Controls to Prevent AI-Supported CEO/CFO Impersonation Frauds

By Prof. Hernan Huwyler, MBA CPA CAIO · Academic Director, IE Law School
Published 8 November 2026 · Last reviewed 8 November 2026

In short

• Voice and video are no longer reliable proof of identity. In the widely reported Hong Kong case, criminals used an AI-generated video conference to impersonate colleagues and induce a transfer of approximately US$25.6 million.
• Effective protection depends on verification steps that cannot be bypassed through a convincing conversation. Require payment authorisation through an independent channel, callbacks to previously verified numbers and additional approval for new beneficiaries or unusual transfers.
• Make these safeguards part of tested operational controls, not just written policies. Run realistic impersonation exercises and measure whether employees consistently follow verification and approval procedures before releasing funds.

A finance employee at the Hong Kong office of a London-based engineering firm received a message from someone posing as the group CFO. The message mentioned a confidential transaction, and the employee suspected phishing. Then he joined a video call, saw the CFO and several colleagues on screen, and heard voices he knew. The doubt faded, and he sent 15 transfers worth HK$200 million, about $25.6 million, to five accounts. Hong Kong police said everyone else on that call was a digital fake, as CNN reported.

Looking harder would not have saved him. People flag well-made fake video poorly even when they are told to hunt for fakes, so a defense built on spotting the fake fails at the moment the fake is good. The controls that work keep the payment safe when the voice, the face and the paperwork are all perfect. At the top of the ranking sit a callback to a number you already hold, approval only inside the system of record, two approvers reached on separate channels, and a cooling period for new payees. This article ranks twelve controls from most to least effective and explains how AI builds the fake documents and fake video meetings those controls have to withstand. It is written for controllers, treasury leads, accounts payable managers and the CFOs whose faces get borrowed.

The Hong Kong case was not a one-off. In November 2026, US prosecutors announced an indictment of three people accused of stealing about $129 million from companies between July 2024 and February 2026, using CEO emails, AI-generated executive voices and impostor attorneys, as AP reported through PBS NewsHour. The charges are allegations, and the defendants are presumed innocent. The FBI's Internet Crime Complaint Center counted $3.05 billion in business email compromise losses for 2025, and for the first time it broke out complaints that referenced AI: 22,364 of them, with about $893 million in reported losses across all fraud types, according to coverage of the report.

Oversight in AI Systems From Governance Illusion to Operational Control

By Prof. Hernan Huwyler, MBA CPA CAIO · Academic Director, IE Law School
Published 8 November 2026 · Last reviewed 8 November 2026

In short

• A policy, a committee, or a risk register entry is not evidence that an AI model is safe to approve. Evidence is a dated record that a quantified assessment was done, that a named executive accepted a stated loss tolerance, and that the model was tested against acceptance criteria set before the test.
• Acceptance criteria come from the loss the organization can absorb, not from a vendor benchmark. In the worked example below, a tolerance of 5 percent probability of exceeding 1.5 million in annual fraud loss translates into a minimum recall of about 0.79, so the approval threshold is set at 0.80 and tested with a confidence interval.
• Test the controls the criteria rely on. Measure reviewer catch rates in drills, red-team the agent permissions, and rerun the quantification when drift, a new tool, or a new model version changes the assumptions.

 

An approval board reviews a payment fraud screening model on a Tuesday afternoon. The vendor slide reports 94 percent accuracy, the project team is pleased, and the chair asks who decided that 94 percent was enough. Nobody answers, because the figure came from the vendor's test set and the bar was set after the result was known. The board approves the model anyway, and the minutes record that it met expectations.

AI governance needs evidence of that decision, and evidence has a specific form. It starts with a quantified assessment of what the model could cost if it fails: how often, how much, and how likely a bad year is. An accountable executive then states a tolerance, such as the largest annual loss they accept at a stated probability. Acceptance criteria are derived from that tolerance before anyone tests the model, and the test results, the approval, and the later monitoring are stored in records a reviewer could rerun. Without that chain, a governance program produces documents that describe intent and nothing that proves control.

