Audit the system.Not the sample.

Anyone auditing an SAP system by hand checks tables, roles, parameters and postings one at a time. That takes time. So it usually stays with samples, and the audit budget decides how much of the system anyone has seen.

ISPICIO_S checks all users, roles, parameters and postings against your rule set and lays the result open line by line. ISPICIO_X extracts the data free of charge where you have no access. One license per auditor, regardless of the number of systems and SAP users.

ISPICIO_X Version 7.0.0.19 Free of charge, no license key. Reads SAP tables via RFC, hands them over as a file and generates reports from finished analyses. For the SAP Basis team of the audited company. ISPICIO_S Version 7.0.0.19 Named-user license, trial for 14 days. Analyzes authorizations, IT General Controls, postings, usage and changes to the SAP standard. For IT auditors, Internal Audit and SAP Basis.

For IT auditors, external auditors, Internal Audit and SAP Basis doing the audit. For CIOs, Heads of IT and Heads of Internal Audit making the decision.

The problem

Sampling was never the method.
It was the compromise.

Nobody audits only an excerpt out of conviction. The sample is the answer to an effort no budget covers. With software that reads the whole system, the reason for it disappears.

  • LaboriousAnyone auditing an SAP system by hand works through tables, roles, parameters and postings. Individually, one after the other, starting over for each system.
  • SamplingSo a few users, a few roles, a few postings get checked. The rest remains an assumption.
  • BudgetAudit budgets rarely reflect the actual analysis effort. The depth of the audit follows the budget, not the risk.
  • Residual riskWhat the sample does not contain, nobody sees. Critical authorizations and segregation-of-duties conflicts go undetected.

From sample to full analysis

The whole system. Not an excerpt.

Every dot is a user. By hand, you check a few. ISPICIO_S checks them all, against all rules, and shows where the hits are.

Sample

This is as far as a manual audit goes: a few users, a few roles, a handful of transactions, selected by experience and time. Everything else remains an assumption. Not because nobody cares, but because nobody pays for it.

Full analysis

ISPICIO_S reads the system’s tables and checks every user and every role against every selected rule. Plus the system parameters, the postings of the period, the usage of transactions and the changes to the SAP standard. How many users the system has makes no difference, neither to the auditor’s effort nor to the price.

Result

One line per rule, behind it the number of hits and every single user or every role. What stands out is evidenced, not estimated. And without hits the statement is evidenced just as well: all checked, nothing found.

Two programs. One file.

On the left it costs nothing.
On the right, a license.

The data path has a border between the audited company and the auditor. ISPICIO_X works on the left of it, free of charge. ISPICIO_S works on the right, with one license per auditor. In between, a file travels.

  1. 01SAP system at the audited company
  2. 02ISPICIO_X reads, free of charge
  3. 03File crosses the border
  4. 04ISPICIO_S analyzes, one license per auditor
  5. 05Reports PDF, CSV, analysis file

  1. Path 1

    Auditor with access

    If the auditor has RFC access of their own, ISPICIO_S connects directly to the SAP system and reads the tables. ISPICIO_X is not needed. This is also how an SAP Basis team works when it audits its own system.

  2. Path 2

    Data comes to the auditor

    The SAP Basis team of the audited company extracts the data with the free ISPICIO_X: read-only access, predefined table sets, on request at night on a schedule. The file goes to the auditor, who opens it in ISPICIO_S.

  3. Path 3

    Result comes back

    The auditor saves the finished analysis as a file. The audited company opens it in the free ISPICIO_X and generates the same reports itself. The result is traceable on both sides of the border.

Three commitments

One license. Everything. Evidenced.

  1. One auditor. All systems, all users.

    The ISPICIO_S license belongs to the person who audits, not to the SAP system. With it, one auditor analyzes as many systems with as many SAP users as they audit. The price stays the same. ISPICIO_X costs nothing, for anyone.

