Success Story · Multi-Entity Manufacturing Group

Redesigning Who Can Touch What, Across Six Companies, Without Breaking Anything

A six-entity manufacturing group rebuilt its entire SAP access model from the ground up, consolidating years of role sprawl into a governed, audit-ready structure, and cut every business unit over within a single quarter.

The Challenge

SAP access, left unmanaged, sprawls. New joiners get roles copied from whoever sat in the seat before them. Special requests get bolted on and never removed. Multiply that pattern across six legal entities, each with its own history, and the result is an access model nobody can fully explain, exactly the kind of finding an external auditor or a fraud investigation lives to uncover. The group had already run one remediation, correcting segregation-of-duties conflicts for over 500 business users, but a point-in-time fix does not solve a structural problem: without a rebuilt foundation, the same sprawl reasserts itself.

How Newen Helped

Newen led a ground-up redesign of the group's SAP authorisation model, not a patch, a rebuild. The team mapped every business process end to end, order-to-cash, procure-to-pay, record-to-report, hire-to-retire, and built a consolidated master role catalogue cross-referenced against SAP's full Fiori application library, so every role's access was deliberate rather than inherited. On top of that master catalogue, the team engineered organisation-restricted derived roles, so the same master role could be safely scoped to a specific company code, plant or sales organisation without duplicating logic six times over.

Deployment was executed as a disciplined, phased cutover, one or two business units per weekend, using formal SAP change management tooling, with user access temporarily suspended, roles reassigned, and access restored in a controlled window rather than a live, in-place change. Business readiness was tracked and signed off unit by unit before each cutover, not assumed.

The Results

All six legal entities were cut over to the new access model within roughly one month, each in its own controlled weekend window, with business readiness scores in the high nineties confirmed before every go-live. The group now runs on a single, explainable access model instead of six divergent histories, a foundation that is easier to audit, easier to extend as the business grows, and considerably harder to exploit.