Third party assurance in RISE.

When a buyer migrates an SAP estate into RISE with SAP, the operational substance of running that estate moves to a counterparty that the buyer no longer directly observes. The buyer's own internal controls cover only the configuration, the security perimeter into the SAP environment, and the integration boundary. Everything else, from infrastructure security to operational integrity to availability engineering, sits inside the supplier's operation. Third party assurance is how the buyer regains visibility into that operation in a form that the buyer's auditor, regulator, and board can rely on. The work is not optional for any serious enterprise, and the standard SAP assurance package, while useful, leaves gaps that the buyer should close through specific contract language and active governance. This article works through the assurance reports the buyer should expect, the gaps the standard reports leave, the buyer side audit and inspection rights, and the governance posture that turns the assurance into useful evidence rather than a stack of unread PDFs.

01.The assurance reports the buyer should expect

SAP, as the RISE supplier, makes several third party assurance reports available to RISE buyers. The reports are produced annually in most cases, by independent auditors operating under recognised assurance frameworks. The buyer's contract should secure timely access to each of the relevant reports, and the buyer's vendor risk team should understand what each one covers and what it does not cover.

The SOC 1 Type 2 report addresses the controls relevant to financial reporting, which matters because the buyer's auditor will rely on it during the buyer's own financial audit. The SOC 2 Type 2 report addresses the controls relevant to security, availability, processing integrity, confidentiality, and privacy, which matters for general operational assurance. Both reports cover a specified scope of services and a specified period, and the buyer should verify that the scope encompasses the configuration the buyer is actually consuming.

The ISO 27001 certification and the related Statement of Applicability indicate the supplier's information security management system meets the international standard. The certification is useful as a foundation but does not, on its own, demonstrate the operational effectiveness of specific controls. The Statement of Applicability identifies which of the standard's controls the supplier has implemented and which have been excluded, and the buyer should review the exclusions specifically.

The PCI DSS attestation, where the buyer's RISE workload processes payment card data, is critical and the buyer should obtain the relevant attestation of compliance and the responsibility matrix that identifies which controls the supplier maintains and which remain the buyer's responsibility.

Various sector and jurisdiction specific certifications, including HIPAA, FedRAMP at the relevant level, GxP related certifications for life sciences, and various national certifications, may apply depending on the buyer's regulatory profile. The contract should secure access to these reports where they are relevant to the buyer's compliance posture.

02.The gaps the standard reports leave

The standard assurance reports cover a great deal but leave gaps that a serious buyer needs to address through additional means. Understanding the gaps is the prerequisite for closing them, and the gaps are predictable.

The scope boundary is the first gap. SOC 1 and SOC 2 reports cover the supplier's controls but typically stop at a defined boundary inside the supplier's operation. The buyer's specific configuration, the buyer's integration boundary, and certain customer specific operational activities may fall outside the audited scope. The buyer should map the audited scope against the buyer's risk profile and identify any uncovered surface.

The hyperscaler subcontractor gap is the second. SAP's reports address SAP's controls, but the underlying hyperscaler operates under its own assurance reports. The buyer should obtain the hyperscaler reports, either through SAP or directly, and should reconcile any control assertions that depend on the boundary between the two parties.

The configuration testing gap is the third. The audit typically tests that controls operate but does not always test that the configuration produced by the supplier for the specific buyer reflects the supplier's documented standard. The buyer's environment should be tested against the supplier's representations as part of the buyer's own governance.

The point in time gap is the fourth. The reports cover a period in the past and do not necessarily reflect the current state. Between annual reports, supplier organisations change, control implementations evolve, and the assurance picture may drift. The buyer should track material changes that occur between reports and should not treat the most recent report as a permanent statement of current state.

The interpretation gap is the fifth. The reports are technical documents and require interpretation. A buyer organisation that does not have the specialist capability to read and interpret the reports does not gain real assurance from receiving them. The buyer should ensure the interpretation capability sits somewhere in the organisation, whether internally or with a retained specialist.

03.The buyer side audit and inspection rights

The buyer's contract should secure audit and inspection rights that supplement the third party assurance reports. The rights are negotiable and a buyer who treats them as boilerplate frequently ends with rights that are theoretically present but practically unusable.

The right should permit the buyer to conduct, directly or through an independent third party, an audit of the controls relevant to the buyer's operation. The audit should cover the supplier's controls, the supplier's processes for managing the buyer's configuration, and the supplier's incident response capability for events affecting the buyer.

The frequency should be reasonable but not restrictive. An annual baseline plus the right to additional audits in defined circumstances, such as a material security event or a regulatory development affecting the buyer, is a common and reasonable shape. A frequency that is restrictive enough to prevent meaningful exercise of the right is a sign the contract needs renegotiation.

