Ten questions for the board: security and compliance belong in the transformation decision

What happened

In the SAP News Center on 15 October 2026, SAP's chief security officer, who is also a member of the Supervisory Board of SAP SE, presents ten questions with which boards can oversee security and compliance, each accompanied by evidence they can request from management.

Who is affected

First of all the supervisory and management boards to whom the questions are addressed. The article stresses that a board is not expected to make technical decisions but to exercise informed oversight. For an SAP programme this becomes concrete in two places: according to the article, major investments, cloud programmes and supplier selections should be assessed from the outset for security and compliance as well, while decisions can still be changed. And it describes systems that are no longer fully supported as an enterprise risk and an investment issue, not merely an IT lifecycle matter. This also concerns the CFO organisation and programme leadership if you still run ECC or are in the middle of moving to S/4HANA.

What to do

Where modernisation is delayed, the article calls for documented compensating controls, clear ownership and a time-bound plan. We would include these three points for every legacy system whose maintenance is running out in the papers for the steering committee – not as an IT appendix, but alongside budget and schedule. The questions on third parties are also worth a look: besides critical suppliers, the article explicitly names cloud providers, software dependencies and advisers as possible sources of risk and asks for independent evidence and for how exit risks are managed. It also asks how quickly access is changed when supplier relationships change. For a programme with several service providers, in our view this means deciding at selection which evidence you expect, who gets access to which systems and when, and when that access ends. And on AI, the article asks which decisions remain subject to human review – a question that belongs in every concept for AI capabilities in a process.

Our assessment

The article comes from SAP and closes with the thought that modernisation can be an important governance lever; the questions themselves can be assessed separately from that. We find them useful precisely because they are not technical. In our view their value for an SAP programme is that they move security and compliance from acceptance at the end to the start of the decision. From large SAP programmes we know the pressure in testing and cut-over when fundamental questions still surface there; authorisations, interfaces and audit evidence are therefore, in our view, among the topics worth settling early rather than leaving them to the final phase. A programme leadership that can present a plan with a deadline and clear ownership for its legacy systems answers the board's question before it becomes an agenda item.