Audit rights inside the RISE contract.

The audit rights inside a RISE with SAP contract are usually treated as boilerplate by both sides during negotiation. SAP includes a standard provision, the buyer legal team reads it once, and the clause is signed without serious challenge. The omission is expensive. Audit rights determine what the buyer can see when something goes wrong, what evidence the regulator can request from SAP, and what visibility the buyer team retains over the operations of the system that runs the business. A weak audit clause leaves the buyer without the visibility the business case assumes. This article walks through the audit rights inside the standard RISE contract, the gaps the standard language creates, and the specific provisions that need to be negotiated, particularly for regulated industries.

The standard audit clause is limited

The standard RISE audit clause typically allows SAP to audit the buyer for license compliance and allows the buyer a limited right to review SAP attestation reports, usually SOC 1 and SOC 2. The buyer gets the attestation, the buyer gets the summary, and the buyer does not get direct visibility into the SAP operations. The asymmetry is striking. SAP can audit the buyer at SAP's discretion. The buyer can only review what SAP chooses to disclose.

The asymmetry is acceptable for buyers in non regulated industries with no specific compliance obligations on the SAP layer. It is unacceptable for buyers in regulated industries, for buyers with regulator obligations that reach into the SAP layer, and for buyers whose own contracts with customers or regulators require deeper visibility into the systems that process customer data.

Regulator access rights are often missing

A regulated buyer, whether in financial services, pharmaceuticals, defence, or critical infrastructure, often has obligations to provide regulators with access to systems that process regulated activity. The regulator may require access to the SAP system, the supporting infrastructure, or the operational logs. The standard RISE contract typically does not provide the regulator with direct access. The buyer is responsible for the regulator obligation, but the buyer does not have the contractual right to compel SAP to grant the access the regulator requires.

The buyer should negotiate a regulator access provision into the RISE contract. The provision should allow regulators with jurisdiction over the buyer to access the SAP operations as reasonably required for the regulatory function, with reasonable notice, at no additional charge, and with the same protections that apply to the buyer audit rights. The provision protects the buyer when the regulator arrives, and a missing provision becomes an emergency negotiation under pressure.

Operational visibility through the term

The buyer needs operational visibility that extends beyond the annual attestation. The team needs to see service performance, incident logs, change records, and configuration state on an ongoing basis. The standard RISE contract often does not specify this level of visibility, leaving it to be defined through the service definition document or a separate operational agreement. The lack of specificity creates ambiguity when the buyer needs visibility that SAP does not want to share.

The buyer should negotiate ongoing operational visibility into the RISE contract. Real time service performance dashboards. Quarterly operational reviews. Annual security posture briefings. Incident reports for any material outage. The provisions create the cadence the buyer needs for its own governance and reduce the friction when the buyer needs information for a specific reason.

Sub processor visibility and rights

SAP runs the RISE service across hyperscaler infrastructure. AWS, Azure, Google Cloud, and SAP's own data centres are sub processors of the SAP service. The buyer typically has audit rights against SAP. The buyer rarely has direct audit rights against the sub processor. The asymmetry creates a gap when a regulator asks about the hyperscaler layer and the buyer cannot pass the question through.

The buyer should negotiate sub processor pass through rights into the RISE contract. SAP should commit to flow down the buyer audit and regulator access rights to its sub processors, and SAP should be responsible for producing sub processor evidence on the buyer's behalf. The buyer does not need to manage the sub processor relationship, but the buyer needs the right to compel the visibility through SAP. The provision is standard for cloud services in other industries and should be standard in RISE.

Audit cost allocation

The standard RISE contract typically provides that the buyer audit, if exercised, is at the buyer's cost. The provision is reasonable for the buyer audit. The provision becomes unreasonable when the audit reveals a material non compliance by SAP. The buyer pays for the audit that proves SAP failure. The cost should shift to SAP in that scenario.

The buyer should negotiate a cost allocation provision that pushes the audit cost to SAP if the audit reveals material non compliance, with a specific threshold. The provision creates the right incentive on SAP to maintain compliance and provides the buyer with the protection that the cost will not deter the legitimate audit. The provision should also cover regulator audits that are required by the buyer obligations, so that SAP does not extract a fee for activity that is not buyer initiated.

Data extraction rights during audit

An audit often requires data extraction from the SAP system. The buyer team or the auditor needs to pull specific data, log extracts, or configuration state. The standard RISE contract sometimes does not specify the data extraction rights, leaving them to be defined ad hoc. The ad hoc approach becomes a negotiation each time, sometimes with cost implications, sometimes with delay implications, and sometimes with refusal implications.

The buyer should negotiate data extraction rights into the RISE contract. The buyer or the buyer's auditor should have the right to extract specified data types, in specified formats, within specified timeframes, at no additional cost. The provision removes the friction that otherwise impedes audit work and gives the auditor confidence that the work can be completed without dependency on SAP discretion.

Conclusion

The audit rights inside the RISE contract are too often treated as boilerplate and signed without challenge. The result is a contract that gives SAP audit visibility into the buyer while limiting the buyer audit visibility into SAP. For buyers in regulated industries, for buyers with regulator obligations that reach into the SAP layer, and for buyers whose customers or counterparties demand deeper assurance, the standard audit clause is insufficient. The negotiation should add regulator access rights, ongoing operational visibility, sub processor pass through, cost allocation discipline, and data extraction rights. Each provision is standard in mature cloud contracts. None is unreasonable to request. All become difficult to add after signature, when the buyer is the one with the regulator question and SAP is the one with the leverage. The audit clause deserves the same line by line attention as the pricing clause. Without it, the buyer signs a contract that constrains its own visibility into the system that runs the business.