SAP Audit Questionnaire: What SAP Is Really Asking and How to Respond Strategically

The Audit Questionnaire Is Not Neutral

When SAP sends you an audit questionnaire—often delivered via email or through a formal audit notification letter—it appears innocuous. Just a series of factual questions about your SAP environment. It's not. The questionnaire is a reconnaissance tool designed to systematically map your SAP system landscape, identify integration points, discover indirect access exposures, and uncover user classification discrepancies before SAP deploys measurement tools.

SAP's audit questionnaire serves multiple strategic purposes. First, it identifies all SAP systems in your environment—including test systems, development environments, and legacy systems that SAP might not have visibility into through your Effective License Position (ELP). Second, it flags integration points and third-party connections, which creates openings for indirect access claims. Third, it discovers which affiliate entities, subsidiaries, and partner organisations touch SAP, expanding SAP's potential claiming universe beyond your original licensee scope.

The questionnaire is not a neutral discovery document. It's designed to maximise the scope of SAP's audit claim. Every answer you provide becomes evidence in SAP's audit file—and SAP will use it later to support claims you may not expect. This is why responding strategically is critical.

The 8 Most Dangerous Questions in SAP's Audit Questionnaire

How to Respond Strategically to the Audit Questionnaire

Principle 1: Get Legal Counsel Involved Before Responding

Before your finance or IT team drafts a single response, involve your legal counsel. Audit responses are contractual documents. They can be used against you in a dispute if they contradict your ELP or contain admissions of non-compliance. Your legal team should review all responses for accuracy, contractual consistency, and risk mitigation.

Principle 2: Designate a Single Point of Contact

Do not allow SAP auditors to directly interview your IT team, finance staff, or system administrators. Create a single point of contact—ideally your procurement or legal counsel—who coordinates all audit communication. This prevents SAP from gathering conflicting information from different stakeholders and using discrepancies to support claims.

Principle 3: Respond Only to Contractual Requirements

Your SAP Master Agreement contains an audit clause that defines what information you're obligated to provide. Typically, this is limited to data necessary to verify compliance with your Effective License Position. SAP often requests far more data than your contract requires. Don't provide it. For each question, ask: "Is this information required to verify compliance with our ELP?" If not, decline politely.

Principle 4: Respond in Writing; Avoid Verbal Answers

Verbal responses can be misremembered, misquoted, or misrepresented. Always respond in writing. This creates a record. If SAP later claims you said something you didn't, you have documentation to contradict them.

Principle 5: Request SAP to Specify Contractual Basis for Each Question

For every question in SAP's questionnaire, you can ask SAP: "Which audit clause in our Master Agreement requires us to provide this information?" SAP's audit rights are contractual, not unlimited. If a question isn't contractually grounded, decline to answer.

Principle 6: Provide Only Verified, Confirmed Data

Don't estimate, speculate, or round. If you don't have precise data, say so. State: "We do not have reliable data on this metric without a formal measurement. We recommend SAP use its measurement tools to verify this data point." This puts the burden on SAP to prove non-compliance through measurement, not on you to provide admissions through self-reporting.

What You're Legally Required to Provide vs. What SAP "Requests"

This is the critical distinction. Your SAP Master Agreement audit clause typically grants SAP the right to audit your compliance with your Effective License Position. This is a contractual audit right, not a blank check for unlimited information access.

Contractually required information usually includes: proof that you have not exceeded your named user count, evidence that you have not deployed modules outside your licensed scope, and documentation of your current user classifications. That's it. SAP is entitled to verify the specific terms of your ELP—nothing more.

SAP often requests additional information: detailed system architecture, integration diagrams, user access logs, business process documentation, etc. These "requests" are not contractually required. You can decline them. SAP will sometimes assert these are "necessary to conduct a thorough audit," but "thorough" ≠ "contractually required." Protect your environment. Limit SAP's access to what your contract actually requires.

The STAR/SLAW Self-Declaration Alternative: Hidden Risk

SAP sometimes offers STAR (Self-Declaration Tool) or SLAW (License Administration Workbench) as an alternative to a full audit. These seem attractive: less intrusive, faster, self-declared. But they carry risk.

When you use STAR/SLAW for self-declaration, you're creating a formal baseline record. SAP stores this declaration and uses it in future audits. If your environment changes (new users, new modules, new integrations), future audit findings will be compared against your STAR/SLAW baseline. You've essentially locked in your position. If SAP later discovers you under-reported in STAR, they'll claim the discrepancy is evidence of deliberate non-compliance, even if it was an honest mistake.

Self-declarations are useful only if: (1) you're confident your baseline data is 100% accurate, (2) you don't expect significant environment changes in the next 3-5 years, and (3) you've run independent USMM measurement to verify your position before declaring. Otherwise, avoid them.

Practical Response Framework: Building Your Audit Response Policy

Step 1: Centralise Audit Communication

Create an internal audit response team: procurement, legal, finance, and IT. All SAP audit requests flow through your legal team. No side conversations with SAP. This prevents inconsistency and ensures legal review.

Step 2: Run Independent USMM Before Responding

Before you answer any user count or system deployment questions, run an independent USMM measurement. This gives you verified baseline data. When SAP asks "How many users?", you respond with USMM data, not estimates. This shifts control to verified metrics.

Step 3: Map Questionnaire to Your ELP

For each question, determine: Is this information required to verify compliance with our ELP? If yes, answer with verified data. If no, decline politely with language like: "This information is not required to verify compliance with our ELP under our Master Agreement. We're prepared to provide data specifically related to [your ELP terms]."

Step 4: Draft Formal Written Responses

Don't email loose answers. Draft a formal response document. For each question, state: your response, the source of the information (measurement tool, ELP, etc.), and the date. Create a record that's defensible in a dispute.

Step 5: Request Clarification on SAP's Legal Basis

In your formal response, include a statement: "Please confirm the specific audit clause in our Master Agreement that requires provision of each of the above data points." This forces SAP to justify their requests contractually. If they can't, you have grounds to deny future requests.

Step 6: Engage Independent Advisor if Risk Detected

If SAP's questionnaire reveals potential compliance gaps (e.g., they're asking about integrations that might constitute indirect access), engage an independent SAP licensing advisor before responding. They can help assess risk and formulate defensible responses that don't create audit findings.