Controls on paper and controls in practice: what an audit looks for in SAP change

In a recent assessment of a large international company's SAP change process, almost every change closed successfully. By the usual measures the process looked strong.

Yet the fields that should have shown the controls working were empty, or carried the same value on every record. The routing field that should send risky changes to a board never changed. A closure step could be ticked without the work being done. Most failures had no recorded cause.

An auditor does not ask whether the outcome was good. They ask for evidence that the control operated. Where the evidence is missing, the control is treated as not operating, however good the results.

The assessment also named what it had not tested, including whether every change deployed to production traced back to an approved record. Saying what you did not examine is part of making a finding credible.