Key Takeaways
- SAP FUE risks cluster into three categories: contractual (ambiguous definitions), technical (USMM overcounting), and strategic (growth-linked cost escalation).
- The biggest single risk is accepting SAP's initial FUE measurement without independent challenge — the average first claim exceeds actual liability by 25–40%.
- Engine metric growth provisions in RISE and S/4HANA contracts create perpetual, uncapped cost escalation unless explicitly negotiated out.
- Undocumented service accounts and third-party integration users are a consistent source of FUE overcounting that most internal teams miss.
- Contract language ambiguity — particularly in agreements signed before 2018 — gives enterprises significant grounds to challenge FUE definitions that SAP now applies more broadly.
- Every FUE risk identified in this guide has a specific, actionable mitigation. None requires SAP's cooperation to implement.
Why SAP FUE Is a Structural Risk, Not Just a Compliance Issue
Most enterprises treat SAP FUE as a compliance problem — something to manage at audit time. That framing misses the deeper issue. SAP FUE risks are structural: they are embedded in how the metric is designed, how it's measured, and how the contracts governing it are written. Waiting for an audit to address FUE exposure is equivalent to managing your tax position only when HMRC arrives at the door.
SAP's FUE model was built to grow with your organisation. Engine metrics track headcount and transaction volume. Named User FUE accumulates as teams grow. RISE subscriptions embed growth provisions that trigger automatic additional charges. None of this is accidental — it is deliberate product and contract design that maximises SAP's recurring revenue from existing customers.
Understanding the specific risks allows you to quantify your exposure and implement targeted mitigations before costs escalate. The complete technical context is in our SAP FUE complete enterprise guide. This article focuses on the eight most significant risks and what to do about each one.
Risk 1: Accepting SAP's Measurement as Final
Treating USMM Output as Your Actual Licence Position
Typical exposure: £500K–£5M+SAP's USMM tool measures what is in your system — user accounts, role assignments, access logs — and generates a FUE count based on SAP's default classification logic. This output is then submitted to SAP as the LAW measurement file, which becomes the basis for any compliance gap calculation and back-licence claim.
The risk: USMM does not apply your specific contractual definitions. It applies SAP's standard measurement logic, which is systematically broader than most enterprise contracts actually require. Users are classified into higher-cost licence types based on role assignments rather than actual transaction usage. Terminated employees, contractors, and out-of-scope entities appear in counts that the contract may not require.
Risk 2: Undefined "Employee" in Engine Metric Contracts
Ambiguous Employee Definitions Driving Engine Metric Inflation
Typical exposure: £200K–£3M+ annuallyFor SAP HCM, SuccessFactors, and Payroll products, the engine metric — and therefore a significant portion of your licence fee — is based on employee count. The critical question is: what counts as an employee? Most contracts define this poorly. SAP's measurement team interprets "employee" as broadly as possible; enterprise buyers should interpret it as narrowly as the language permits.
Common overcount scenarios: the HCM system includes terminated employees in inactive status that should not contribute to the engine metric; temporary and agency workers hired through third-party agencies are included when the contract only covers direct employees; employees in subsidiaries or affiliated companies that have separate SAP contracts are double-counted; employees onboarded to the HCM system before an SAP go-live but who never actually accessed SAP are included in the count.
Risk 3: Growth-Linked Engine Metric Escalation
Uncapped Engine Metric Growth Provisions
Typical exposure: 15–25% cost increase per contract termEngine metrics create a direct financial link between your business growth and your SAP licence costs. Every new employee added to SAP HCM, every additional payroll unit processed, every increment in Ariba spend managed through the network — all of these automatically increase your licence liability under engine-metric contracts.
Most enterprise SAP contracts contain annual true-up provisions that allow SAP to invoice for engine metric growth outside of the renewal cycle. In RISE with SAP contracts, these provisions are typically quarterly. Once signed, you have limited ability to resist the invoices — the growth is contractually locked in.
Risk 4: Service Account and Technical User Overcounting
Interface Users and Service Accounts Appearing in FUE Counts
Typical exposure: £50K–£500K depending on landscape complexityEnterprise SAP landscapes typically contain hundreds of technical users — batch processing accounts, RFC (Remote Function Call) communication users, workflow service accounts, and system integration IDs used by third-party applications to connect to SAP. None of these should contribute to the Named User FUE count, but they frequently appear in USMM output if they are not correctly typed as system users.
The risk compounds in large, complex landscapes where user administration has accumulated over years. Legacy user accounts created during system migrations, test environment users copied to production, and developer accounts that were never reclassified after go-live all inflate the FUE total. In a mature SAP landscape with 10,000+ users, technical and legacy account inflation of 5–10% is common.
Risk 5: RISE with SAP Licence Unit Opacity
Bundled RISE Pricing That Obscures Engine Metric Exposure
Typical exposure: 20–40% overpayment on RISE contract valueRISE with SAP bundles infrastructure, application, and support costs into a single subscription price. For many enterprises, this creates the illusion of simplicity — one invoice, one vendor, one price. The reality is that the RISE Licence Unit model embeds engine metrics within the subscription fee in a way that makes the cost structure opaque and future escalation hard to predict.