This guide is for Chief AI Officers, risk and compliance leaders, internal auditors, model owners, and anyone who signs an approval. It explains what counts as evidence, what a quantified AI risk assessment contains, and how to turn a loss tolerance into numerical acceptance criteria for predictive and agentic systems. It then covers testing against those criteria, measuring human oversight as a control, how the EU AI Act and the main standards point the same way, and the evidence register that ties it together.

 

 

Compliance Theater Is Hiding Your Biggest Security Risks

By Prof. Hernan Huwyler, MBA CPA CAIO · Academic Director, IE Law School
Published 17 October 2026 · Last reviewed 17 October 2026

In short

• Compliance should be the outcome of an effective security programme, not a substitute for one. Reversing that logic can produce certificates and completed checklists while leaving critical security gaps undiscovered.
• Replace activity-based metrics with evidence of results: verified remediation, actual asset and vulnerability scan coverage, and audit evidence generated through routine operations.
• Attackers often exploit assets that the organisation does not know exist. An incomplete asset inventory can therefore undermine even a well-documented compliance programme.

 

Consider an illustrative scenario, a composite of patterns that repeat across security programs. A payments processor presents its quarterly security report to the audit committee. Every scheduled vulnerability scan ran on time. Nearly all employees finished security training, the certification renewed without a gap, and every audit finding from the prior year is closed. Three weeks later an attacker enters through a server that never appeared on a scan target list, because the team built it after the list was last updated. The report was accurate on every line, and it still told the committee nothing about whether the company was getting safer.

Compliance is a byproduct of security. When an organization knows its threats, protects the assets that matter, tests its controls, and fixes weaknesses until a retest confirms the fix, most of its compliance evidence becomes a record of work already done to reduce risk. When the sequence runs the other way, the organization collects evidence first and hopes protection follows. That gap is where false confidence grows, and decision-makers stop asking hard questions at the moment they most need to ask them. This article is for CISOs and compliance officers who want to report outcomes instead of activity, and it ends with seven metrics you can start swapping in this quarter.

The argument covers the obligations most teams already carry. GDPR, NIS2, HIPAA, SOX, PCI DSS, ISO/IEC 27001, and SOC 2 each ask, in different words, whether controls work and whether you can show it. Compliance stays a legal and contractual duty with its own deadlines, and nothing here argues for skipping it. The point concerns order and evidence. Security work comes first, and the records that work produces earn the compliance claim. The sections below cover what each obligation requires, how checkbox reporting goes wrong, which metrics replace it, and how to make the evidence trail a normal output of operations.

 

Guide for Risk Managers for DORA Compliance

By Prof. Hernan Huwyler, MBA CPA CAIO · Academic Director, IE Law School
Published 16 October 2026 · Last reviewed 16 October 2026

In short

• DORA has applied since 17 January 2025. The priority is now demonstrating that data, accountable owners and operational processes can support compliance and respond to supervisory scrutiny.
• Map critical or important functions to the ICT assets and services that support them before preparing reporting templates. This register provides the foundation for the wider DORA program.
• Build the programme around day-to-day operations, with particular attention to incident reporting deadlines and ICT third-party oversight, two areas where implementation can become difficult.

 

A quarterly operational risk report that takes four months to produce is already a DORA problem, and nobody has opened the regulation yet. By the time the report lands, two newer quarters of incidents, supplier changes and control failures have happened. The Digital Operational Resilience Act, Regulation (EU) 2022/2554, has applied since 17 January 2025, so the open question for most financial entities is no longer when to start. The question is whether their data, owners and processes can answer a supervisor within hours instead of months.

The short answer is to build one maintained dependency model that links each critical or important function to its information, ICT assets, providers, contracts, incidents and test results, and then run the five DORA chapters on top of it. The chapters cover ICT risk management, incident management and reporting, resilience testing, ICT third-party risk, and information sharing. Most of the effort sits in the links between those chapters. A firm that treats them as five projects ends up with five registers that disagree with each other.

