Lesson 6 of 6
Testing for audit
9 min
Listen to this lesson
EHS and product compliance tests are read twice: once by the project, to decide go-live, and later by auditors, inspectors or investigators, who want to know whether the system did what the company says it does. sap-tst-403 teaches the general method for regulated validation. This lesson applies it to EHS: which controls sit in the processes, how to test them, and what evidence survives an audit.
Regulatory controls embedded in the processes
| Control | Process | Regulation it supports (Contoso) | Test |
|---|---|---|---|
| Recordability decision required to close injuries | Incident management | OSHA recordkeeping (29 CFR 1904) | Try to close a recordable case without a decision |
| Unapproved chemicals blocked in purchasing | Purchasing with chemical approval | OSHA hazard communication; site policy | Create a PO for an unapproved chemical |
| Emissions checked against permit limits | Environment management | State air permit | Push a test month over the limit |
| Marketability check in sales orders | Sales with product compliance | Product regulations per country | Order to an unassessed country |
| Dangerous goods check in deliveries | Delivery with product compliance | US DOT hazardous materials rules | Deliver an unclassified product |
| SDS sent with first shipment and on update | Delivery with SDS distribution | OSHA hazard communication | Ship to a new customer; release a new SDS version |
Controls embedded in logistics and EHS processes, mapped to the rules they support.
Each row is a negative test as much as a positive one: the control is proven when the system stops the wrong thing, not only when it allows the right one. And each control needs a configuration owner, because a later change to the check, a new country or a new product type can silently weaken it.
Evidence that survives an audit
| Evidence element | Why auditors need it | Example |
|---|---|---|
| Requirement and regulation reference | Shows why the test exists | 29 CFR 1904 recordkeeping; permit condition reference |
| Test data and preconditions | Lets someone re-perform the test | Material CMC-CLN-020, customer 17100001, SDS version 2.0 |
| Expected result written before execution | Shows the test was not fitted to the result | "Delivery blocked with message" |
| Actual result with system identifiers | Proves what happened | Delivery number, message text, output log entry, timestamps |
| Tester, date, system and release | Attributable and contemporaneous | Tester ID, CMQ client 100, SAP S/4HANA 2025 |
| Review and sign-off | Shows independent review | Monique's approval with date |
Evidence elements for EHS tests, following the principles in sap-tst-403.
Regulatory content changes
Regulations change, and so does the regulatory content that product compliance and environment management use: substance lists, dangerous goods tables, emission factors. Each content update is a change to a regulated system. Contoso's practice (illustrative): content updates move through CMQ like any change, a short regression in CMR (the pre-production copy of production) runs the controls in the table above with the products and permits in scope, and Monique signs before the update moves to CMP. The same applies to SAP releases and support packages that touch EHS.
- Content update receivedAssess impactWhich products, substances, permits are affected
- Import in CMQ and CMRRun control regression in CMRThe six controls above, with in-scope products
- ReviewMonique reviews differencesFor example, a changed classification
- Import in CMPLuis imports in the release windowEvidence filed with the change
What would you do?
An auditor asks Contoso to show that the system blocked deliveries of unclassified dangerous goods during the first year after go-live. What evidence answers this best?
What goes wrong in testing
- Evidence is captured as screenshots without document numbers, dates or system identifiers.
- Expected results are written after execution, so tests cannot show they were independent.
- Negative tests are skipped because test data for "wrong" cases is hard to build.
- Content updates and support packages are imported without rerunning the control regression.
Finally, plan for the inspection, not just the audit. An OSHA inspector or a state environmental inspector arrives without much notice and asks for records on the spot: the 300 log for the last five years, the SDS for a chemical on the line, the emissions records for the last 12 months. Run a mock inspection before go-live: Monique's team retrieves each record from the new system, against a stopwatch, with someone who did not build it watching. A record that exists but cannot be found in time is, for practical purposes, missing.
- Regulatory controls sit inside incident, purchasing, environment, sales and delivery processes.
- Prove each control with negative tests: the system must stop the wrong thing.
- Evidence must be attributable, contemporaneous and re-performable, with expected results written first.
- Treat regulatory content updates and releases as controlled changes with a control regression.
Check your understanding · not graded
Lesson check
1. What proves an embedded compliance control works?
2. Why write expected results before execution?
3. How should a regulatory content update be handled?
4. Which evidence shows a control operated during the year?