Process Controls and Audit Evidence in SAP S/4HANA

Keep this: job aid

Control owner card

• Know each control's type: automated, IT-dependent manual or manual; preventive or detective.
• Automated controls rely on IT general controls: protected configuration, approved transports, restricted access.
• P2P: PO approval, invoice tolerances, GR-based IV, duplicate check, controlled release (MRBR).
• O2C: credit check, pricing controls, billing blocks, incompletion.
• R2R: posting periods (OB52 / Manage Posting Periods), user limits (OBA4), validations, dual control.
• Test every control twice: positive and negative, with production-like roles.
• Map the risk and control matrix to SAP settings and test scenarios; flag control tests for regression.
• Evidence: configuration value, change history, one instance, override review; report name, selection, date, totals.
• Monitor: blocks, overrides, manual journal entries, period changes, bank detail changes, SoD.
• Read overrides: many small = friction; frequent large = control failing.