This guide is for risk owners, compliance officers, internal auditors and security leads who have to turn the regulation into working procedures. It follows the order in which a program usually runs, and it separates what the regulation requires from what is a sensible implementation choice. It also corrects several statements that circulate in conference slides and vendor material, such as the idea that DORA requires threat-led penetration testing from every firm.

 

How to Plan, Govern, and Build Enterprise AI Agents and AI Architecture

By Prof. Hernan Huwyler, MBA, CPA, CAIO · Academic Director, IE Law School
Published 14 October 2026 · Last reviewed 14 October 2026

In short

• An AI pilot can perform impressively in a controlled demonstration yet fail in production when real users, operational costs, data access, permissions and unpredictable outputs enter the picture.
• Enterprise AI governance must extend beyond model selection and prompt design. It must cover the complete operating environment: data, integrations, identity, access rights, monitoring, escalation and accountability.
• AI agents need clearly defined permissions and boundaries. Their ability to call tools, retrieve information or initiate transactions should be limited to approved tasks and risk levels.
• Deterministic software controls should enforce critical business rules, security requirements and approval thresholds. Prompts and model instructions alone are not reliable enforcement mechanisms.
• Successful AI deployment requires named business and technical owners, measurable performance indicators, human intervention procedures and continuous monitoring after go-live.
• The central lesson for executives, AI architects and risk professionals: production readiness is an architecture and governance challenge, not simply a question of choosing a more powerful AI model.

 

AI governance professionals need more than policies. They need to understand how AI systems are designed, where controls belong, and what happens when agents act in the real world.

An AI pilot can look impressive in a demonstration and still fail when a company tries to put it into production. Costs grow, permissions become difficult to manage, outputs vary, and nobody knows exactly who should intervene when something goes wrong.

For risk managers, internal auditors, compliance officers, cybersecurity experts, and IT professionals, these are not abstract technology problems. They are questions of accountability, control design, operational resilience, and business value.

That is why I believe AI architecture deserves a place at the center of enterprise AI governance.

 

Essential Skills for GRC, Finance, Legal and Cyber in 2027 and 2028

This article answers one worry: if AI now drafts the policies, tests the controls, reviews the contracts and triages the alerts, what is left for a GRC, finance, legal or cyber professional to do? The answer is five human skills, ranked by how well they protect your job: professional judgment (called taste in the AI community), agency, follow-through, focus and resourcefulness. Each one sits where automation stops and accountability starts. Judgment decides which AI output is sound and defensible. Agency moves you from the person who samples 40 payments to the person who runs the agent that checks all 18,000. Follow-through makes the work land with the people who rely on it. Focus keeps you on the few exposures that matter, and resourcefulness lets you take on the unfamiliar projects others decline.

The key advice is to build these skills on one real project instead of reading about them. Pick one control you test by sampling today, write the decision it supports and who makes it, and run an agent across the whole population. Write down the rules you used to sort real exceptions from noise, because that is your judgment on paper. Keep humans on irreversible decisions, give every agent an owner, a boundary and a log, and stay with the work until the business actually uses it. Revisit the projects you ruled out, since the constraint that stopped them may be gone. Employers will pay for the professional who can show the exposure chosen, the decision supported and the person who relies on the result.

Consider a composite situation, not a real engagement. An internal auditor at a mid-sized manufacturer spends two weeks every quarter testing a sample of 40 payments out of roughly 18,000 for duplicates and approval breaches. That sample covers about 0.2 percent of the population, and everyone in the room knows it. An AI agent can now read all 18,000 payments overnight and hand the auditor a short list of exceptions by Monday morning. The two weeks of sampling are gone, and so is the part of the job that looked like work.

