GRC, access controls & segregation of duties: 8 SAP partners to consider
Eight SAP partners for GRC, access controls & segregation of duties: Turnkey Consulting, Soterion, Xiting, oXya, KPMG, Deloitte, PwC, NTT DATA Business…
Access-risk design, SoD, provisioning, control evidence and ongoing governance.
| Agency | HQ | Evidence |
|---|---|---|
| Turnkey Consulting | London, UK | Published relevant service offering |
| Soterion | Johannesburg, South Africa | Published relevant service offering |
| Xiting | Schöfflisdorf, Switzerland (Gartner, G2); one directory lists Florida | Security technology; implementation services to confirm |
| oXya | Paris area, France (Issy-les-Moulineaux); Americas office in Jersey City | Broader SAP practice; exact category evidence pending |
| KPMG | Global network of member firms | Broader SAP practice; exact category evidence pending |
| Deloitte | London, UK (DTTL); services delivered by member firms | Broader SAP practice; exact category evidence pending |
| PwC | Global network of member firms | Broader SAP practice; exact category evidence pending |
| NTT DATA Business Solutions | Bielefeld, Germany | Broader SAP practice; exact category evidence pending |
Shortlisted
Turnkey Consulting
Published SAP security/GRC implementation and support.
HQLondon, UK
Founded2004
TeamAbout 64 (company-data site); other sources differ
Named clientsNot stated on the pages we checked
Partners & badgesOffices in France, Germany, Malaysia, Singapore, Australia, New Zealand and the US
Services
What stands out
- Published SAP security/GRC implementation and support.
Research before choosing
- Confirm edition/release, implementation ownership, comparable reference, proposed team and delivery geography. Published collateral supports relevance; validate delivery quality and recency.
- Confirm current entity, regional team, edition-specific expertise and a comparable reference.
- Request a comparable client reference and confirm the delivery team
Source: Published relevant service offeringFacts from the company’s own website and public sources, checked 23 October 2026. Not a ranking.
Shortlisted
Soterion
Homepage screenshot pending
Published SAP security, roles and access-risk consulting.
HQJohannesburg, South Africa
Founded2010
Team11 to 50 (Gartner band)
Named clients140 to 150+ clients (company-reported)
Partners & badgesNewest United VARs solution partner (March 2025); sells the Access Risk Manager module for SAP
Services
What stands out
- Published SAP security, roles and access-risk consulting.
Research before choosing
- Confirm edition/release, implementation ownership, comparable reference, proposed team and delivery geography. Published collateral supports relevance; validate delivery quality and recency.
- Confirm current entity, regional team, edition-specific expertise and a comparable reference.
- Request a comparable client reference and confirm the delivery team
Source: Published relevant service offeringFacts from the company’s own website and public sources, checked 23 October 2026. Not a ranking.
Shortlisted
Xiting
Published SAP access-security platform.
HQSchöfflisdorf, Switzerland (Gartner, G2); one directory lists Florida
Founded2008
Team100+ (SAP partner page); Gartner band 51-200
Named clientsNot stated on the pages we checked
Partners & badgesSAP Gold Partner; Xiting Security Platform runs on SAP Business Technology Platform; branches in Germany, Romania, the US and UK
Services
What stands out
- Published SAP access-security platform.
Research before choosing
- Confirm edition/release, implementation ownership, comparable reference, proposed team and delivery geography. Published collateral supports relevance; validate delivery quality and recency.
- Security technology provider. Confirm consulting scope and named implementation resources.
- Request a comparable client reference and confirm the delivery team
Source: Security technology; implementation services to confirmFacts from the company’s own website and public sources, checked 23 October 2026. Not a ranking.
Shortlisted
oXya
Research lead: SAP technical consulting, S/4HANA migration, BTP and managed cloud. Exact category delivery evidence remains to be obtained.
HQParis area, France (Issy-les-Moulineaux); Americas office in Jersey City
Founded1998 (its company page)
TeamAbout 900 to 1,000 (its site and a 2026 news item)
Named clientsNot stated on the pages we checked
Partners & badgesAcquired by Hitachi in 2015 and by Montefiore Investment in 2023
Services
What stands out
- Published technical consulting and managed SAP services.
- Research lead: SAP technical consulting, S/4HANA migration, BTP and managed cloud. Exact category delivery evidence remains to be obtained.
Research before choosing
- Confirm edition/release, implementation ownership, comparable reference, proposed team and delivery geography. Broader practice fit is an inference, not a verified category-specific capability.
- Confirm current entity, regional team, edition-specific expertise and a comparable reference.
- Request a comparable client reference and confirm the delivery team
Source: Broader SAP practice; exact category evidence pendingFacts from the company’s own website and public sources, checked 23 October 2026. Not a ranking.
Shortlisted
KPMG
Research lead: SAP business-led transformation and RISE delivery. Exact category delivery evidence remains to be obtained.
