Items to Consider When Implementing Audit Reviews of SAP S/4HANA and SuccessFactors

Many of these items are not new to system development projects, but this article provides project points directly related to SAP S/4HANA and SuccessFactors. Organizations should consider the following when implementing SAP S/4HANA and SuccessFactors (although this is not a complete listing of items to consider):

  1. Evaluate applications and perform a cost/benefit analysis.  SAP’s future direction is to move organizations to some type of SAP HANA and SuccessFactors within the cloud. However, the organization should decide when the time is right to make the change.  Before making a change, an organization should perform a cost/benefit analysis and overall evaluation of applications, to ensure that the proper applications are selected.
  2. Create a strong project steering committee. Executive business and IT management need to be a part of the steering committee that makes key decisions throughout the project. 
  3. Project scope should be well-defined and realistic.  If multiple applications are being replaced in a short time period, it is imperative to properly plan the scope of the project and allow time to stabilize business processes after the applications go live.  A key decision is whether to implement SAP S/4HANA with or without SAP S/4HANA Finance (Finance).  SAP S/4HANA Finance requires updates to the SAP table structure, and it will have a much bigger impact to business processes than if only SAP S/4HANA is included within the scope.  Implementing SAP S/4HANA without Finance will result in its main scope being migrating to the in-memory computing platform.  Other decision points are the order in which to implement SAP HANA and SuccessFactors, and when to turn on the replication between SAP HANA and SuccessFactors.
  4. Project Team – key resources should be properly allocated from the internal business, internal IT, and external providers.  Even if the organization is using third parties for project assistance and has selected a cloud solution, both internal IT and internal business resources need to be on the project team.  For example, SuccessFactors may only need limited internal IT resources for the SuccessFactors application implementation. However, internal IT will need to be involved for the interfaces and the SAP S/4HANA replication. Internal Audit or other audit resources that are independent of the project should also be actively monitoring the project.
  5. Use a formal system development methodology. When external methodologies are used, they should be mapped back to the organization’s internal project methodology.  Any methodology should have the following fundamental stages: Initiation, Design, Testing, Go-Live, and Production support. The project should allow adequate time to address testing, training, data and configuration issues after the implementations.
  6. Use a formal project plan. The project plan should be updated throughout the project and include tasks, task owners, due dates, and percent complete.
  7. The project should have a Project Management Office (PMO). The PMO should assist in monitoring the status of the projects including overall status, risks, and high-risk issues. Regular status meetings should ensure that projects stay on track.
  8. Use certified third-party assistance. SAP requires companies to use an implementation partner for SuccessFactors. Companies should select a certified partner with SuccessFactors experience.
  9. Test. The project should perform unit testing, QA testing, and performance testing. Test plans and test results need to be formally documented. 
  10. Train. The end-user will see limited change if only SAP S/4HANA is implemented (without SAP S/4HANA Finance). On the other hand, SuccessFactors will most likely be a new application, with a different feel than past SAP HR systems.  SuccessFactors can push the termination process out to management across the organization. Managers need to be trained to ensure that they are aware of their responsibility to disable an employee’s access to the organization’s systems when employees leave the organization.
  11. Reconcile data from the legacy systems to the new systems.  Automated data migration tools will be most likely used. Organizations should still perform key reconciliations to ensure that all data was completely and accurately migrated.
  12. Focus on interfaces. Organizations should create an inventory of interfaces to ensure that each interface was included in the project and was adequately tested. 
  13. Review the Service Organization Controls (SOC) 2 Report. SAP obtains a yearly SOC 2 Report for SuccessFactors, performed by a third-party to provide an opinion on the operating effectiveness of key controls. The SOC report addresses the risks of the controls that SAP performs. An organization should map the SOC controls back to their own key internal controls to ensure that control responsibilities are clear.
  14. Restrict Security. Limited transactions are affected when moving to SAP S/4HANA from a SAP ERP system. New transactions are mostly existing transactions that were enhanced or changed for SAP S/4HANA. These new S/4HANA transaction end with “H”.
  15. Change Management. Organizations will find limited change to the SAP S/4HANA change management transport process if SAP was used in the past.  For SuccessFactors, the application patch process is addressed by SAP and tested within the SuccessFactors’ SOC report.  However, organizations need to properly account for the other SuccessFactors changes even if changes are requested through a third party.

Contact us with questions and visit our Technology Services page to learn more about software solutions and additional Schneider Downs Technology consulting and network services.

You’ve heard our thoughts… We’d like to hear yours

The Schneider Downs Our Thoughts On blog exists to create a dialogue on issues that are important to organizations and individuals. While we enjoy sharing our ideas and insights, we’re especially interested in what you may have to say. If you have a question or a comment about this article – or any article from the Our Thoughts On blog – we hope you’ll share it with us. After all, a dialogue is an exchange of ideas, and we’d like to hear from you. Email us at [email protected].

Material discussed is meant for informational purposes only, and it is not to be construed as investment, tax, or legal advice. Please note that individual situations can vary. Therefore, this information should be relied upon when coordinated with individual professional advice.

© 2022 Schneider Downs. All rights-reserved. All content on this site is property of Schneider Downs unless otherwise noted and should not be used without written permission.

our thoughts on
The Future of Retail Shopping
Accounting Challenges for Emerging Technology Companies – Accounting For Research and Development Costs
Apache Log4j Vulnerability Update – Remediation Tools and Patches
Apache Log4j Vulnerability Update – CISA Issues Emergency Directive
Apache Log4j Vulnerability Update – Government Responses and Ransomware Activity
HR Management Software Provider Kronos Hit by Ransomware
Register to receive our weekly newsletter with our most recent columns and insights.
Have a question? Ask us!

We’d love to hear from you. Drop us a note, and we’ll respond to you as quickly as possible.

Ask us
contact us

This site uses cookies to ensure that we give you the best user experience. Cookies assist in navigation, analyzing traffic and in our marketing efforts as described in our Privacy Policy.