Topic starter
03/06/2026 2:21 pm
TL;DR: Clean core certification for Pathlock, covering its Native Cyber Security and GRC Suite and Application Profiler, was reported by Pathlock as a signal that S/4HANA migrations must keep controls traceable and upgrade-safe. SAP governance in the digital core depends on access rules and audit trails that still work after change.
Editorial analysis by NHI Mgmt Group, based on content published by Pathlock: “Pathlock Solutions Achieve SAP®-Certified for Clean Core with RISE with SAP”.
Key questions
Q: What breaks when custom SAP controls are left inside the digital core?
A: Embedded custom controls often become brittle during upgrade and audit cycles.
Q: How can IAM teams tell whether their SAP governance is migration-ready?
A: Migration-ready governance is visible when access rules, approvals, and audit trails are defined in standard extension points and can be tested against the target-state environment.
Q: How should security teams govern SAP access during an S/4HANA migration?
A: Security teams should treat migration as a governance redesign exercise, not a lift-and-shift.
Practitioner guidance
- Inventory embedded access logic Catalogue custom role logic, approval paths, compensating controls, and transaction-specific exceptions that currently live inside the SAP core.
- Re-test SoD after architecture changes Validate segregation-of-duties rules in the target-state environment rather than assuming source-system controls will behave identically after migration.
- Separate core modifications from governed extensions Move business-specific logic out of the SAP core and into controlled extension patterns with documented ownership, change controls, and audit trails.
Bottom line: The main risk in S/4HANA migration is not the move itself but carrying forward custom access logic and audit gaps that no longer fit the target architecture.
Glossary terms: Clean Core, Segregation of Duties, SAP Extension Governance
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 20 hours ago by NHI Mgmt Group
03/06/2026 2:27 pm
Clean core is now an identity governance problem as much as an ERP architecture problem. The article is not really about certification as an end state. It is about whether organisations can migrate to S/4HANA without carrying forward access exceptions, audit gaps, and brittle custom controls that were tolerated in legacy ECC environments. That makes the migration a governance redesign exercise, not a lift-and-shift technical project. The practitioner conclusion is straightforward: if the control model cannot survive the new architecture, the migration is not yet ready.
A question worth separating out:
Q: Why do clean core and auditability need to be designed together in SAP programmes?
A: Clean core reduces the risk of hidden customisation, while auditability depends on controls remaining traceable and testable through change. If those two goals are separated, teams can end up with a cleaner architecture that is harder to evidence, or a more evidentiable system that is harder to upgrade. Governance only holds when both are aligned.
👉 Read our full editorial: SAP clean core certification sharpens governance for S/4HANA migration