SAP S/4HANA SOD: The 15 Conflict Pairs Every External Auditor Flags First

The migration from SAP ECC to S/4HANA does not automatically clean up your Segregation of Duties landscape. In fact, the simplified authorization concept in S/4HANA — combined with the introduction of Fiori apps and new authorization objects — often introduces new SOD risks that did not exist in ECC.

Why S/4HANA SOD Is More Complex

In ECC, SOD was managed through transaction codes (T-codes) and authorization objects. In S/4HANA, Fiori apps abstract the underlying T-codes — a single Fiori app may execute multiple T-codes, and the authorization object structure has changed significantly in Logistics, Finance, and Procurement modules.

The 15 Conflict Pairs Auditors Flag First

1. Create Vendor + Approve Payment — Classic procure-to-pay conflict
2. Create Purchase Order + Approve Purchase Order
3. Post Goods Receipt + Create Vendor Invoice
4. Create Customer + Post Customer Invoice
5. Create GL Account + Post Journal Entry
6. Approve Journal Entry + Post Journal Entry
7. Create User + Assign Authorization Roles — IT SOD, highest risk
8. Execute Payment Run + Release Payment Run
9. Create Asset + Depreciate Asset
10. Create Material + Release Purchase Order for Material
11. Maintain Bank Master Data + Initiate Wire Transfer
12. Access Salary Data + Post Payroll
13. Create Credit Memo + Release Credit Memo
14. Change Contract + Approve Contract
15. Access Debug Mode (SM50/SM51) + Any Financial Transaction — Highest risk ABAP developer conflict

Using NextGen GRC for SOD Analysis

NextGen GRC's SOD module maps these conflict pairs across SAP ECC, S/4HANA, and Oracle EBS — with role-level and user-level conflict detection, risk scoring, and compensating control documentation. The AI-powered risk assessment module generates a remediation roadmap prioritized by audit risk.