Sod: Articles & Insights

The 2026 global SoD survey (100 practitioners, 26 countries) found that conflicts per user did not move in five years, 19% never review their ruleset, and 38% have no cross-system rules. Most of those figures are estimates. Here is how to replace the estimate with a measurement, and which gaps an analysis tool closes.

A brownfield conversion carries your roles over as they are: every SoD conflict, every unused transaction, every workaround added since go-live. A pre-conversion authorization health check baselines SoD on ECC, removes unused access, maps successor transactions and Fiori apps into the ruleset, and designs SoD-free composite roles, in parallel with the migration project.

MTC Skopos was built to do consulting work at clients who had no access-risk tooling, by a security consultant and a software architect, and it grew to cover the analyses we were rebuilding in Python, SQL and Alteryx on every engagement: did-do, remediation, the authorization matrix, the role bill of materials. Then it started selling, to global firms, Big Four, boutiques, public bodies and S&P 500 companies. This introduces Field Notes, a six-part series on how those organisations actually evaluate and buy SoD tooling.

Field Notes article 2. The decision to ship MTC Skopos as a signed portable executable came from the consultant's laptop problem: locked-down client machines where nothing can be installed, so the analysis is either a spreadsheet that stops at transaction level or a SQL, Python or Alteryx build that is correct once and thrown away at the end of the engagement. What portable-and-signed solves, why the product is still sold as a subscription when there is nothing hosted, and where SaaS honestly wins.

IAM tools assign business roles: named bundles that grant ERP roles across one or more systems. Approval workflows see the bundle name, not the authorizations behind it. MTC Skopos now imports business roles alongside your ERP exports and analyses the access they grant exactly like direct assignments, with full attribution, simulation, and remediation.

SAP GRC and Pathlock implementations take months. Your SoD risks are not waiting. MTC Skopos runs risk analysis and remediation from day one, with no infrastructure and no configuration project. Clean your authorization landscape before you automate it, stay clean during rollout, and transfer your validated ruleset to SAP GRC or Pathlock when it goes live. Then keep Skopos for the systems your GRC suite does not reach.

Role redesign projects typically stretch across months of consultant workshops, spreadsheet gymnastics, and back-and-forth validation cycles. The AI Role Designer collapses this into an iterative conversation: provide a functional blueprint, let AI analyze historical usage, generate a new role concept, run risk analysis, and refine until clean. Then build the roles, whether manually or through AI connected directly to SAP.

SoD remediation has long been the bottleneck of GRC programs. This white paper explains how MTC Skopos automates the process with a four-phase algorithm that prioritizes least-disruptive fixes, protects business continuity, and validates every recommendation before implementation.

A guide to building an accounts payable segregation of duties matrix for SAP, with specific transaction codes, authorization objects, and common AP SoD conflicts.

A technical reference for SAP SoD conflicts: specific transaction code combinations, authorization objects that drive conflicts, and practical detection methods for SAP ECC and S/4HANA.

Traditional SoD analysis identifies who has conflicting access. Did-Do analysis answers the critical follow-up question: Did users with risky access actually make changes? This evidence-based access violation monitoring approach transforms compliance from theoretical to actionable.

Your ECC SoD matrix won't work in S/4HANA. Learn how to build a ruleset that covers Fiori apps, OData services, and the new authorization architecture - without starting from scratch.

A comprehensive comparison of Segregation of Duties tools and SoD software for SAP environments. Discover what makes an effective SoD solution and where MTC Skopos fits in the market landscape.

A complete guide to building and maintaining your SAP Segregation of Duties matrix, with a free downloadable Excel (XLS) template and best practices for automation.

If you've worked in Segregation of Duties remediation, you know the drill. You run your analysis, get a list of conflicts, and then... you're on your own. Most tools are great at telling you what's wrong but figuring out how to fix it is left as an exercise for the reader. We built something different.

The future of SAP security analysis isn't about choosing between specialized tools and AI, it's about using MCP to make specialized tools like Skopos work through AI interfaces.

An access risk report documents the access risks in an ERP landscape: SoD violations, critical access, over-privileged users, and scope breaches, plus the remediation each one needs. MTC Skopos now ships an interactive Overview dashboard that gives you the executive summary of every analysis on the spot, and still exports the underlying risk models to Power BI, Tableau, or any BI platform for deeper dashboarding shaped around your own priorities.

Protect your organization from fraud with proper Segregation of Duties. Learn how to distribute critical functions across personnel to eliminate single points of control.

Segregation of duties: Right team working with the right tool, what normally takes weeks of review without the proper tool, we knocked out in a few days.

Suites like SAP GRC Access Control, Pathlock and Soterion sell access risk analysis as one module among four. MTC Skopos does only that module, which is why its detection runs at authorization-object level and its remediation proposes ordered changes. The trade is real: it never provisions access, and it never will.