Jul 17, 2026
•3 minute read
Privileged Access Management
Modern Identity Management for SOX: Closing Control Gaps Across SAPSolving the SoD and user administration challenge for human and agentic actors
As SOX compliance expectations continued to rise, many organizations still lacked complete visibility and control over who—and what—had access to critical SAP and SOX-relevant enterprise applications.
The root issue was structural. Enterprise IAM was designed to manage identity at scale, but SOX required access governance to operate as a financial control system aligned with financial reporting risk and audit defensibility. In modern landscapes where financial processes ran across multiple systems, access could appear compliant within individual applications while still introducing material risk across the end-to-end workflow.
KPMG’s most recent material weakness study underscored the point: among companies disclosing material weaknesses, 56% cited IT, software, security, and access issues—and 43% cited segregation of duties or control design weaknesses. These control gaps drove a rising cost of compliance. The 2025 KPMG SOX Survey reported an FY24 average program effort of 15,580 hours, with 45% of organizations reporting year-over-year cost increases. When access governance was weak by design, teams compensated with manual controls, spreadsheet-driven reviews, late-cycle remediation, and repeated audit retesting—creating friction across Finance, IT, IAM, and Internal Audit.
This session addressed the identity and access breakdowns that repeatedly surfaced in audits: disconnected joiner-mover-leaver processes that created access creep, SoD conflicts that didn’t map cleanly to financial workflows across applications, privileged access that wasn’t governed as a repeatable, auditable control, and high-volume user access reviews that generated evidence but limited assurance. The speakers also addressed a fast-growing blind spot: the lifecycle and governance of non-human identities—including service accounts, bots, and automation agents—that interacted with SOX systems without consistent ownership or enforceable boundaries.
The session included a demonstration of how identity discovery, access governance, and continuous compliance monitoring could be automated across SAP and adjacent applications using a modern identity security platform
Apr 23, 2026
•2 minute read
Unlocking the Real Power of SAP GRC Access Control Solution with VASPP Add-OnsSAP’s GRC Access Control solution is a widely recognized tool for efficiently managing user access to SAP applications. It offers a wide range of capabilities for managing user access, including automated access provisioning, access request workflows, and risk analysis along with access management automation. The solution is also capable of enforcing segregation of duties (SoD) policies to ensure that users do not have conflicting access privileges. But while the tool offers a comprehensive set of reporting and auditing capabilities and is an essential tool for any organization that requires a secure and efficient way to manage user access to their SAP systems, it is also a complex solution that requires significant expertise and experience to set up and maintain.
This article focuses on VASPP's suite of innovative GRC add-ons to address some of the challenges associated with traditional GRC Access Control solutions. These add-ons provide organizations with more ergonomic and user-friendly interfaces and make it easier for end-users to submit access requests and manage their access rights. The add-ons offer a modern web cockpit that streamlines the access request process and provides a more intuitive interface that requires less technical knowledge.
Jul 7, 2023
•7 minute read
SAP Cloud Identity Access Governance (IAG) – A PrimerSAP Cloud Identity Access Governance (IAG) is a cloud-driven solution designed to facilitate organizations in controlling access to vital business software and data. It forms a component of the SAP Business Technology Platform (BTP), offering a multitude of cloud services and solutions adaptable to businesses of different scales. With SAP Cloud IAG, companies can efficiently govern access to their SAP and non-SAP applications and their cloud and on-premise systems, all through a unified, centralized platform. While SAP Cloud IAG offers functionalities akin to SAP Access Control, which is part of SAP's GRC solutions, it is not intended as a replacement. Instead, it enriches Identity and Access Management (IAM) in complex cloud and on-premise settings and enhances compliance procedures with a user-friendly, dashboard-oriented interface, alongside a streamlined cloud experience.
The first in the series of articles on SAP Cloud Identity Access Governance (IAG) explores the key features and benefits of SAP Cloud IAG. Each article in the series will provide valuable insights and guidance for organizations who are looking for real-world case studies of successful implementations and best practices for implementation and customization.
Jun 27, 2023
•4 minute read
Events
SAPinsider Summit Philadelphia 2026Philadelphia, PA, United States
SAPinsider Summit New Orleans 2026New Orleans, Louisiana, United States
SAPinsider Summit Chicago 2026Chicago, IL
SAPinsider Copenhagen 2026Copenhagen, Denmark
