SAP access control policies are functionally and technically complex. As a result of these high demands, many organisations fail to adequately plan and implement such policies. However, the lack of a well thought-out access control policy can often result in users receiving more authorisations than necessary. These users could then deliberately manipulate or accidentally damage an SAP ERP system and put its integrity, confidentiality, and availability at risk.

In addition, the design of authorisations in S/4HANA systems must be precisely mapped and synchronised among the integrated ABAP, HANA, and NetWeaver Gateway components (for Fiori applications); otherwise, contradictory authorisations could be assigned.

If an SAP access control policy is not sufficiently documented, assigned authorisations cannot be traced and maintained. Among other possible consequences, employees who have left a given organisation or have been assigned new tasks may retain the ability to access the organisation's SAP ERP systems.