Lesson 5 of 5
Monitoring after go-live
10 min
Go-live is when controls start operating for real. It is also when they are most likely to be bypassed: users are learning, workarounds are common, and the pressure to keep orders and payments moving is high. Monitoring tells the process owner whether controls are working and whether overrides are under control.
What to watch
| Signal | Why it matters | Where to look (examples) |
|---|---|---|
| Blocked supplier invoices and who released them | High volumes suggest wrong PO prices or tolerances; releases by the wrong people suggest an authorization gap | Blocked invoice release (MRBR) and supplier invoice apps; invoice lists filtered by payment block |
| Credit-blocked orders and releases | Frequent releases above limits may mean limits are wrong or the control is being bypassed | Credit management apps and blocked sales document lists |
| Manual journal entries | Unusual manual postings, especially near close, are a classic risk area | Manage Journal Entries filtered by document type and user |
| Posting period changes | Periods reopened after close should be rare and approved | Change history of the posting period settings |
| Changes to sensitive master data | Supplier bank detail changes are a fraud risk | Change documents for business partners; dual-control confirmations |
| SoD conflicts and emergency access | New role assignments can create conflicts; emergency access must be reviewed | SoD analysis and emergency access logs in your access governance tool |
Control signals to monitor after go-live.
Setting the cadence
- Daily (hypercare)Blocks and overridesBlocked invoices, credit blocks, failed postings; spot workarounds early
- WeeklyExceptions reviewReleased blocks, manual price changes, sensitive master data changes
- Monthly (close)Period-end controlsManual journal entries, period openings, reconciliations
- QuarterlyAccess and SoDRole assignments, SoD conflicts, emergency access usage
- Each releaseRegression of controlsRe-run control scenarios; confirm configuration unchanged unless approved
During hypercare, review daily. As the process stabilizes, move to the cadence your internal control team agrees. Write the cadence down, name who performs each review, and keep the evidence; a monitoring review is itself an IT-dependent manual control.
Each review should end in one of three outcomes: no exceptions; exceptions explained and accepted; or exceptions that need action. Record which, and for the third, raise the action with an owner and a date. A review that always says "no exceptions" deserves a second look: either the control is working perfectly, or the report is not selecting what it should. Periodically test the report itself by checking that a known exception appears in it.
Continuous control monitoring
Some companies automate parts of this with continuous control monitoring, where rules run against SAP data on a schedule and raise exceptions for review. SAP Process Control offers this kind of automated monitoring alongside control documentation and evaluations. Whatever tool you use, the principle is the same: define the rule, define the threshold, route exceptions to a named owner, and record what was done.
- Exception raisedA rule, report or user flags an override or unusual posting
- Owner assignedNamed reviewer per signal, with a due date
- InvestigateWas it justified? Is there an upstream cause such as wrong prices or master data?
- ActCorrect the document, fix the cause, or escalate a control failure
- RecordOutcome, reviewer and date kept as evidence of the review
Monitoring is also how controls improve. If the same exception keeps appearing, the fix usually belongs upstream: a pricing condition, a credit limit, a missing authorization restriction or a confusing step in the process. Feed those findings into the next release and its regression set, so that each release leaves the process a little better controlled than the last.
What would you do?
Four weeks after go-live, Contoso sees 120 supplier invoices released from price blocks, 90% by one buyer-manager, mostly for Lakeside Components. What should Dan do?
- Monitor blocks, overrides, manual journal entries, period changes, sensitive master data changes and SoD.
- Review daily in hypercare, then on an agreed cadence; the review itself needs evidence.
- Continuous control monitoring automates rules and routes exceptions to owners.
- Read override patterns: frequent small overrides mean friction; frequent large ones mean the control is failing.
Check your understanding · not graded
Lesson check
1. Why are controls at particular risk right after go-live?
2. Which app helps monitor manual journal entries?
3. Many small overrides of a block usually indicate what?
4. What does continuous control monitoring do?