The scope should be defined clearly. Open ended audit rights are sometimes negotiated but are difficult to exercise because the supplier will object to specific requests on scope grounds. A defined scope that covers the controls, processes, and capabilities relevant to the buyer's regulatory and operational posture is more workable.

The cost provisions should not discourage reasonable exercise. The supplier will typically agree to bear its own costs of supporting the audit, with the buyer bearing the costs of the audit team. Provisions that require the buyer to reimburse the supplier's costs in excess of reasonable amounts effectively neutralise the right and should be resisted.

The remedy for adverse findings should be specified. An audit that finds material deficiencies should trigger a remediation obligation, with timelines and consequence provisions, rather than producing a finding that the supplier acknowledges and does not act on.

04.The regulatory inspection rights

Regulated buyers carry an additional layer of assurance requirement because their regulators may need to inspect the operation directly. The contract should accommodate the regulatory inspection without forcing the buyer to negotiate the access in the middle of a regulatory event.

In financial services, banking regulators in most jurisdictions assert the right to inspect critical service providers and their subcontractors. The European Banking Authority guidelines, the relevant national supervision frameworks, and the equivalent frameworks in other jurisdictions all impose specific access requirements. The contract should commit SAP and the underlying hyperscaler to support the regulatory inspection without commercial barrier.

In healthcare and life sciences, the relevant regulators including the FDA, EMA, and national equivalents may require access during inspection of the buyer's quality system. The contract should commit SAP to support the inspection, to provide the documentation the regulator requires, and to make the supplier's personnel available where appropriate.

In public sector deployments, the relevant sovereign requirements may include direct inspection by the national audit office, the data protection authority, or a sector specific oversight body. The contract should accommodate these inspections within the relevant national requirements.

The buyer side preparation for regulatory inspection should include the documentation, the assurance reports, the audit findings, and the operational records that the regulator typically reviews. The supplier's cooperation, prepared in advance through the contract, is critical to a clean regulatory inspection.

05.The governance posture that makes assurance useful

Third party assurance only produces real value when the buyer has a governance posture that consumes and acts on it. A buyer that requires the reports but does not read them, or reads them without acting on the findings, has paid for assurance without producing the assurance benefit.

The vendor risk function should maintain a current view of each assurance report, the period it covers, the scope, the findings, and any management actions that the supplier has committed to. The view should be reviewed annually at minimum and should feed the enterprise risk register.

The internal audit function should treat the RISE relationship as a significant third party arrangement, with the relevant audits scheduled into the audit plan. Internal audit should test the buyer side controls that depend on the supplier's controls, including the configuration management, the integration boundary, and the operational handover from supplier to buyer.

The information security function should integrate the supplier's assurance posture into the buyer's overall security framework. The integration includes mapping the supplier's controls against the buyer's control framework, identifying any gaps, and documenting how the gaps are managed.

The board level reporting should include the vendor assurance picture for material third parties, including SAP under RISE. The reporting should make the residual risk visible and should not bury the assurance in the operational reporting layer.

06.The escalation pathway when assurance is inadequate

Occasionally a buyer will find that an assurance report contains findings that materially affect the buyer's risk posture, or that the supplier's response to an audit is inadequate. The contract should define an escalation pathway and the buyer should be willing to use it.

The first step is typically a formal communication to the supplier identifying the concern and requesting a remediation plan with timelines. The communication should be specific and should reference the relevant contract provisions, including the audit rights and the assurance obligations.

The second step is to engage the supplier's account leadership and, where appropriate, the supplier's compliance organisation. The engagement should produce a documented remediation plan and an agreed measurement framework.

The third step is to escalate to the buyer's own senior leadership and, in regulated industries, to the relevant regulator. The escalation is appropriate where the supplier's response is inadequate and where the gap is material to the buyer's regulatory or operational posture.

The fourth step is to consider the contract remedies including service credit claims, breach assertions where appropriate, and, in extreme cases, termination for cause. The buyer should not threaten remedies it is not prepared to exercise, but it should also not allow the supplier to assume that the remedies will never be exercised.

07.Conclusion

Third party assurance is the mechanism through which a RISE buyer regains visibility into an operation that the buyer no longer directly controls. The standard SAP assurance reports cover a great deal but leave gaps around scope boundary, subcontractor coverage, configuration testing, point in time currency, and interpretation capability. The buyer's contract should secure audit and inspection rights that supplement the standard reports, and the buyer's governance posture should turn the assurance into useful evidence rather than unread documentation. The work is substantial but not optional for any enterprise that takes its regulatory, audit, and operational obligations seriously. Buyers who treat third party assurance as a first class governance topic typically respond better to supplier incidents, satisfy regulators with less friction, and provide the board with the confidence the relationship requires.

Assurance you do not read is not assurance. The reports are a starting point. The governance posture that consumes them is what produces the protection.