Meet the Speakers

S/4HANA transformation impacts the most critical applications that run a business. Any delay or deployment issue will have significant effects on the business. These can lead to disruptions, security issues, and audit findings. Many organizations assume access governance is a workstream to bolt on after the technical migration is done, or that a lift-and-shift approach sidesteps the problem entirely. It does not. Lift-and-shift moves existing roles and authorizations onto the new stack largely as-is. It carries legacy SoD conflicts and outdated access forward unchanged, and it does not account for the role redesign that S/4HANA’s new authorization objects and Fiori catalogs actually require.

In this session, Pathlock’s Susan Stapleton and Chris Radkowski walk through why access governance and security have to be embedded in every phase of an S/4HANA transformation, from planning through deployment and beyond, and what happens to the business when it is not. Attendees will leave with a practical view of what access governance requires at each stage of the program, where the lift-and-shift approach falls short, and why some organizations build governance in early to avoid disruption at cutover rather than discovering the gap during it.

Register Now to learn how to:

Explore related questions
  • Determine when security and access design should start in your S/4HANA program plan — and who owns it: the transformation team, security, or GRC.
  • Identify the access governance decision points in a typical S/4HANA program timeline and where each belongs relative to go-live.
  • Assess current-state access risk — SoD conflicts, sensitive access, and actual usage — and define acceptance criteria for what must be resolved before cutover.
  • Apply a framework to build compliant roles and controls into the transformation rather than after it.
  • Explain how S/4HANA-specific changes — Fiori apps, redesigned processes, and RISE/clean-core deployment models — alter SoD rulesets and role design compared to ECC.
  • Avoid findings in your first post-go-live SOX audit, and add a security workstream without moving the go-live date.

Sponsored by:

pathlock