SAP's RISE proposals typically present a per-user monthly fee without decomposing how much of that fee is attributable to the Named User component, the engine metric component, or the infrastructure and support component. This prevents enterprise buyers from benchmarking the licence value against market rates or negotiating individual components. The growth provisions — particularly for headcount-linked engine metrics — are buried in the Order Form technical schedules.
Risk 6: Post-Merger FUE Exposure
Acquisition-Driven FUE and Engine Metric Escalation
Typical exposure: £500K–£10M+ depending on acquisition sizeWhen you acquire a company that uses SAP — or when you onboard an acquired company's employees into your existing SAP systems — your FUE and engine metric position can change dramatically and immediately. SAP's standard contract language typically includes the acquiring entity's entire group within the measurement scope, meaning acquired employees and SAP users flow directly into your FUE and engine metric counts from the date of acquisition.
This creates two distinct risks: if the acquired entity had its own SAP contracts, you may be paying double for users that should have been transferred; and if the acquired entity's employees are onboarded into your SAP systems without a parallel licence expansion, you face an immediate compliance gap that SAP will typically identify and pursue at the next measurement.
⚠ The Risk SAP Never Discloses
SAP's account teams conduct routine "licence health checks" and request voluntary system measurements outside of formal audits. These health checks produce data that feeds directly into SAP's commercial pipeline — any identified compliance gap becomes the basis for an upsell discussion or a formal audit letter. Never participate in an SAP licence health check without independent review of your FUE position first. Our SAP audit defence advisers prepare enterprises for these engagements routinely.
Risk 7: Indirect Access Through Connected Applications
Third-Party Application Connections Generating Unlicensed FUE
Typical exposure: £200K–£5M+ for complex landscapesFor SAP S/4HANA, Digital Access licensing applies when third-party systems generate document types (Orders, Deliveries, Invoices, Material Documents) in SAP through automated interfaces. These documents require a Digital Access licence — a form of engine-style metric that charges per document or per document type package rather than per user.
The risk is most acute in organisations with heavily integrated SAP landscapes where multiple ERP, CRM, WMS, and eCommerce systems connect to S/4HANA. Every automated transaction between a connected system and SAP potentially generates a Digital Access document. Without a Digital Access audit, enterprises routinely underestimate their document volume by 30–60%, creating significant undisclosed compliance exposure.
Risk 8: Stale Contract Definitions in Long-Running Agreements
Outdated FUE Definitions That No Longer Reflect Your SAP Landscape
Typical exposure: Bidirectional — can favour or disadvantage the customerEnterprise SAP contracts signed before 2015 often contain FUE definitions that pre-date SAP's current product portfolio and measurement methodology. These older definitions may be more favourable to the customer — for example, defining Limited Professional more broadly, excluding certain employee categories from engine metrics, or applying lower FUE conversion ratios for specific user types.
The risk runs both ways. If your SAP environment has evolved significantly since the contract was signed — deploying new modules, migrating to S/4HANA, connecting new third-party systems — your current usage may not be covered by the older licence types defined in the contract. SAP will attempt to apply current product definitions, which are typically more expensive, when the contract language is ambiguous about which generation of products applies.
If any of these risks apply to your organisation, the best time to address them is before an SAP measurement request or audit letter arrives. Our SAP licence optimisation service includes a structured FUE risk assessment that quantifies each category of exposure and prioritises mitigations by commercial impact. Book a free consultation to get started.
Book a Free Risk Assessment →Frequently Asked Questions
Which FUE risk causes the most financial damage in practice?
Based on our advisory experience, accepting SAP's initial measurement without challenge (Risk #1) causes the most immediate financial damage because it locks in an inflated FUE position that becomes very difficult to unwind post-submission. Growth-linked engine metric escalation (Risk #3) causes the most long-term damage because it is perpetual and compounds over multi-year contracts.
Can we renegotiate engine metric provisions in an existing contract?
Yes, but it is most effectively done at renewal. SAP will not proactively offer to cap or reduce engine metric provisions — you must raise it as a commercial negotiation point. The strongest position involves demonstrating that the current growth projections create costs significantly above market benchmarks. Independent benchmarking data and alternative vendor leverage are the most effective negotiation tools.
How does RISE with SAP change the FUE risk profile?
RISE consolidates risks into a single bundled subscription, which increases transparency in some areas but reduces it in others. The main change is that engine metric escalation is embedded in the subscription price and is managed through quarterly adjustments rather than annual audits. This means cost surprises occur more frequently but at smaller increments — making it harder to push back on individual true-up invoices than on a large annual audit claim.
What is the first step to address FUE risks if we have no existing analysis?
Start with your contract. Pull your SAP Master Agreement and Order Forms and identify every FUE definition and engine metric provision. Then run USMM and compare the output against your HR and identity management data. The gap between those two data sets is your exposure. If internal resources are limited, our team can complete an initial FUE risk assessment in 2–3 weeks that provides enough information to prioritise the most impactful mitigations.