An acquirer quantifies SAP risk before signing

This case study is an anonymised composite drawn from representative engagements. It names no real parties and uses approximate figures to illustrate typical outcomes.

This acquirer quantifies sap risk before signing case study shows how indirect access, one of the most contested areas in SAP licensing, was measured and priced before the leverage shifted to the publisher. SAP is consistently among the highest audit risks a buyer inherits, and indirect access exposure is rarely visible on the data room index.

Inside the acquirer quantifies SAP risk before signing case study

Situation

This case study follows a corporate acquirer buying a 2,000 employee manufacturing and distribution business in North America. The target ran SAP as its core system, with a long history of integrations to third party systems for ordering, logistics and analytics. The SAP estate had grown over more than a decade, and the named user counts and engine metrics had drifted from the original contract assumptions. The acquirer wanted the SAP position quantified before signing.

SAP exposure is driven by usage patterns that contracts do not describe in plain terms, and indirect access in particular has produced eight figure claims against acquirers and inheritors.

Exposure found

The review built an effective license position for SAP, focusing on the two areas that drive the most exposure: named user classification and indirect access. Many users had drifted into classifications that no longer matched their actual roles. More significantly, multiple third party systems were reading and writing SAP data, and that indirect access had accumulated unmeasured for years.

Sized on a likely settlement basis, the indirect access and user classification gap represented a material, eight figure range of exposure. The scale was consistent with public reminders of how large SAP claims can become: SAP pursued Anheuser Busch InBev for a reported 600 million dollars and Diageo for a reported 60 million dollars over disputed and inherited licensing (source: Diageo Great Britain Ltd v SAP UK Ltd [2017] EWHC 189 (TCC), UK High Court, and contemporaneous reporting of SAP indirect access disputes, 2017; as of June 2026).

Approach

We isolated the indirect access exposure specifically, because it is the single largest source of surprise in SAP audits and the part most likely to be inherited in full. We documented the assumptions and modelled the cost to cure, including the remediation of user classifications and a renegotiated digital access position, which reduced the number well below the headline.

We presented the quantified SAP position to the investment committee with clear options: reflect the cost to cure in the price, require remediation as a condition, or secure a specific indemnity. We worked alongside the acquirer's counsel on the contractual route.

Outcome

The acquirer reflected the cost to cure in the price and secured a specific indemnity for the residual indirect access exposure. The latent, eight figure risk was converted into a priced and allocated part of the deal rather than a liability that would surface as a post close SAP audit.

After close, we supported the remediation of user classifications and the negotiation of a digital access position that fit the combined business. The result was a defensible SAP estate and an acquirer that had paid for the business it bought, not for an inherited compliance gap.

Lessons for buyers

SAP indirect access is the classic inherited liability: it accumulates silently for years, it is invisible to standard diligence, and a buyer who does not test for it inherits the full history. Quantifying it before signing is the only way to keep the leverage on the buyer side.

The lesson is that SAP risk is measurable before a deal, and a quantified position lets a buyer price it, remediate it or indemnify it. The alternative is to discover it after close, when the only option left is to pay.

This outcome is the work of our software due diligence service, applied to the risks in the M&A software audit risk guide. For the questions buyers ask most, see the FAQ below.