Soterion
by Soterion · Access Controls & SoD
SAP-native GRC suite for access risk, SoD, licensing and emergency access management.
Updated August 2026 · By the ERP Research Editorial Team · Independent and vendor-neutral.
- Works with
SAP- Deployment
- Cloud, On-premise
- Company size
- Mid-market, Enterprise
- Pricing
- Quote-based
- Founded
- 2010
- Headquarters
- Johannesburg, South Africa
Overview
Soterion is a South Africa-based GRC vendor offering a suite of nine SAP-native modules covering access risk analysis, segregation-of-duties (SoD) management, user provisioning, license optimization and audit preparation. It is built specifically for organizations running SAP ECC, S/4HANA On-Premise, or S/4HANA Cloud Private Edition (RISE with SAP), rather than positioning as a general cross-application GRC platform.
Its flagship Access Risk Manager module ships with an out-of-the-box SoD, critical-transaction and data-privacy ruleset, and incorporates users' historical transaction usage data to separate potential risk from actual risk. A "what-if" allocation simulator lets teams test the SoD impact of a proposed role change before applying it in SAP. Other modules cover Basis configuration review against best practice, central identity/role provisioning, continuous real-time monitoring of materialized SoD violations, data privacy discovery, elevated/emergency access, self-service SAP password reset, periodic access review, and SAP license (Full Use Equivalent) optimization.
Founded in 2010 and headquartered in Johannesburg, South Africa, Soterion says it serves more than 150 clients globally and is used in audit engagements by all Big Four accounting firms. It is sold both directly and through partners such as EPI-USE Labs.
Screenshots & demo
Demo video from the vendor's YouTube channel.
Features & capabilities
Access Risk Manager
Core SoD and access-risk analysis for SAP.
- Out-of-the-box SoD, critical-transaction and data-privacy ruleset
- Historical transaction usage analysis to separate potential vs. actual risk
- "What-if" allocation simulator for proposed role changes
- Organization-level analysis (company code, plant, etc.)
- SAP SuccessFactors Employee Central and payroll risk visibility
Continuous Controls & Periodic Review
Ongoing monitoring and scheduled certification.
- Continuous Controls Manager for real-time monitoring of materialized SoD violations
- Periodic Review Manager for scheduled user access reviews
- Mitigating-controls documentation and control-execution prompting
Identity, Provisioning & Emergency Access
Role standardization and elevated-access workflows.
- Central Identity Manager for standardized business roles and provisioning
- Elevated Rights Manager for temporary elevated access via automated workflow
- Password Self-Service for SAP password resets
Licensing & System Hygiene
Cost control and SAP Basis configuration checks.
- SAP License Manager showing FUE cost of every role assignment
- Basis Review Manager benchmarking SAP Basis configuration against best practice
- Data Privacy Manager to locate tables holding personal/sensitive data
Common use cases
- Running SAP SoD and critical-transaction risk analysis with a ready-made, customizable ruleset
- Simulating a proposed SAP role change to see its SoD risk impact before applying it in production
- Cleaning up access risk in a legacy ECC environment ahead of an S/4HANA or RISE with SAP migration
- Reducing SAP FUE license spend by identifying over-assigned roles
- Running scheduled, business-owner-led periodic access reviews for audit evidence
- Managing temporary elevated/emergency access with automated workflows
- Assessing SoD and data-privacy risk in SAP SuccessFactors Employee Central and payroll
Strengths & considerations
Strengths
- Purpose-built for SAP only, with nine integrated modules covering access risk, licensing, Basis review and provisioning rather than a single point tool
- Differentiates potential access risk from actual risk by incorporating real SAP transactional usage history
- Over a decade of SAP-only focus and used by all Big Four audit firms in engagements, per the vendor
ERP integrations
Analyzes SAP ECC, S/4HANA On-Premise and S/4HANA Cloud Private Edition (RISE with SAP); also covers SuccessFactors Employee Central and payroll
Pricing
Pricing not publicly disclosed; sold direct and through partners such as EPI-USE Labs. Get an independent shortlist with pricing guidance below.
About the vendor
- Founded
- 2010
- Headquarters
- Johannesburg, South Africa
- Notable customers
- Lundin Mining, Komatsu, Nedbank, Weir Minerals
Alternatives to Soterion in Access Controls & SoD
Soterion — frequently asked questions
What SAP versions does Soterion support?
Soterion covers SAP ECC, S/4HANA On-Premise, and S/4HANA Cloud Private Edition (RISE with SAP).
Does Soterion only work with SAP?
Yes. Soterion is built specifically for organizations running SAP, including SAP SuccessFactors Employee Central and payroll, rather than as a general cross-application GRC platform.
Can Soterion simulate the risk impact of a role change before it's applied?
Yes. Its Access Risk Manager includes a "what-if" allocation simulator that shows the SoD risk impact of a proposed role change before it is applied in SAP.
Does Soterion help with SAP license costs?
Yes. Its SAP License Manager module shows the Full Use Equivalent (FUE) cost of every role assignment so teams can see what over-assigned access is costing.
How many organizations use Soterion?
Soterion says it is used by more than 150 clients worldwide and is endorsed by the Big Four global audit firms.
Evaluating Access Controls & SoD?
Tell us your ERP and requirements and we'll send an independent shortlist — including Soterion and the best-fit alternatives — with honest pros and cons.