The question for 2027 and 2028 is what the auditor does with the other thirteen days. The short answer is five human skills, and I rank them here by how well they protect a GRC, finance, legal or cybersecurity career from displacement by automation of repetitive analysis, reporting and control reviews. In order of job-market relevance they are professional judgment, agency, follow-through, focus and resourcefulness. This article is for risk analysts, internal and external auditors, compliance officers, finance controllers, in-house lawyers and security engineers who want to know which habits employers will pay for once everyone has the same AI tools.

AI has removed the old excuses that kept capable professionals from acting on what they already understood: no time, no access, no technical skill. That makes the call to action simple. Revisit the projects you ruled out in the last three years, because the constraint that ruled them out may no longer exist. AI has expanded what is possible in risk management, auditing, compliance, cybersecurity, legal work and finance faster than most people have expanded what they are willing to attempt, and that gap is where your next promotion sits.

Agentic AI in Internal Audit, What to Automate, What to Keep

 

Consider an illustrative scenario, not a real engagement. A mid-sized distributor connects an audit agent to its ERP, its document repository and its ticketing tool. Within a week the agent has pulled invoices, receipts and approvals for 240 purchase orders and produced a tidy memo saying the procure-to-pay control passed. The audit manager reads it, likes it, and asks the only question that matters: which records did the agent open? Nobody can answer.

The short answer to the sequencing problem is this. Agentic AI should first take bounded, repeatable, evidence-based work: a finite set of documents, stable rules, and output you can check against a known result. It must not decide audit scope, judge whether evidence is sufficient, conclude that a control works, rate a finding, or close an issue. Those decisions belong to accountable auditors, and an agent can only prepare the ground for them.

This article is for internal auditors, chief audit executives and the managers and audit committee members who oversee them. After reading it you will be able to sort audit tasks into automate now, automate with review gates, and keep human. You will also have a short list of access rules, evidence requirements and escalation triggers to put in place before any agent touches a workpaper. The question to ask is not whether AI can replace internal auditors. Ask which audit activities are bounded enough to automate safely, and which decisions need independent professional judgment and a named person who answers for them.

 

AI Governance Frameworks For Risk Managers

 

Corporate environments are adopting autonomous systems at a pace that outstrips traditional oversight mechanisms. Engineering teams ship automated workflows daily. Business units integrate external models into core operations without formal review. The resulting environment creates massive blind spots for risk professionals. You cannot manage what you cannot see, and you certainly cannot audit what you do not understand. The era of treating artificial intelligence as a mere productivity enhancement is over. It is now a foundational component of enterprise architecture. This shift demands a complete rethinking of control environments.

Risk managers, compliance officers, and cybersecurity experts must transition from passive observers to active architects of machine behavior. The theoretical debates about future capabilities no longer matter. The immediate reality involves managing current deployments that process sensitive data, execute financial transactions, and interact directly with customers. Professionals who master this transition will define the next decade of corporate governance. Those who fail will preside over catastrophic compliance failures and severe reputational damage.

This guide provides a direct, actionable blueprint for securing autonomous systems. We will explore five essential pillars of modern risk management. These pillars move beyond basic policy documents. They focus on the practical implementation of controls, the integration of global standards, and the strategic career positioning of governance leaders. You will learn how to validate machine outputs, secure third-party integrations, assign legal accountability, capture institutional context, and manage the hidden costs of automated code generation.

AI Agent Segregation of Duties Guide for GRC and SOX Compliance

 

Finance leaders are under constant pressure to cut costs, and automation is the fastest lever available. IT teams are asked to hand AI agents more autonomy every quarter, and in many workflows that autonomy now stretches across the full transaction lifecycle: an agent reads customer or financial data, produces a recommendation, approves it, executes the action through an API, and writes the log entry that documents what happened.

No serious organization would hand a single employee that combination of powers without a control wrapped around every step. Yet that is precisely the architecture some companies are building today, one agent deployment at a time, often without anyone deciding to do so on purpose. This piece walks through why that pattern is a genuine segregation of duties problem, what Sarbanes-Oxley actually requires when an agent touches a financially relevant process, and what a control owner can do about it in practice.

