Grc: Articles & Insights

The 2026 global SoD survey (100 practitioners, 26 countries) found that conflicts per user did not move in five years, 19% never review their ruleset, and 38% have no cross-system rules. Most of those figures are estimates. Here is how to replace the estimate with a measurement, and which gaps an analysis tool closes.

MTC Skopos was built to do consulting work at clients who had no access-risk tooling, by a security consultant and a software architect, and it grew to cover the analyses we were rebuilding in Python, SQL and Alteryx on every engagement: did-do, remediation, the authorization matrix, the role bill of materials. Then it started selling, to global firms, Big Four, boutiques, public bodies and S&P 500 companies. This introduces Field Notes, a six-part series on how those organisations actually evaluate and buy SoD tooling.

Field Notes article 3. Compliance-driven buyers need a defensible SoD report once, to close an audit finding, and then the need is gone. Efficiency-driven buyers produce that report repeatedly and it hurts. Both look identical during a trial. Three first-call questions that separate them, the trial-extension mistake we made for six months, and what happens after the yes, when the file moves to a procurement function that never saw the product.

Field Notes article 4. Large enterprises with fully deployed SAP GRC Access Control kept asking for demos, and so did organisations already running a specialist analyzer such as CSI tools. They were not confused. Detection works; what is missing is everything after the report lands: remediation decisions, fast exploratory simulation, and output a business owner will read. The Excel file every security architect maintains is the market.

Field Notes article 5. Procurement asks an offline desktop tool for a SOC 2 report. The request is not unreasonable: certificates are a proxy for working processes, and a compromised build pipeline is a real risk. But the scope does not fit software whose boundary never contains customer data. What we offer instead: verifiable code signing, packet-capture-testable data flow, Ed25519-signed logs, an SBOM embedded in the binary, and the five questions security teams should ask in place of the certificate.

Field Notes article 6, closing the series. Every small vendor gets the disappearance question, and the honest answer splits it into four risks: operational continuity, data access, licensing, and maintenance. Three structurally favour local software; one genuinely does not. Software mostly disappears by sunset, acquisition and forced migration rather than by bankruptcy, which is a risk vendor size does not remove. What MTC Skopos commits to: if the company stops, the version you paid for keeps running, with no licence server in the way.

IAM tools assign business roles: named bundles that grant ERP roles across one or more systems. Approval workflows see the bundle name, not the authorizations behind it. MTC Skopos now imports business roles alongside your ERP exports and analyses the access they grant exactly like direct assignments, with full attribution, simulation, and remediation.

Critical access is a category of access risk separate from Segregation of Duties: transactions that cause damage on their own, without needing a conflicting partner. This guide lists the critical transactions every SAP environment should monitor, explains how to detect them with access risk analysis, and shows how MTC Skopos catches them in the same pass as SoD.

A practical guide to SAP authorization design that holds up in production. Covers role architecture, naming conventions, organizational value strategy, least privilege enforcement, critical access monitoring, and the change governance process that keeps your landscape clean over time.

SAP GRC and Pathlock implementations take months. Your SoD risks are not waiting. MTC Skopos runs risk analysis and remediation from day one, with no infrastructure and no configuration project. Clean your authorization landscape before you automate it, stay clean during rollout, and transfer your validated ruleset to SAP GRC or Pathlock when it goes live. Then keep Skopos for the systems your GRC suite does not reach.

Role redesign projects typically stretch across months of consultant workshops, spreadsheet gymnastics, and back-and-forth validation cycles. The AI Role Designer collapses this into an iterative conversation: provide a functional blueprint, let AI analyze historical usage, generate a new role concept, run risk analysis, and refine until clean. Then build the roles, whether manually or through AI connected directly to SAP.

SoD remediation has long been the bottleneck of GRC programs. This white paper explains how MTC Skopos automates the process with a four-phase algorithm that prioritizes least-disruptive fixes, protects business continuity, and validates every recommendation before implementation.

Payroll postings, treasury transactions, executive compensation - some G/L accounts need tighter access control. Here's how to configure authorization groups with F_BKPF_BES and F_BKPF_BLA in SAP S/4HANA, step by step.

Exploiting SAP used to require both system access and years of domain expertise. AI collapses that second requirement. An attacker with a basic SAP login and a language model can now navigate the system, understand authorization structures, and find exploitation paths that previously took specialists weeks to uncover. What does that mean for how you manage access risk?

A guide to building an accounts payable segregation of duties matrix for SAP, with specific transaction codes, authorization objects, and common AP SoD conflicts.

A technical reference for SAP SoD conflicts: specific transaction code combinations, authorization objects that drive conflicts, and practical detection methods for SAP ECC and S/4HANA.

SAP's FUE measurement model assigns every user a license tier based on their authorization profile, not their actual behavior. That gap between assigned and used access is where organizations hemorrhage money. Learn how the FUE calculation works, what the STAR ruleset actually measures, and how to use MTC Skopos to bring your license position back in line with reality.

SaaS GRC tools trade operational convenience for data sovereignty. Your SAP authorization data lives on someone else's servers, analyzed their way, exported in their formats. In the AI era, where agents need raw data and local processing matters more than dashboards, these constraints become deal-breakers. MTC Skopos takes a different approach: your data never leaves your infrastructure.

Traditional SoD analysis identifies who has conflicting access. Did-Do analysis answers the critical follow-up question: Did users with risky access actually make changes? This evidence-based access violation monitoring approach transforms compliance from theoretical to actionable.

Your ECC SoD matrix won't work in S/4HANA. Learn how to build a ruleset that covers Fiori apps, OData services, and the new authorization architecture - without starting from scratch.

A comprehensive comparison of Segregation of Duties tools and SoD software for SAP environments. Discover what makes an effective SoD solution and where MTC Skopos fits in the market landscape.

A complete guide to building and maintaining your SAP Segregation of Duties matrix, with a free downloadable Excel (XLS) template and best practices for automation.

For years, GRC tools have been designed with complexity that required consultants to operate effectively. AI is changing that equation. Organizations that can feed clean data to AI agents are getting results in minutes that used to take weeks.

An access risk report documents the access risks in an ERP landscape: SoD violations, critical access, over-privileged users, and scope breaches, plus the remediation each one needs. MTC Skopos now ships an interactive Overview dashboard that gives you the executive summary of every analysis on the spot, and still exports the underlying risk models to Power BI, Tableau, or any BI platform for deeper dashboarding shaped around your own priorities.

Protect your organization from fraud with proper Segregation of Duties. Learn how to distribute critical functions across personnel to eliminate single points of control.

Segregation of duties: Right team working with the right tool, what normally takes weeks of review without the proper tool, we knocked out in a few days.

Suites like SAP GRC Access Control, Pathlock and Soterion sell access risk analysis as one module among four. MTC Skopos does only that module, which is why its detection runs at authorization-object level and its remediation proposes ordered changes. The trade is real: it never provisions access, and it never will.