The person a Big 4 team calls when the access risk actually lives inside SAP.
An eight-week, live training course for the SAP GRC Security & Fiori Consultant role, not a self-paced video library. Every SAP landscape is one over-broad role away from a segregation-of-duties conflict, and one unreviewed emergency-access session away from an incident nobody can explain. This course trains you to be the specialist who can trace that risk end to end and build the fix, not just flag the finding.
Do the job, not just describe it
- Scope a GRC/Security engagement without waiting to be told what to test
- Independently trace, build and fix access risk on a live SAP system
- Tell a ruleset that's actually working from one that's gone quietly blind
- Turn in a fix a reviewer signs off without a follow-up question
- Sit in a room with the Basis team and the business and speak both languages
- Work on your own live S/4HANA login, in a dedicated practice namespace
A ruleset that went quiet, and nobody noticed for a year.
Nobody at Calder Ridge Manufacturing disabled anything. A Fiori rollout, a hiring wave, an afternoon nobody had time to look at closely. Then a junior consultant reran an old analysis with current data and found what the ruleset had stopped watching for. That's the job.
Calder Ridge is fictional; the gaps aren't. Each of the 8 Books is built from a real pattern of access or security failure, threaded through one company so you learn it deeply. Every Book is taught at full depth and built live in your own practice namespace.
Who can do what, and who's watching
Access risk, emergency access, role design & workflow
- The Ruleset That Went Quiet
- The Shared Login
- The Split That Closed a Door
- The Approval Nobody Sent
What got copied, missed, or left open
Provisioning, SU24, remediation & Fiori security
- Copied From Someone Else
- The Proposal Nobody Updated
- Resolved on the Report
- The Tile That Opened Everything
What this course will and won't do for you
Said up front, because anybody promising otherwise is selling something.
This course will notNo shortcuts
- Make you an SAP expert overnight
- Teach you ninety transaction codes by rote
- Replace hands-on time on a real engagement
- Hand you a certificate for showing up
This course willBuild the judgement
- Get you diagnosing what's broken, why it matters and what the fix needs to look like, before you name a screen
- Show you exactly what a reviewer will push back on, and why
- Give you a method that survives every SAP system you'll work in
- Put you on your own live S/4HANA login, fixing a real access issue, with a facilitator watching you work through it
Read it. Argue it. Run it in SAP.
Three layers, in order, every time.
SAP from zero
A live three-hour opening session. You leave with three prerequisite guides and an eight-day reading plan.
Orientation & Q&A
A structured Q&A on the reading, then the main course and the case begin.
Theory sessions
Group 1 and Group 2 worked on paper first. Every session ends on a decision you must bring an answer to.
SAP demo lab
First hour, the facilitator builds the fix end to end. Second hour, you build the same fix in your own ZZ_TRAIN_ namespace.
Post-class reading
Eight chapters: the S/4HANA landscape, GRC Access Control architecture and the eight domains, at your own pace.
Final Q&A & close
The whole cohort back together: what you can now do and what comes next.
Ninety percent of your grade is the part you can't look up
SAP execution accuracy is ten percent. Everything above it, the part that gets you promoted, is judgement. If you only ever get faster at clicking through transactions, you plateau around year three.
- Business risk & access understanding20%
- Diagnostic strategy & scope definition15%
- Solution evaluation15%
- Consultant judgement & escalation15%
- Lab write-up quality15%
- Stakeholder communication10%
- SAP execution accuracy10%
Choose the schedule that fits your week
Same case, same 8 Books, same live instructor, same certificate, same price. Nothing metered, nothing upsold.
Live, three evenings a week: an opening Saturday, Monday / Wednesday / Friday sessions, a closing Saturday. 8 live sessions.
Live, Saturday and Sunday: an opening Saturday, Saturday + Sunday sessions, a closing Saturday. 6 live sessions, identical content.
Reserve your seat
Seats are confirmed in the order paid. A course administrator emails you the next open cohort's dates and a payment link.
Built from the other side of the review
TIB Systems is an SAP Security, GRC and Controls training and advisory firm. This course is built around what a reviewer actually pushes back on, not what a syllabus says they should.
Honest answers
Do I need to know how to code?
No. You need to know that the rules governing what SAP does are written in code and configuration, and that both can be inspected. That's the skill this course builds.
How much do I need to memorise?
Almost none of it. Familiarity is the target, not recall. You read beforehand so that a live session is the second time you see something, not the first.
Is there an exam?
No. The pre-class guides have readiness checklists for you alone. Your assessed work is eight hands-on labs, built and marked the way a real engagement deliverable is reviewed.
I've already used SAP. Will this be too basic?
Some of it will be fast for you. But almost nobody who has used SAP has been taught why the security architecture is shaped the way it is, and that is what the course is built around.
What if I miss a session?
Tell your facilitator in advance if you can. Sessions build on each other, so recovery means reading the materials properly and bringing your questions to the next session.
Is the SAP access real or a simulation?
Real. Every trainee gets their own login on a live S/4HANA server with a dedicated practice namespace, for the full course plus 2 extra months after class.
What if the facilitator is unavailable?
Two additional trained facilitators back the lead, so one person's schedule never holds up your cohort.
How is this different from Controls 360?
They are separate career paths. GRC Security & Fiori is about designing, building and fixing access. Controls 360 is about testing and assuring SAP controls for SOX/ITGC. Most people choose one.
You'll be the one who reruns the analysis and asks the question.
$950, one time. Weekday or weekend, both fully live.