Before you choose: Confirm edition/release, implementation ownership, comparable reference, proposed team and delivery geography. Broader practice fit is an inference, not a verified category-specific capability.
HQGlobal network of member firms
FoundedNot stated for the practice
TeamNot stated for the practice
Named clientsNot stated on the pages we checked
Partners & badgesMember firms run Dynamics practices, for example in Australia and India; KPMG Canada agreed to acquire Adoxio
Services
Best at
- Dynamics ERP and CRM advisory and implementation through member firms
- Microsoft cloud transformation programmes
- Regional Dynamics practices, for example in Australia and India
Also offers
- Audit and assurance
- Tax
- Advisory and consulting
Source: Broader SAP practice; exact category evidence pendingFacts from the company’s own website and public sources, checked 23 October 2026. Not a ranking.
Shortlisted
Deloitte
Research lead: SAP transformation, operating models and implementation. Exact category delivery evidence remains to be obtained.
Before you choose: Confirm edition/release, implementation ownership, comparable reference, proposed team and delivery geography. Broader practice fit is an inference, not a verified category-specific capability.
HQLondon, UK (DTTL); services delivered by member firms
Founded1845
TeamAbout 470,000 people (FY2025, third-party); 150 countries and territories
Named clientsNot stated
Partners & badgesDTTL and each member firm are legally separate entities
Services
Best at
- Integration of enterprise systems with business process
- Technology, AI and data programmes
- Programmes that involve substantial organisational change
Also offers
- Audit and assurance
- Tax
- Consulting and risk
- Cyber
- Strategy and transactions
Source: Broader SAP practice; exact category evidence pendingFacts from the company’s own website and public sources, checked 23 October 2026. Not a ranking.
Shortlisted
PwC
Research lead: SAP finance and enterprise operating-model transformation. Exact category delivery evidence remains to be obtained.
Before you choose: Confirm edition/release, implementation ownership, comparable reference, proposed team and delivery geography. Broader practice fit is an inference, not a verified category-specific capability.
HQGlobal network of member firms
FoundedNot stated for the practice
Team370,000+ across the network (third-party job posting)
Named clientsNot stated on the pages we checked
Partners & badgesGlobal alliance with Microsoft covering Azure, Dynamics 365, Office 365 and Power BI (2017 announcement)
Services
Best at
- Dynamics 365 and Microsoft transformation programmes
- Public-sector Microsoft work
- Global alliance with Microsoft (announced 2017)
Also offers
- Audit and assurance
- Tax
- Advisory and consulting
Source: Broader SAP practice; exact category evidence pendingFacts from the company’s own website and public sources, checked 23 October 2026. Not a ranking.
Shortlisted
NTT DATA Business Solutions
Homepage screenshot pending
Research lead: SAP implementation, logistics, cloud and managed services. Exact category delivery evidence remains to be obtained.
Before you choose: Confirm edition/release, implementation ownership, comparable reference, proposed team and delivery geography. Broader practice fit is an inference, not a verified category-specific capability.
HQBielefeld, Germany
Founded1989 (as S&P Consulting)
Team13,500 (its G-Cloud document); other sources differ
Named clientsNot stated on the pages we checked
Partners & badgesPart of the NTT DATA group
Services
Best at
- Founded as S&P Consulting in 1989, one of the first SAP partners
- SAP implementation and services in 50+ countries (G-Cloud document)
Also offers
- Wider NTT DATA group IT services
Source: Broader SAP practice; exact category evidence pendingFacts from the company’s own website and public sources, checked 23 October 2026. Not a ranking.
How this shortlist was made: partners were assessed on category-specific evidence, based on public sources, mainly provider sources. A service page establishes a capability claim, not independently verified delivery quality. Team quality and comparable client references still need checking before selection. Reviewed 23 October 2026. The order is not a ranking. See How We Choose.
How to choose
- Ask for a reference with the same scope, and the same platform version where it applies.
- Confirm who will deliver the work and where they are based.
- Agree what is in scope: setup, integration, training and ongoing support.
- Check the partner's current SAP partner profile and any SAP recognition, then read the evidence link on its card.
Related categories
Public-cloud implementationPrivate-cloud implementationOn-premise implementation & upgradesAssessment, roadmap & business caseGreenfield implementation & fit-to-standardBrownfield ECC conversionSelective data transitionM&A carve-outs, carve-ins & ERP consolidationGlobal template & multi-country rolloutsClean-core & BTP extension engineeringABAP Cloud & custom-code remediationFiori, UX & role-based applicationsIntegration architecture & API engineeringData migration, cleansing & reconciliationArchiving, ILM & legacy decommissioningBasis, HANA & performance engineeringCloud hosting, HA/DR & platform operationsSecurity architecture & authorization redesignCloud ALM & Solution Manager transitionDevOps, transports & release governanceQA, regression & test automationCutover, adoption & business readinessApplication management & continuous improvementJoule, business AI & ERP automationAll SAP services
Run an agency in this category?
Listing is free and review is the same for everyone.