Lesson 5 of 5
Governance reporting
9 min
Listen to this lesson
Clean core is a long-running effort, and long-running efforts drift without a steady reporting rhythm. Grace's program board wants to know three things each month: where the estate stands, whether it is getting better or worse, and which decisions need them. This lesson turns the classified inventory into governance.
What to report
| Measure | Why it matters | Contoso value at baseline |
|---|---|---|
| Extensions by level (A/B/C/D) | The headline picture of upgrade risk | 18 / 64 / 121 / 37 of 240 |
| Level D in critical processes | The items most likely to hurt an upgrade | 11 in order-to-cash and finance |
| New extensions by level this period | Shows whether the policy for new work is followed | 6 new, all level A or B |
| Remediations completed and verified | Progress with evidence, not intent | 0 (program starts next month) |
| Open exemptions with expiry | Exceptions that need a decision or an exit | 4, two expiring this quarter |
A monthly clean core report. Counts per level matter less than the trend and the critical-process view.
- Scheduled ATC runClean core checks across all customer packages in CMD, against the pinned classification file
- Aggregate by extensionMap objects to extensions; take the lowest level per extension
- Compare with last periodNew, remediated, retired and regressed extensions
- Review exceptionsArchitect and owners review new C or D usages and exemptions
- Board summaryOne page: trend, critical items, decisions needed
Policy for new work
The fastest way to improve the picture is to stop adding to the bottom of it. Contoso's architecture board agrees a simple policy: new extensions are built at level A by default; level B is allowed when no released API exists and the classic API is documented; level C needs an architect-approved exemption with an owner, a reason and an expiry date; level D needs board approval and a written exit plan. ATC at transport release enforces the parts it can, and exemptions are recorded where everyone can see them.
- Can the requirement be met with released APIs, key user tools or a BTP app?Yes → build at level A · No → next question
- Is there a classic API for the gap?Yes → level B allowed; note the API and request a released successor · No → next question
- Is internal object access unavoidable?Yes → level C with exemption, owner, expiry and changelog review · No → rethink the design
- Is a modification or implicit enhancement proposed?Yes → board decision with exit plan, or reject · No → proceed
Tools for the picture
ATC is the source of truth for code-level findings. SAP also highlights a RISE with SAP Methodology dashboard that gives insights into clean core adoption for RISE customers; check what your contract and release give you, and make sure the extension-level view your board sees can be traced back to ATC results. Keep the inventory itself (extension, owner, level, reason, exemption, target level and date) in a place the whole program can read, and link remediation work to features in SAP Cloud ALM so progress and test evidence sit together.
Communicating with non-developers
- Talk about upgrade effort and risk, not about language versions.
- Show trends and the critical-process list; a single percentage invites gaming.
- Tie each decision request to a business process and an owner, such as Dan for finance or Maria for order-to-cash.
- Celebrate retirements; deleting unused code is progress.
What would you do?
At the monthly board, the clean core report shows two new level D extensions created this period, both by a partner team under deadline pressure, with no exemption on record. What should Kenji recommend?
- Report extensions by level, critical-process level D, new work by level, verified remediations and exemptions.
- Policy for new work: A by default, B with justification, C with exemption, D only with board approval and exit plan.
- Keep the board view traceable to ATC results and the pinned classification file.
- Use the report to scope upgrade regression around level C and D extensions.
Check your understanding · not graded
Lesson check
1. Which measure best shows whether the new-work policy is followed?
2. Under Contoso's policy, what does a new level C extension need?
3. Why should the board-level view be traceable to ATC results?
4. How should clean core status shape upgrade regression scope?