The Risk Management Blueprint: A Practitioner's Guide to Quantitative GRC

 

Risk management has a credibility problem. Not because the profession lacks talent, but because color-coded heat maps, ordinal scoring matrices, and quarterly dashboard reviews were never built to change decisions. They exist to document that a compliance process took place. Executive teams know this. They react accordingly by treating risk departments as corporate overhead instead of strategic assets.

I wrote this book to help my peers turn that dynamic around.

After 25 years leading risk functions and advising executive boards across complex multinational companies, I needed a manual that actually bridges advanced quantitative methods with the daily decisions that determine business outcomes. That drive is why The Risk Management Blueprint hit #9 among the most sold risk management books in the weeks after publishing.

At 867 pages, it gives practitioners a single unified methodology across every major risk domain, covering AI systems, cyber exposure, financial cash flows, sustainability transitions, and human behavior. The framework rests on probability theory, financial modeling, and decision science so you can swap subjective scores for numbers that stand up in the boardroom.

You can preview the first four chapters and access the book here: https://amzn.to/4ciag1F

This is not a textbook. It does not spend the majority of its pages diagnosing what is broken in the profession before gesturing toward improvement in a final chapter. More than 70 percent of the book's total length is allocated to domain applications and advanced analytical infrastructure, meaning the bulk of every page is spent on how to build, calibrate, and apply quantitative and predictive risk models across the decisions that actually shape organizational outcomes.

SOC 2 Is Not Security: A Critical Guide for GRC Managers

Let us be direct. SOC 2 is not a security certification. It is an attestation report issued under AICPA standards in which a licensed public accounting firm expresses an opinion on whether a service organization controls met the selected trust services criteria. The report does not declare that your product is safe. It does not certify that your penetration test was rigorous. It does not prove that your attack surface is small or that your customers are protected from a breach. It states that management described a system, selected criteria, asserted controls, and the auditor found those controls suitably designed and, for a Type II report, operating effectively during the specified period.

That distinction matters more than many teams are willing to admit. The report can create a polished artifact that procurement teams accept, but the underlying controls may still be thin, poorly scoped, or disconnected from the technical reality of the product. The phrase SOC 2 is the audit version of trust me bro became popular for a reason. When the PDF is stronger than the security program, the market starts rewarding documentation rather than operational resilience. As a GRC leader, your job is to reverse that sequence. Build the controls, operate them, collect evidence continuously, and let the SOC 2 report fall out as a byproduct rather than serving as the starting point.

This guide walks through the exact gaps that make SOC 2 incomplete as a security signal, how to read a report without wasting your review cycle, how to build a security-first program that makes SOC 2 the output, how to use continuous assurance strategically, and how to govern vendors that hand you a SOC 2 report and expect instant approval. The focus is practical because the risk owner in the room rarely needs another abstract debate. You need a method for using SOC 2 as one piece of evidence among many.

The article is intended for a global audience. SOC 2 is a US-origin AICPA attestation product, but it is now exchanged across borders by cloud providers, software vendors, data processors, and AI product teams. It often sits alongside ISO/IEC 27001, NIST Cybersecurity Framework, CIS Controls, GDPR, HIPAA, NIS2, and emerging AI governance obligations. That means the underlying discipline remains the same. Understand the limitations, own the controls, and never outsource your risk judgment to a report.

 

Stop Chasing Evidence to Start Informing Decision-Making

Walk into most GRC departments in large global companies and you'll find talented professionals spending their weeks on the same treadmill: updating a register, chasing a control owner for evidence, formatting a report nobody outside compliance will read. That work isn't worthless, audits need it and regulators expect it, but it has quietly become the entire job for a lot of practitioners, and that's a problem nobody in the function wants to say out loud. Paper compliance was built for a slower, less automated world. The world asking for your risk function’s input now needs something else: probabilistic insight that turns uncertainty into measurable exposure, decision thresholds, planning choices, and control responses that improve performance.

uncertainty → exposure → thresholds → decisions → treatment actions → performance 

 

AI Isn't Coming for GRC Jobs. It's Coming For The Manual Review Part of Every GRC Job

Here's the uncomfortable part nobody says out loud in a GRC conference room. AI is not replacing risk managers, compliance officers, auditors, cyber teams, controllers, or sustainability experts. It's replacing the manual review work that used to justify half of those job descriptions. What's left after that work disappears is judgment, and judgment is either your biggest career asset right now or the skill you never actually built because the manual work always came first.

