Environment integrity

A test result is only as good as the system it was produced in. If CMQ has been changed directly, has settings that differ from production, or lets testers do things production users cannot, a "pass" in CMQ proves less than it seems. This lesson pulls the administration controls together into one view: what keeps a test environment trustworthy.

Invisible and invalidatingClient open for direct changes; tested configuration never transported. Testers cannot see it.

Obvious and invalidatingTesters use users with broad authorizations; authorization defects never surface.

Invisible and minorHousekeeping job schedules differ from production; rarely affects functional results

Obvious and minorDifferent printer names in QA; testers notice and work around it

Environment gaps by visibility and impact. The top-left box is where Basis controls matter most.

The Sign-Off Table · thesignofftable.com/academy/sap-bas-201

Six controls that protect test evidence

Control	What to check	Why it matters
Client settings	CMQ client 100: No changes allowed; no cross-client changes	Only transported configuration is tested
System change option	CMQ global setting Not Modifiable	No code exists in CMQ that CMD and CMP lack
Transport discipline	Imports in the same sequence planned for CMP; no "fix-only-in-QA"	CMQ represents the next state of production
Realistic authorizations	Test users carry the business roles real users will have, not broad profiles such as SAP_ALL	Authorization defects are found before go-live
Change logging	Table change logging active (profile parameter rec/client) and SE06/SCC4 changes reviewed	Unauthorized changes can be detected and explained
Background jobs and interfaces	Jobs and interface settings mirror production where the test needs them	End-to-end tests run the same batch chain as production

A control checklist Basis can run before and during a test cycle.

Users and logon in test systems

SAP user master records (SU01) have a user type. Dialog users are people; System users run background jobs and internal communication and cannot log on in dialog; Communication users serve external RFC connections; Service users are shared anonymous accounts; Reference users only lend authorizations to others. For testing, give each tester a named dialog user with the business roles under test, plus clearly named test users per role where scripted tests need them. Shared all-powerful test users destroy traceability: nobody can say who did what.

SU01 user types and what each is for; testers get named dialog users, never shared accounts with broad authorizations.

The Sign-Off Table · thesignofftable.com/academy/sap-bas-201

SAP training notes that new SAP S/4HANA installations and conversions from 2021 onward switch on table data change logging by default. Check the parameter in each of your systems anyway, because a logging gap is only discovered when you need the log.

Debugging and other quiet back doors

Some authorizations let a user change the outcome of a test without anyone noticing. Debugging with the ability to change variable values at runtime ("debug and replace") is the classic example: a tester or developer who can alter a value in the debugger can make a failing posting succeed. In CMQ during formal test cycles, restrict change-in-debugger rights to a small, named group and review the system log entries it produces. The same applies to direct table maintenance on application tables. If a result could have been produced by a back door, it does not count as evidence.

A result only counts as evidence if no back door could have produced it.

The Sign-Off Table · thesignofftable.com/academy/sap-bas-201

Before the cycleSam checks SCC4, SE06, transport sequence, job schedule and test user roles in CMQ
RecordSettings captured as evidence and attached to the test cycle in SAP Cloud ALM
During the cycleAny change to SCC4 or SE06 triggers an alert and a review with Priya
After the cycleSettings checked again; any deviation is assessed for its effect on results
Sign-offPriya signs the environment statement alongside the test results

An environment-integrity routine wrapped around a test cycle.

The Sign-Off Table · thesignofftable.com/academy/sap-bas-201

What would you do?

Halfway through integration testing, Sam's weekly control shows that someone opened CMQ client 100 for direct changes three days ago and closed it again yesterday. What should happen?

Key points

Closed clients, Not Modifiable QA, disciplined transports and realistic users keep test evidence valid.
Use named, role-based test users; avoid shared users with broad authorizations.
Keep table change logging active and review SCC4 and SE06 changes.
Wrap every test cycle in an environment check and an environment statement at sign-off.

Six controls that protect test evidence

Users and logon in test systems

Debugging and other quiet back doors

Lesson check