Lesson 4 of 5
Exemptions: approval, scope and expiry
10 min
Listen to this lesson
Not every finding can or should be fixed now. A check may raise a false positive, a finding may sit in a test-only program, or the fix may be planned for a later release. An ATC exemption masks such a finding so it no longer appears as open in new results. SAP's help is explicit that a request for an exemption must be approved by a quality manager before it becomes effective. That approval step is what keeps exemptions honest; without it, the gate is only as strict as its most hurried developer.
- Developer requestsFrom the finding’s details: scope, approver, reason, justification
- Approver reviewsExemption browser in SAP GUI or ADT, or the Approve ATC Exemptions app
- Approve or rejectRejected findings stay open and still block
- EffectiveApproved findings are masked in later runs
- ReviewOn the expiry or review date: renew with reason, or remove and fix
Requesting an exemption
SAP's help describes a two-page request. The first page sets the scope: granularity (how widely it applies to objects: one finding, a subobject such as a method, the object, or a whole package) and the check scope (one finding, one kind of message, or the whole check). Defaults are normally right; broader exemptions may need quality-manager authorization. The second page names the approver, a reason chosen from a list, and a free-text justification, and lets the requester ask to be notified. A SAPinsider walkthrough adds that requesters cannot approve their own requests, and that approvers are maintained in the ATC administration under exemptions.
| Field | Good example from Contoso | Weak example |
|---|---|---|
| Scope | One finding in method calc_total of ZCL_CMC_DEPOSIT_REPORT | Package ZCMC_SD, all checks |
| Reason | False positive | Other |
| Justification | Check flags a SELECT in a loop; the loop runs at most 12 times (months). Measured 40 ms. Revisit when the report is rebuilt in Q1. | Needed for go-live |
| Approver | Kenji (ABAP lead), not the requester | The requester’s teammate who sits next to them |
| Expiry or review date | End of Q1, linked to the rebuild backlog item | None |
What a well-formed exemption request looks like.
Expiry and review
Exemptions should not live forever by default. In the SAP BTP ABAP environment, SAP documents that the Approve ATC Exemptions app shows an exemption's expiry date, which the processor can change after the request is created, and lets approvers filter by state, processor and requester, see the justification, scope and system group, and subscribe to notifications about new requests. It can also replicate exemptions from on-premise systems; SAP documents transaction SATC_EXPORT_XMPT for downloading them, with a note to apply for older releases. In classic systems, check what your release offers for validity dates; where none is available, record the review date in the justification and review the list in the exemption browser on a fixed schedule.
Governance that works
- A short list of named approvers per area, never the requester.
- Reasons that mean something: false positive, test-only code, planned fix with a date, accepted risk with sign-off.
- A monthly review of new, expiring and package-wide exemptions, reported with the release.
- A rule that "Other" as a reason needs a second approver.
- Pseudo-comments and pragmas that silence checks are reviewed like exemptions, or disallowed in the ATC configuration.
What would you do?
Three days before Mock 2 cutover, a developer requests a package-wide exemption for all security checks on ZCMC_SD, with the justification "Needed for mock". Kenji is the approver. What should he do?
- An exemption masks a finding only after a quality manager approves it.
- Set granularity and check scope as narrowly as possible.
- Every request names an approver (not the requester), a reason and a real justification.
- Give exemptions an expiry or review date; BTP’s Approve ATC Exemptions app shows and edits expiry.
- Review exemptions every release and report broad or open-ended ones.
Check your understanding · not graded
Lesson check
1. When does an ATC exemption become effective?
2. Which exemption setting controls how widely it applies to repository objects?
3. Which BTP app lets a processor change an exemption’s expiry date?
4. Which exemption is the biggest risk to the gate?