system copies and refreshes, with pre-copy backups, post-copy BDLS, RFC and job clean-up, and data privacy steps.
More SAP tools
See all- SAP SD Rebate Agreement Request Form Template
- SAP SD Sales Order Item ABAP SELECT Generator
- SAP Cost Element Categories Reference
- SAP Period End Closing Checklist
- SAP Standard Cost Variance Calculator
- SAP Activity Type Rate Calculator
- SAP Document Types Reference
- SAP Posting Keys Reference
- SAP Cost Center Hierarchy Upload Worksheet