Making Compliance Work: Connecting Processes, People and Evidence Across SAP
Making Compliance Work: Connecting Processes, People and Evidence Across SAP
Effective compliance requires more than policies and controls. It depends on connecting information, people and actions across business processes.
Organisations invest in SAP and specialist governance systems to manage risk, enforce policies and maintain control over business operations. Yet even well-designed compliance processes depend on everyday activities that can be difficult to manage.
Employees must complete declarations. Managers must review access requests. Control owners must investigate exceptions. Suppliers may need to provide certifications or supporting documentation.
When these activities rely on disconnected forms, emails and manual follow-up, compliance becomes harder to manage and evidence.
Arch helps organisations connect the activities that turn compliance requirements into completed, accountable business processes.
By bringing together SAP-integrated forms through Stelo, business interactions in Microsoft Teams through Looply, and controlled correspondence through Floe, Arch helps organisations improve compliance processes while retaining the SAP systems and governance controls they already rely upon.
Why compliance processes become fragmented
Compliance responsibilities are often distributed across departments, systems and individuals. Although the underlying business rules may be clearly defined, carrying out the required activities can be more complicated.
Information capture is one challenge. Internal control assessments, employee declarations and supplier questionnaires often involve information that isn’t already held in SAP. When gathered through spreadsheets, attachments or disconnected forms, submissions can be incomplete, inconsistent or difficult to track.
Business participation is another. Many compliance tasks depend on managers and employees who rarely use specialist governance applications. Access reviews, policy acknowledgements and control confirmations can be overlooked, leading to delayed decisions and repeated reminders.
Communication presents a further challenge. Compliance processes may require formal notices, confirmation letters or requests for supporting documentation. Manually preparing these communications can introduce inconsistencies or errors, particularly when they must incorporate information held in SAP.
These are not necessarily failures of the underlying compliance system. They are often gaps between the system, the business process and the people responsible for carrying it out.
As we explored in SAP GRC Finds the Risk. The Business Still Has to Act., identifying a risk is only part of effective governance. Someone must still understand what is required and take appropriate action.
Connecting compliance requirements to business action
Effective compliance depends on several connected activities: collecting and validating information, reviewing and acting on decisions, communicating outcomes, and maintaining appropriate records.
Not every process requires every activity, and they do not always follow a fixed sequence. The important principle is that they operate within a controlled business process rather than as disconnected administrative tasks.
For organisations running SAP, this does not mean replacing existing governance applications or rebuilding established business processes.
SAP GRC, SAP S/4HANA, SAP SuccessFactors and other enterprise applications can continue to manage their respective business data, governance rules and process records. Complementary technologies can then make information collection, business participation and communication more effective.
How Arch supports connected compliance
Arch provides three complementary technologies that address different aspects of compliance processes. Each can be deployed independently or combined where a business process requires several capabilities.
Stelo: Capture and control compliance information
Many compliance activities begin with collecting information that must be reviewed, validated and recorded.
Stelo enables organisations to digitise manual processes using custom SAP Fiori forms and applications, supported by an integrated SAP process framework.
A compliance assessment, for example, could collect structured responses, pre-populate fields using SAP data, validate submissions and include supporting documentation. The information can then move through a defined review or approval process, with relevant outcomes recorded or posted into SAP.
Stelo also provides process monitoring and audit-trail capabilities, including visibility into the information submitted and changes made during the process.
This makes it suitable for activities such as internal control assessments, employee declarations, exception reporting and supplier compliance reviews.
Rather than simply replacing a spreadsheet with an online form, Stelo brings information capture into a controlled, integrated SAP process.
Read more: Stelo for Fiori Forms: Revolutionizing Manual Processes into Digitized SAP Workflows
Looply: Connect people to decisions and actions
Even a well-designed compliance process depends on people responding at the right time.
Managers may need to approve access requests, employees may need to acknowledge policies, and control owners may need to review exceptions or confirm that corrective actions have been completed.
These tasks can easily be overlooked when they sit within applications that users rarely visit.
Looply extends SAP and other business processes into Microsoft Teams, bringing relevant notifications and actions into an environment people already use.
Using interactive Adaptive Cards, Looply can present contextual information, request decisions, capture responses and provide access to supporting material. Reminders, escalations and notification updates can help keep outstanding activities visible.
The underlying governance process remains in the appropriate business system. For example, SAP GRC can continue to manage access governance rules, risk analysis and controlled approvals, while an appropriately configured Looply integration makes selected tasks more accessible to business users.
The same approach can support compliance processes implemented through Stelo or other SAP applications.
Looply helps close the gap between a compliance task being assigned and the responsible person taking action.