Every one of these six professions is being pulled through the same transformation at the same time, just wearing different clothes. Risk teams are using AI to process larger volumes of exposure data faster than any analyst could by hand. Audit is automating the routine testing that used to eat most of fieldwork season. Cyber teams are automating alert triage and first-line response. Compliance is watching AI surface policy conflicts across thousands of documents in the time it used to take to review one contract. Controllers are automating reconciliations and close procedures. Sustainability teams are automating ESG data extraction and disclosure drafting.

None of that is a headcount story on its own. It becomes one for the people who don't adapt, because the professionals who can validate AI outputs, challenge exceptions, and decide where a human still has to sign off are becoming the only ones a board actually needs in the room.

 

S/4HANA Role Redesign: Fix Segregation of Duties Before Go-Live or Pay the Audit Bill After

 

Why Privilege Creep Kills SAP Migrations Before the First Production Transaction Runs

Your migration to SAP S/4HANA is six months out. The project team is focused on data migration, Fiori tile configuration, and cutover planning. Meanwhile, 847 user roles built across eight years of organizational changes, job transfers, emergency firefighter access, and M&A integrations are being lifted wholesale into the new system. Nobody has reviewed them. Nobody has mapped them against the new S/4HANA authorization model. And your external auditors are already asking for the SoD conflict report.

This is the standard failure mode. And it is expensive to fix after go-live.

Migrating unremediated ECC roles into S/4HANA production does not just inherit old access risk. It amplifies it. S/4HANA's simplified data model, new Fiori authorization objects, and transaction replacements create net-new SoD conflicts from role content that was previously clean.

This article gives you the technical remediation workflow to stop that from happening. It covers the SAP-native tools, the sequencing logic, the role design architecture that prevents re-accumulation, and the automated tooling that makes the process viable at enterprise scale.

 

SR 26-2 Is Here: The 2026 Model Risk Guidance That Finally Gives Validators Teeth

On April 17, 2026, the Federal Reserve, the FDIC, and the OCC (collectively, "the agencies") issued SR Letter 26-2, which replaces prior model risk management guidance, the SR 11-7 issued in 2011. This update refines supervisory expectations regarding how banking organizations should calibrate their model risk management frameworks. The guidance is most directly applicable to institutions with total assets exceeding $30 billion, though smaller institutions with complex modeling activities are advised to consider its principles.

The guidance formally excludes simple arithmetic calculations, deterministic rule-based processes, and notably, generative artificial intelligence and agentic artificial intelligence models from the definition of a model. However, the agencies explicitly state that traditional statistical, quantitative, and non-generative artificial intelligence models remain within scope. The primary audience is organizations with over $30 billion in assets, reflecting a tailored supervisory approach that recognizes the lower inherent risk profiles of most community banking institutions.

 

How to Stop Producing Risk Registers Nobody Uses

Enterprise Risk Management programs fail in the same quiet way. They produce polished registers, colorful heat maps, and quarterly reports that look impressive in board packs. Then the organization makes its next major capital allocation, acquisition, or vendor choice using a single-page summary with one projected number and zero reference to the risk framework that consumed thousands of hours to build.

I've watched this pattern destroy the credibility of risk functions across industries. The risk team works hard. Stakeholders get interviewed. Likelihood and impact get scored. And none of it touches the actual decisions that determine whether the organization wins or loses. The gap between risk reporting quality and decision quality is where ERM programs go to die.

This article addresses that gap directly. It provides a stage-by-stage implementation approach for building an ERM program that changes how your organization decides, plans, and allocates resources. Every recommendation comes from field-tested practice, not theory. If your ERM program currently produces documents that live in SharePoint between annual reviews, this post shows you how to fix that.

