Lesson 2 of 5
Configurable controls
10 min
SAP S/4HANA ships with many controls that only need to be switched on and set correctly. Using them is cheaper and more reliable than building custom checks, and it fits the clean core approach. This lesson covers the configurable controls a process owner in procure-to-pay (P2P), order-to-cash (O2C) and record-to-report (R2R) should know, and where each is set at a high level.
Procure-to-pay controls
| Control | What it does | Where it is set (high level) |
|---|---|---|
| Purchase order approval | POs above a value or with certain attributes need approval before they can be output to the supplier | Flexible workflow for purchasing documents, or the classic release strategy (with release in ME29N / ME28), depending on your setup |
| Invoice verification tolerances | Invoices with price or quantity variances beyond limits are blocked for payment | Customizing for Logistics Invoice Verification, "Set Tolerance Limits" per company code and tolerance key |
| Goods-receipt-based invoice verification | Invoice can only be matched to quantities actually received (three-way match) | Indicator on the PO item, usually defaulted from the supplier or info record |
| Duplicate invoice check | Warns or blocks when the same supplier invoice reference is entered twice | Supplier master setting plus invoice verification customizing |
| Release of blocked invoices | Only authorized users release payment blocks | Authorization on the release function (MRBR in SAP GUI) |
Configurable controls in procure-to-pay.
Note that several of these settings live in Customizing, which means they reach production through transports. That is good news for control: a change to a tolerance or an approval rule follows the same change management route as any other configuration, with a request, a test and an approval. It is also why ITGCs and process controls cannot be separated.
Order-to-cash controls
| Control | What it does | Where it is set (high level) |
|---|---|---|
| Credit check | Orders or deliveries for customers above their credit limit are blocked until released | SAP Credit Management: credit segments, risk classes, check rules; credit check assigned to sales document types |
| Pricing controls | Manual price changes limited or blocked; minimum prices enforced | Condition type settings in pricing customizing |
| Billing blocks | Certain orders (for example free-of-charge or credit memo requests) need review before billing | Billing block set by document type or manually; released by authorized users |
| Incompletion check | Documents missing required data cannot proceed | Incompletion procedures for sales documents and deliveries |
Configurable controls in order-to-cash.
Record-to-report controls
| Control | What it does | Where it is set (high level) |
|---|---|---|
| Posting period control | Postings are only allowed into open periods, by account type and, optionally, by authorization group | OB52 in SAP GUI or the Manage Posting Periods app (same underlying settings) |
| Amount limits per user | Users can only post documents or grant discounts up to their tolerance group's limits | Tolerance groups for employees (OBA4) and user assignment |
| Field status and validations | Required fields such as profit center or cost center must be filled; rule-based validations reject inconsistent postings | Field status groups; validation and substitution rules |
| Sensitive field dual control | Changes to fields such as supplier bank details must be confirmed by a second person before payment | Sensitive fields defined in customizing; confirmation by a different user |
Configurable controls in record-to-report.
- Does SAP standard offer a configurable control for this risk?Yes → configure it and document the setting · No → consider a manual or IT-dependent control
- Is the setting protected by change and access control?Yes → can be relied on as automated · No → fix the ITGC first
- Can users bypass it (override, release, manual price)?Yes → restrict who can, and add a detective review of overrides · No → document it
- Invoice postedAP clerk posts the Lakeside Components invoice against the PO
- Tolerance checkPrice 6% above PO; tolerance for company code 1710 exceeded
- Payment blockInvoice saved but blocked; payment run skips it
- Authorized releaseBuyer-manager role reviews and releases, or the price is corrected
- Detective reviewWeekly list of released blocks reviewed by the process owner
That last question matters most. Nearly every preventive control in SAP has a release or override path, because the business needs one. The control is only as strong as the authorization on the override and the review of how often it is used.
What would you do?
Contoso's buyers complain that too many supplier invoices are blocked for price variances. They ask Dan to raise the tolerance from 2% to 10%. What should Dan do first?
- P2P: PO approval, invoice tolerances, GR-based invoice verification, duplicate check, controlled release.
- O2C: credit check, pricing controls, billing blocks, incompletion.
- R2R: posting periods (OB52 / Manage Posting Periods), user amount limits (OBA4), validations, dual control.
- Know each control's actual value and protect its override path.
Check your understanding · not graded
Lesson check
1. Which setting blocks supplier invoices with price variances beyond a limit?
2. Which app manages posting periods with the same underlying settings as OB52?
3. What does GR-based invoice verification enforce?
4. Why must override paths be restricted and reviewed?