For a practical example involving policy acknowledgements and employee confirmations, read Streamlining Process Compliance with Microsoft Teams and Looply.
Floe: Deliver consistent business communications
Some compliance processes also require formal communication with employees, suppliers, customers or other stakeholders.
These communications may need to follow approved formats, incorporate specific wording or contain information drawn directly from SAP.
Floe enables organisations to generate professional, data-driven business correspondence using centrally managed templates and SAP business information.
This can include formal notifications, requests for documentation, confirmation letters and other correspondence where accuracy and consistency are important.
For example, a supplier compliance process might require a formal request for missing certification, or confirmation that a review has been completed. Floe can generate the appropriate email or document using an approved template and relevant SAP data.
By integrating communications with the business process, Floe helps reduce manual preparation and maintain consistency across outgoing correspondence.
Discover more about Floe for SAP business correspondence.
Connected compliance in practice
The value of these complementary capabilities becomes clearer when we consider how they could support different compliance requirements.
The following scenarios illustrate possible approaches, rather than implying that every capability is required in every process.
Scenario 1: Access governance and risk remediation
Consider an organisation using SAP GRC Access Control to manage access requests and segregation-of-duties risks.
SAP GRC provides the governance framework, identifies potential conflicts and manages the relevant approval processes. But the effectiveness of those controls still depends on business managers and control owners reviewing requests and responding appropriately.
Looply can provide an additional interaction channel, presenting relevant tasks in Microsoft Teams with information to help the recipient understand the decision required. Depending on the workflow and integration, responses can be returned to the underlying SAP process.
Where an exception requires a more extensive investigation or structured assessment, Stelo could provide a Fiori process for documenting findings, collecting supporting information and managing subsequent reviews.
The intention is not to reproduce SAP GRC functionality in another application, but to improve the business activities surrounding access governance.
Importantly, speed is not the only consideration. Access review decisions must also be informed.
Our article Access Reviews Fail When Managers Don’t Have the Context to Decide explores why the quality of information presented to reviewers is critical.
Scenario 2: Supplier compliance assessments
Supplier compliance provides an example where all three Arch products could contribute to the same business process.
An organisation may need to conduct periodic supplier reviews, covering certifications, regulatory requirements, financial information and supporting documents.
Without an integrated process, these activities can involve questionnaires, spreadsheets, email correspondence and manual tracking.
A connected approach could work differently.
Stelo provides an SAP Fiori assessment for internal users, with supplier information drawn from SAP, structured compliance questions and supporting documentation. The completed assessment can be routed for review.
Looply notifies the responsible manager through Microsoft Teams, presents the relevant approval task and supports follow-up where decisions remain outstanding.
Floe generates appropriate supplier correspondence, such as a request for missing documentation or confirmation of the review outcome, using approved templates and SAP data.
The assessments, decisions and relevant process history remain associated with the appropriate SAP processes and supporting repositories.
Each product addresses a distinct requirement: collecting and controlling information, engaging people in decisions, and communicating outcomes.
Together, they illustrate how a complex compliance activity can be managed as a connected business process rather than a collection of disconnected tasks.
Extending existing SAP systems, not replacing them
Organisations often already have established systems for governance, business transactions, document management and audit records.
Improving compliance processes should build on those investments, rather than introduce another disconnected system.
Arch’s approach is to extend existing SAP capabilities while preserving the responsibilities of the underlying applications.
SAP GRC remains responsible for the relevant governance rules and access decisions. Stelo manages structured information capture and form-driven processes within SAP. Looply connects people with the tasks requiring their attention. Floe generates business correspondence using information and rules from SAP.
Integration ensures that relevant data and decisions can be handled by the appropriate systems of record.
The same principle applies to audit evidence. Assessment histories, recorded approvals and correspondence can contribute to accountability, but the evidence required for a particular control depends on the organisation’s policies, retention requirements and process design.
By keeping these responsibilities clear, organisations can improve how compliance activities are performed without unnecessarily changing the systems that govern them.
Making compliance work
Compliance becomes more effective when the activities supporting it are embedded in everyday business processes.
Arch brings together structured SAP information capture, accessible workflow interactions through Microsoft Teams and consistent business communications.
Through Stelo, Looply and Floe, organisations can address individual compliance challenges or connect multiple activities into more comprehensive, controlled processes.
The objective is not to introduce another layer of compliance administration. It is to make existing compliance processes easier to manage, complete and evidence.
Explore compliance solutions with Arch
Whether you’re improving SAP GRC workflows, digitising compliance assessments, managing policy acknowledgements or automating business correspondence, Arch can help you connect the systems, information and people involved.
Explore our Compliance & Risk Management solutions, or contact Arch to discuss your requirements.