 

How to Use Large Language Models Securely in Risk Management, Compliance, Cybersecurity, and Audit

 

A compliance officer asked an LLM to analyze a vendor contract for GDPR obligations. The prompt included the full contract text. The contract contained employee names, personal email addresses, salary data from an embedded compensation schedule, and a confidential arbitration clause. All of it went into a third-party API. The compliance officer received a helpful analysis. The organization received a data privacy incident.

Nobody planned for this. The compliance officer was doing good work. The tool produced a useful output. And the organization now had regulated personal data sitting in an external system with no data processing agreement, no retention controls, and no way to request deletion.

That is the paradox of LLMs in GRC. The same capability that makes them powerful for regulatory analysis, risk assessment, and audit automation makes them dangerous when deployed without guardrails. An LLM will process whatever you feed it. It does not distinguish between public regulatory text and confidential personal data. It does not know that the regulation it cited does not exist. It does not understand that the risk score it generated was influenced by training data biases that systematically underweight emerging market vendors.

 

How to Audit the SAP S/4HANA Order-to-Cash Cycle

Practical Audit Controls for the SAP S/4HANA Order-to-Cash Cycle

Revenue problems rarely begin in the income statement.

They begin earlier. In customer master data. In pricing conditions. In credit limits. In copy control. In blocked deliveries that no one resolves. In incomplete sales documents that sit too long. In manual overrides that looked harmless at the time.

That is why a strong SAP S/4HANA order-to-cash audit is never just a sales process walkthrough. It is a control review across sales, shipping, billing, receivables, customer master data, pricing, credit management, and the handoff into financial accounting.

I have seen organizations with healthy top-line growth discover margin leakage only after audit tested pricing overrides and free-of-charge processes in detail. I have also seen teams with good commercial discipline still struggle because customer business partner data, incompleteness procedures, or credit checking were only partially configured. The process looked fine on paper. The exceptions told a different story.

This article gives you a practical framework for auditing the SAP S/4HANA order-to-cash cycle. It covers new S/4HANA features, enterprise structure, master data, security, common configurable controls, high-value reports, and the technical details needed for a serious audit or GRC review. As requested, I include transaction codes, tables, authorization objects, and field-level references where they are relevant.

 

How to Execute a Complete SAP S/4HANA Audit: ITGCs, Basis Security, Process Controls, and Every T-Code You Need

 Most SAP S/4HANA audits fail before fieldwork even begins. The planning is shallow, the scope misses entire control layers, and the team lacks the technical depth to distinguish a real finding from a false positive. I have seen audit reports with 40 findings that missed the three issues that actually mattered. That is expensive failure.

Getting the SAP S/4HANA audit right matters because the system sits at the center of financial reporting, procurement, inventory management, and dozens of other processes that carry real organizational risk. A weak audit gives false assurance. A strong audit identifies quantifiable business impact and drives measurable control improvement.

This post walks through the complete SAP S/4HANA audit framework, from IT General Controls through business process validation, with every T-code, table, and configuration parameter you need to execute at a high level. Each section includes implementation tips drawn from field experience across financial services, manufacturing, and public sector engagements.

 

Practical Audit Controls for SAP HANA in IT General Controls Reviews

SAP audits slow down for a simple reason. The team asks good control questions, but they pulls evidence the hard way. That is expensive. It is also risky. When GRC teams run IT General Controls reviews, Basis reviews, security assessments, and compliance testing without a clear SAP HANA evidence model, they miss population-level issues, they over-rely on screenshots, and they burn weeks reconciling exceptions that should have been identified in hours.

I have seen this firsthand. In one global SAP program, the audit team had strong control design knowledge but no HANA-native audit approach. They extracted data into spreadsheets, sampled manually, and escalated dozens of false positives. The rework took three extra weeks. The actual root cause was not weak audit judgment. It was weak technical evidence strategy.

This post fixes that problem.