Best Practices for SOX Compliance in SAP Change Management

Change management involves ensuring that standardized methods and procedures are used for efficient and timely handling of changes to an IT infrastructure. These changes can be required based on legislative changes, or from the need to reflect new business initiatives or service improvement initiatives. With an effective change management process, companies can ensure that standardized methods, processes, and procedures are used for all changes. This in turn ensures that changes are handled in a timely manner and the proper balance between required change and the possible negative impact of changes is maintained.

The heightened focus on regulatory compliance (SOX, IFRS, etc.) has produced an unanticipated side-effect that, paradoxically, poses a genuine threat to many organizations' best-laid compliance plans: the SAP project and IT management teams tasked with implementing the changes in processes and practices produced by a compliance audit are oftentimes operating without a set of compliance guidelines for their own work in making those changes. In many instances, the vast majority of compliance-related efforts and resources have been allocated to the audit process and the business processes, leaving the project and IT teams charged with making compliance-related changes to the systems (so-called "change management") with the unwelcome problem of managing a very unique process without the specialized set of practices required specifically for SAP change management.

The primary purpose of the book is to provide SAP project and IT change management teams with a concrete set of best practices which can be used to develop processes that are efficient, effective and, most important, compliant with SOX 404. The author's stated objective is to help project teams from becoming "part of the [compliance] problem" when performing change management responsibilities in the SAP system landscape by providing the necessary guidance and tools for ensuring SOX 404 compliance, which governs information technology and systems.