  2. Full analysis instead of sampling.

    ISPICIO_S checks all users or all roles against every selected rule, plus system parameters, postings, usage and changes to the SAP standard. The result is one line per rule with the number of hits, expandable down to the individual user.

  3. Full audit trail of the analysis.

    Every data extraction leaves a log with the row count per table. Every analysis is a file that can be reopened, also with the free ISPICIO_X. Every report names rule, author and date.

Five audit areas

What gets checked. By your rules.

Which authorizations are critical, which combinations constitute a conflict and which parameters apply is up to you. Audit scopes can be bundled as Control Sets; a team shares rules and report templates and audits the same way everywhere. Custom developments you check ad hoc, without creating a rule.

Authorizations
Critical authorizations and segregation of duties (SoD): which users and roles are able to do what they should not be able to do. Optionally per company code or purchasing organization, optionally for dialog users only.
IT General Controls
System parameters against target values plus access, change and operations controls: password rules, Security Audit Log, transports into the production system, developer keys, standard users.
Journal Entry Testing
The postings of a period, from ECC or S/4HANA, as the basis for auditing financial reporting. The results go into further analysis as CSV.
Usage
Which transactions and reports are actually called, and by whom. What is never used can go. Whoever actually posted with too many rights becomes visible.
IPE Testing
Changes to the SAP standard. What the audited company has changed in the standard, the auditor must not take for standard and checks separately.

In the audit

Evidenced down to the individual user.

The result of an analysis is not a summary but a list: one line per rule, behind it every user, every role, every document. What the auditor shows, the audited company can open itself with ISPICIO_X.

Audit areaRuleHits
Authorizations Release payment runs 41 users
  • A. M. · Role Z_FI_ZAHLLAUF
  • K. S. · Profile SAP_ALL
  • T. L. · Role Z_FI_BUCHHALTUNG
  • and 38 more
Segregation of duties Create vendor and release payment 12 users
IT General Controls Minimum password length below requirement Not Effective
Journal Entries Postings on weekends and public holidays 118 documents
Usage Transactions not called during the audit period 264 transactions
Example rules and figures, user names as initials. Which rules apply is up to the auditor.

  • PDF reports

    Rule definition, summary report with the first ten users per rule, detailed report with all of them, cross table of user, authorization and usage, one report per audit scope. Each with author, company and date.

  • CSV exports

    All authorizations per user as a flat table for pivoting, roles, every view of the Result Explorer, postings for further auditing.

  • Analysis file

    The saved analysis opens in ISPICIO_S and in the free ISPICIO_X. The audited company generates the same reports itself.

  • Download log

    For every data extraction a log with the row count per table, for reconciliation with the SAP system. User names can be replaced by initials or numbers before export.

Requirements

What you need.

Two Windows programs, one read-only RFC connection. No server, no database, no cloud. The data stays on the computer that reads it.

Workstation
Windows 10 (version 1809 or later) or Windows 11, 64-bit. Both programs come as a signed MSIX package; a double-click installs them. User interface and PDF reports in German or English, as you choose.
SAP access
An RFC user with read-only authorizations, via a direct connection or through the Message Server. We provide a suitable role. Nothing is installed and nothing is changed in the SAP system.
Memory
The analysis runs in the computer’s memory. For IPE Testing and large volumes of postings, 16 GB are recommended; postings can be loaded by quarter or by month.
License
ISPICIO_X: none. ISPICIO_S: one license key per auditor (named user), regardless of the number of SAP systems and SAP users. The license is verified online against the ISPICIO license server.
Email, optional
SMTP or Microsoft Exchange, if ISPICIO_X or ISPICIO_S should report the end of a long data extraction, for instance after an overnight extraction of postings.

Next step

Start today: ISPICIO_X fetches the tables, free of charge. Our sales team sends the key for ISPICIO_S, valid for 14 days.

Download ISPICIO_X now

ISPICIO_X is a full version without a license key.