Risk: Articles & Insights

In most SoD tool evaluations, the deciding question is not the ruleset. It is where the SAP authorization data goes. Field Notes article 1 covers why these extracts raise the question more sharply than most software, how a decade of default-to-SaaS removed the choice from buyers, the five questions buyers actually asked, and the honest costs of running entirely on the customer's hardware.

Field Notes article 5. Procurement asks an offline desktop tool for a SOC 2 report. The request is not unreasonable: certificates are a proxy for working processes, and a compromised build pipeline is a real risk. But the scope does not fit software whose boundary never contains customer data. What we offer instead: verifiable code signing, packet-capture-testable data flow, Ed25519-signed logs, an SBOM embedded in the binary, and the five questions security teams should ask in place of the certificate.

Field Notes article 6, closing the series. Every small vendor gets the disappearance question, and the honest answer splits it into four risks: operational continuity, data access, licensing, and maintenance. Three structurally favour local software; one genuinely does not. Software mostly disappears by sunset, acquisition and forced migration rather than by bankruptcy, which is a risk vendor size does not remove. What MTC Skopos commits to: if the company stops, the version you paid for keeps running, with no licence server in the way.

Payroll postings, treasury transactions, executive compensation - some G/L accounts need tighter access control. Here's how to configure authorization groups with F_BKPF_BES and F_BKPF_BLA in SAP S/4HANA, step by step.

Exploiting SAP used to require both system access and years of domain expertise. AI collapses that second requirement. An attacker with a basic SAP login and a language model can now navigate the system, understand authorization structures, and find exploitation paths that previously took specialists weeks to uncover. What does that mean for how you manage access risk?

A guide to building an accounts payable segregation of duties matrix for SAP, with specific transaction codes, authorization objects, and common AP SoD conflicts.

A technical reference for SAP SoD conflicts: specific transaction code combinations, authorization objects that drive conflicts, and practical detection methods for SAP ECC and S/4HANA.

Traditional SoD analysis identifies who has conflicting access. Did-Do analysis answers the critical follow-up question: Did users with risky access actually make changes? This evidence-based access violation monitoring approach transforms compliance from theoretical to actionable.

Your ECC SoD matrix won't work in S/4HANA. Learn how to build a ruleset that covers Fiori apps, OData services, and the new authorization architecture - without starting from scratch.

A complete guide to building and maintaining your SAP Segregation of Duties matrix, with a free downloadable Excel (XLS) template and best practices for automation.

An access risk report documents the access risks in an ERP landscape: SoD violations, critical access, over-privileged users, and scope breaches, plus the remediation each one needs. MTC Skopos now ships an interactive Overview dashboard that gives you the executive summary of every analysis on the spot, and still exports the underlying risk models to Power BI, Tableau, or any BI platform for deeper dashboarding shaped around your own priorities.

Protect your organization from fraud with proper Segregation of Duties. Learn how to distribute critical functions across personnel to eliminate single points of control.

Segregation of duties: Right team working with the right tool, what normally takes weeks of review without the proper tool, we knocked out in a few days.

SAP Access Risk Analysis (ARA) is the process of evaluating user permissions to identify SoD conflicts, critical access, and over-provisioning. MTC Skopos delivers fast, on-premise ARA with step-by-step remediation and flat-rate pricing — an alternative to SAP GRC Access Control, Pathlock, and cloud-based access risk tools.