In SAP, authorisations are only checked in a given program if a corresponding authorisation check has been implemented by the developer. Without a check like this in the program code, no test is carried out to see if the user is actually authorised to carry out an action. Nevertheless, authorisation checks are frequently forgotten in custom-developed program code. This often renders the entire authorisation concept at hand ineffective and allows unauthorised persons to access the data stored in the respective SAP system. This can also lead to violations of compliance requirements, which can have serious consequences, especially with regard to audits.