A lot of organizations are planning, preparing for or undergoing SAP S/4 HANA transformation. Security is an important aspect of any IT implementation/ migration project and user access is one of the most important aspects of the information security. Therefore, SAP role redesign is a crucial consideration in the context of an SAP S/4HANA transformation.

It is very common for organizations using SAP ECC for a long time to end up with lots of issues with user authorizations – which includes both excessive access and Segregation of Duties (‘SoD’) conflicts. S/4 HANA transformation is often a trigger to address these authorization issues, and this often requires SAP role redesign. One of the questions, which often comes up is whether the SAP role redesign should be performed before, or during the transformation. This blog aims to provide some insights to help you decide.

Case for SAP role redesign before S/4 HANA Transformation

1. It is possible to align the new SAP roles with future business processes. This will ensure that they align with the new processes and capabilities enabled by the transformation and your role design is ready to support the future S/4 HANA system.
2. There is one less task to be performed during the transformation project, which is often a complex project even without the role redesign.
3. By defining new SAP roles before the transformation, you can facilitate the change management more effectively.
4. Changing roles during the transformation can add complexity to both the project as well as the role redesign.

And most importantly, by addressing the authorizations issues upfront by redesigning the role, you reduce the risk exposure of your organization.

Case for SAP role redesign as part of S/4 HANA Transformation

1. Without hands-on experience with S/4HANA, it may be challenging to design roles that fully leverage its features.
2. If the role redesign is performed before transformation, it is possible that role redesign may need to be revisited after the transformation, as actual usage and requirements become clearer. Therefore, it is more efficient to perform role redesign during the transformation.
3. This is less disruptive for the business since they can test the new role together with the overall transformation UAT – making the UAT both more comprehensive and efficient.

In any case, it is not a good idea to push the role redesign after the SAP S/4 HANA transformation. Change management for such redesign is often very difficult.

Hybrid approach

If you are unable to decide, a hybrid approach may be the most effective way forward.  An outline of this hybrid approach is as follows:

1. Initial role assessment – conduct a high-level role assessment before the transformation project to identify potential changes required in role design.
2. Phased role redesign – implement initial role changes, focusing on critical areas, before the transformation.
3. Refinement – refine and finalize role redesign as part of the S/4 HANA transformation, incorporating final functionalities and process flows.

Some best practices for SAP S/4 HANA role redesign

Whatever approach you take for SAP role redesign, here are some best practices you should consider:

1. Involve relevant stakeholders including business process owners, SAP functional consultants, key users, and SAP security & authorization teams
2. Standardize processes before designing roles to ensure efficiency and effectiveness
3. Develop a naming standard and role maintenance rule book
4. Ensure role design is aligned with your SoD requirements upfront
5. Consider special roles for special activities (including sensitive access)
6. Continuously monitor role effectiveness and adjust as needed.

By adopting a phased approach and considering these factors, you can ensure that role redesign supports a successful S/4HANA transformation and drives business benefits.

This blog is written by Edna Tam, Managing Consultant with Hexadius Consulting.