Topic starter
14/09/2026 10:09 am
TL;DR: SAP segregation of duties helps manufacturing teams catch conflicting actions inside SAP, but OpenIAM argues that auditors test access control, identity lifecycle, and certification across SAP plus connected systems. The real gap is evidence: a conflict finding is only useful when reviewer decisions, remediation, and timestamps are all retrievable.
Editorial analysis by NHI Mgmt Group, based on content published by OpenIAM: “Why SAP SoD Is Not Enough for Manufacturing Compliance”.
Key questions
Q: What breaks when SAP SoD is used as the only manufacturing compliance control?
A: SAP SoD still finds conflicting roles inside SAP, but it breaks down when auditors test access across directories, HR systems, contractor platforms, and workflow tools.
Q: Why do manufacturing auditors care about evidence after a conflict is found?
A: Because a detected conflict is not a complete control outcome.
Q: What are the signs that an SoD programme is missing cross-system risk?
A: Common signs include clean SAP conflict reports alongside unresolved directory privileges, incomplete certification context, contractor access outside the HR feed, and remediation actions that are not timestamped or retrievable.
Practitioner guidance
- Expand SoD rules beyond SAP Build conflict rules that include directory, HR, contractor, and workflow entitlements so a risky access combination is visible before it becomes an audit exception.
- Link certification records to review evidence Require each access review to store the reviewer, decision, timestamp, remediation status, and any accepted-risk justification in one retrievable record.
- Model lifecycle events across connected systems Verify that joiner, mover, and leaver changes reach SAP, Active Directory, Entra ID, and any plant or contractor systems that carry financially material access.
Bottom line: SAP SoD is useful, but manufacturing compliance fails when the control stops at one application boundary.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/09/2026 10:10 am
Manufacturing SoD is an access-evidence problem, not an SAP-only control problem. The article is right to separate conflict detection from audit readiness. Auditors care about whether the organisation can reconstruct identity decisions across SAP and connected systems, not whether a single module can flag a risky role pair. Practitioners should therefore treat evidence continuity as the control objective, not as a reporting afterthought.
A question worth separating out:
Q: Should organisations prioritise SAP SoD or identity lifecycle governance first?
A: They should treat them as linked, but identity lifecycle often exposes the deeper failure because access changes must flow through SAP and all connected systems. If joiner, mover, and leaver events are not governed end to end, SoD findings will recur and certifications will remain evidentially weak.
👉 Read our full editorial: SAP SoD is not enough for manufacturing compliance