Topic starter
14/09/2026 10:09 am
TL;DR: Conflict detection inside SAP is only part of the manufacturing compliance story, according to OpenIAM. Audit proof still depends on retrievable review decisions, remediation, and timestamps across SAP and connected systems.
Editorial analysis by NHI Mgmt Group, based on content published by OpenIAM: “Why SAP SoD Is Not Enough for Manufacturing Compliance”.
Key questions
Q: Why do manufacturing auditors care about evidence after a conflict is found?
A: Because a detected conflict is not a complete control outcome.
Q: What are the signs that an SoD programme is missing cross-system risk?
A: Common signs include clean SAP conflict reports alongside unresolved directory privileges, incomplete certification context, contractor access outside the HR feed, and remediation actions that are not timestamped or retrievable.
Q: What breaks when SAP SoD is used as the only manufacturing compliance control?
A: SAP SoD still finds conflicting roles inside SAP, but it breaks down when auditors test access across directories, HR systems, contractor platforms, and workflow tools.
Practitioner guidance
- Expand SoD rules beyond SAP Build conflict rules that include directory, HR, contractor, and workflow entitlements so a risky access combination is visible before it becomes an audit exception.
- Link certification records to review evidence Require each access review to store the reviewer, decision, timestamp, remediation status, and any accepted-risk justification in one retrievable record.
- Model lifecycle events across connected systems Verify that joiner, mover, and leaver changes reach SAP, Active Directory, Entra ID, and any plant or contractor systems that carry financially material access.
Bottom line: SAP SoD is useful, but manufacturing compliance fails when the control stops at one application boundary.
Glossary terms: Segregation of Duties, Access Certification, Identity Lifecycle Event, Connected-System Governance
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 week ago by NHI Mgmt Group
14/09/2026 10:10 am
Manufacturing SoD is an access-evidence problem, not an SAP-only control problem. The article is right to separate conflict detection from audit readiness. Auditors care about whether the organisation can reconstruct identity decisions across SAP and connected systems, not whether a single module can flag a risky role pair. Practitioners should therefore treat evidence continuity as the control objective, not as a reporting afterthought.
A question worth separating out:
Q: Should organisations prioritise SAP SoD or identity lifecycle governance first?
A: They should treat them as linked, but identity lifecycle often exposes the deeper failure because access changes must flow through SAP and all connected systems. If joiner, mover, and leaver events are not governed end to end, SoD findings will recur and certifications will remain evidentially weak.
👉 Read our full editorial: SAP SoD needs cross-system evidence for manufacturing compliance
This post was modified 1 week ago by NHI Mgmt Group