Firms that measured their own position quarterly cut audit back bills 50 to 70 percent against firms that waited for SAP's annual run
An audit is a measurement, and the party that measures first sets the framing. Waiting for the annual run hands SAP both the number and the calendar.
Prepared by Redress Compliance · August 18, 2026 · SAP license position reviews. 30 to 40 positions reviewed, 2024 to 2025.
Executive summary
Firms that self measured quarterly cut audit back bills 50 to 70 percent against those that waited for the annual measurement. The saving comes from arriving with your own evidence rather than responding to SAP's.
Indirect or digital access was the largest exposure on 40 to 60 percent of estates, and it was almost always found late, which is the worst possible time to find it.
Named user classification drift left 15 to 30 percent of users on a more expensive type than their role required. Drift is silent, so only a measurement surfaces it.
The program costs 0.5 to 1.5 percent of annual SAP spend and settles audits at 1 to 4 percent. The reactive posture costs 2 to 4 percent in advisory fees and 8 to 22 percent in settlement charges.
Why does the measurement cadence decide the bill?
The reactive posture treats an audit as an event to survive. The proactive posture treats compliance as a managed program. By the time the annual run lands, misclassification and indirect use have already accrued.
Drift is the gap between assumed consumption and measured consumption, and most drift is silent. A quarterly run surfaces it before it becomes settlement exposure, which is the single most effective change available in the first 90 days.
| Posture | Operating cost | Advisory on audit | Settlement charge |
|---|---|---|---|
| Reactive, annual run only | None visible | 2 to 4 percent of annual SAP spend | 8 to 22 percent |
| Proactive, quarterly program | 0.5 to 1.5 percent of annual SAP spend | Absorbed by the program | 1 to 4 percent |
The arithmetic favors the proactive posture inside 18 months. It also concentrates renewal leverage, because the classification, the access map and the utilization baseline become the buyer side data set.
The reactive side of the same problem is mapped in the audit defense framework, and the maintenance alternative in the third party support service.
What does the program actually run on?
Five components, deliberately lean. Most large estates operate it with one to three named owners and a quarterly steering committee, measured against SAP's own material rather than reseller commentary.
- The license register: one source of truth for entitlements, contracts and amendments.
- The measurement engine: USMM and LAW reporting on a quarterly cycle.
- The classification process: named user tier review with documented evidence.
- The indirect access map: every integration documented and license attributed.
- The governance forum: quarterly reporting to a named executive sponsor.
The program ramps in 6 to 12 months
The first credible audit posture lands at month 9 to 12. That is slow enough to matter, which is the argument for starting before a letter arrives rather than after. Definitions sit on the SAP licensing page.
The SAP audit defense framework
Measurement to settlement, the five dimensions of an SAP audit and how each one is answered.
Get the brief →What 30 to 40 SAP license positions showed
Across roughly 30 to 40 SAP license positions reviewed between 2024 and 2025, the firms that ran an internal compliance program settled audits for a fraction of those that did not. Three patterns recur.
- Indirect or digital access was the largest exposure on 40 to 60 percent of estates, and was almost always found late.
- Named user classification drift left 15 to 30 percent of users on a more expensive type than their actual role required.
- Firms that self measured quarterly cut audit back bills by 50 to 70 percent against those that waited for the annual measurement.
A quarterly internal measurement changes who controls the number when an SAP audit opens. That is the whole mechanism, and it is available to anybody.
- Every risky clause flagged with the verbatim quote and page anchor
- Entitlements, caps and protections verified across your whole contract portfolio
- Paste ready replacement language and an evidence trail for the response
Why is named user classification the central lever?
Because it is the commercial axis of the SAP license model, and the matrix has changed across releases and price list versions. Documented evidence is the only protection against an auditor reclassifying users upward.
Each classification needs role mapping, transaction log evidence and a documented business justification. The evidence file lives in the license register, and the auditor reads it before reclassifying anybody.
The classification work survives a RISE migration
It transfers into the RISE full use equivalent count rather than being thrown away, which means the program pays twice. The conversion mechanics sit in the SAP renewal tactics guide and the RISE migration series.
Module level classification differs across the estate. The customer experience side is covered separately in the SAP CX licensing guide.
Watch the briefing · 3:48Optimize the Estate FirstThe SAP measurement work that pays for the negotiation before it starts.
How is indirect access governed rather than discovered?
By inventory, not by investigation. Indirect access occurs when a system outside SAP reads from or writes to SAP and a human benefits from the data through that system. The 2018 digital access price list created the settlement framework.
Four steps, repeated on change
- Inventory every integration, inbound and outbound.
- Classify each one as system to system or human to system.
- Score the access pattern across create, read, update and delete.
- Attribute the license type and quantity, and reclassify whenever the integration changes.
The pricing model is published by SAP digital access, and the deeper exposure map sits in the indirect access pillar.
What the reviews measured, 2024 to 2025
Two cuts of the engagement file frame what the cadence is actually worth.
The gap between firms that self measured quarterly and firms that waited for SAP's annual measurement.
What the classification, access map and utilization baseline were worth on the typical SAP renewal.
Neither number is a discount. Both are the return on measuring your own position before somebody else measures it for you.
Your first five moves
- Appoint a named license manager with allocated time, then consolidate contracts, amendments and price lists into a single license register.
- Run the first USMM and LAW to baseline current consumption, and put the cycle on a quarterly cadence rather than the annual one that matches SAP's audit calendar.
- Classify the named user base with documented evidence, which is where the 15 to 30 percent sitting one tier too high becomes visible and defensible.
- Map indirect access across every integration before the auditor asks, since it was the largest exposure on 40 to 60 percent of estates and was almost always found late. The audit survival guide and its companion paper cover what happens if it is not.
- Stand up the quarterly steering forum with a named executive sponsor, and align the program calendar to the renewal calendar. The SAP practice builds the position before SAP measures it.
Frequently asked questions
What is an internal SAP compliance program?
The buyer side answer to SAP's audit posture. It operates the USMM and LAW measurement tools, classifies named users by role, governs indirect access, and reports residual exposure to an executive sponsor every quarter.
How much does the program cost?
Roughly 0.5 to 1.5 percent of annual SAP spend in operating cost, against 2 to 4 percent in advisory fees for a reactive audit response. The arithmetic favors the program inside 18 months.
How much does it save at audit?
Firms that self measured quarterly cut audit back bills by 50 to 70 percent against those that waited for the annual measurement, and settled at 1 to 4 percent of annual spend rather than 8 to 22 percent.
Why quarterly rather than annually?
The annual cadence aligns with SAP's audit calendar and gives no early warning. A quarterly run surfaces drift before it becomes settlement exposure, and it is the single most effective change available in the first 90 days.
What is the largest exposure?
Indirect or digital access, which was the biggest item on 40 to 60 percent of estates reviewed. It was almost always found late, after the position had already accrued.
How much classification drift is normal?
Between 15 and 30 percent of users sat on a more expensive type than their actual role required. Drift is silent, so it only surfaces when somebody measures.
What evidence does a classification need?
Role mapping, transaction log evidence and a documented business justification, held in the license register. The auditor reads the evidence file before reclassifying anybody.
How long does the program take to mature?
Six to twelve months, with the first credible audit posture landing at month nine to twelve. That is the argument for starting before a letter arrives.
Does the work survive a RISE migration?
Yes. The named user classification transfers into the RISE full use equivalent count rather than being discarded, so the program pays at the audit and again at the transition.
What is the program worth at renewal?
Between 4 and 11 percent on the typical SAP renewal. The classification, the indirect access map and the utilization baseline are the buyer side data set every renewal is argued from.
