Why This Diagnostic
Your free assessment showed you the gaps. This tells you why they exist and what to do about them.
The C6 Expert Diagnostic is a facilitated, expert-guided analysis of your Application Access Governance maturity. Gerald West — with 27+ years of SAP security experience, including 13 years as Head of Application Security & Controls at a FTSE 250 — personally reviews your responses, enriches them with industry benchmarking and pattern recognition, and delivers a prioritised report with a live review call.
This is not another questionnaire. It is a diagnostic consultation with a specialist who has managed the exact challenges you are facing.
What You Get
- Evidence-Based Maturity Scoring — Weighted, multi-dimensional scoring across your selected process area(s). A defensible maturity rating you can present to stakeholders.
- Root-Cause Gap Analysis — Identification of the specific capability gaps holding your maturity back, with analysis of why they exist — not just what is missing, but what is causing it.
- Industry Benchmarking — Comparison of your maturity against organisations of similar size, sector, and complexity.
- Prioritised Roadmap — A sequenced set of recommendations ranked by impact and feasibility, so you know exactly what to tackle first.
- Investment Case for Stakeholders — A clear articulation of the business case for each recommendation — ready to present upward to secure budget.
- 60-Minute Expert Review Call — A live session with Gerald West to walk through every finding and discuss strategic next steps specific to your organisation.
How It Works
Step 1: Choose Your Scope Select a single process area (e.g., Review & Certify Access) or the full AAG domain covering all five processes. Not sure which? Your free assessment results show your process-level scores — start with your lowest-scoring area.
Step 2: Complete the Enhanced Questionnaire You receive a structured, expert-level questionnaire that goes deeper than the free assessment. This takes 30–45 minutes for a single process, or 60–90 minutes for the full domain. Complete it in your own time.
Step 3: Expert Analysis & Report We analyse your responses using CaroKahn's proprietary Context Engineering methodology, enriching your data with industry benchmarking and 27+ years of pattern recognition. We may follow up with you on specific points if needed.
Step 4: Receive Your Diagnostic Report A branded PDF report (15–20 pages for a single process, 25–35 pages for full domain) as well as summary artefacts, delivered within 5 - 7 working days.
Step 5: Live Expert Review Call A 60-minute video call where Gerald walks through the findings, answers your questions, and discusses what to prioritise. Every call ends with clarity on your next move.
Choose Your Process Area
Each process area can be purchased individually (£1,500 + VAT) or as the full AAG Domain Diagnostic covering all five (£6,000 + VAT).
AAG-P1: Analyse & Monitor Access — How you collect, consolidate, and analyse access data across your SAP landscape. Covers SoD conflict identification, alert generation, event correlation, and conflict remediation.
AAG-P2: Design & Optimise Roles — How you design, build, test, and maintain your SAP role architecture. Covers role methodology, naming conventions, testing rigour, and continuous optimisation.
AAG-P3: Request & Provision Access — How users request, approve, and receive SAP access. Covers request workflows, approval routing, provisioning automation, joiners/movers/leavers, and emergency access.
AAG-P4: Review & Certify Access — How you review existing access for continued appropriateness. Covers periodic reviews, certification campaigns, manager attestation, and remediation tracking.
AAG-P5: Elevate & Control Access — How you manage privileged and temporary elevated access. Covers firefighter management, emergency access procedures, session logging, and post-access review.
Not sure which to choose? Take a free C6 Maturity Assessment for AAG at carokahn.com/assessments — your process-level scores will show you exactly where your biggest gaps are.
Who This Is For
- SAP Security leads and GRC managers who know their access governance isn't where it needs to be but can't articulate exactly where the gaps are – or what to fix first.
- Heads of Internal Audit receiving recurring access-related findings and needing a structured view of root causes, not just symptoms.
- Organisations preparing for S/4HANA migrations who need to redesign roles, access models, and SoD frameworks for the new platform – and want to get it right first time.
- IT Directors and CISOs who want access governance to demonstrate business value to the board, not just produce compliance reports that nobody reads.
- Teams running GRC tools like Pathlock, Soterion, or SAP GRC that know they're only exploiting a fraction of the technology's capability and need a roadmap to close the gap.
Frequently Asked Questions
How long does the whole process take?
From purchase to receiving your report: typically 2–3 weeks, depending on how quickly you complete the questionnaire. The expert review call is scheduled within 10 working days of report delivery.
I have already completed the free assessment. Do I need to answer questions again?
The Expert Diagnostic questionnaire is deeper and more detailed than the free assessment, but we use your free assessment results as a starting point so you are not repeating yourself. Think of the free assessment as the GP check-up and this as the specialist consultation.
Can I start with one process area and add more later?
Absolutely. Many clients start with their lowest-scoring process area from the free assessment, then expand to additional processes or the full domain. If you purchase additional process areas within 90 days, we credit the per-process price against the full domain price.
What format is the report?
A branded PDF document, professionally formatted and board-ready. Typically 15–20 pages for a single process area or 25–35 pages for the full domain. You own this document and can share it internally as needed.
Is this suitable for organisations currently migrating to S/4HANA?
Particularly so. The diagnostic assesses your current-state maturity and identifies specific access governance risks and opportunities relevant to your transformation. Many clients use the findings to shape their S/4HANA security workstream.
Can my organisation pay by invoice or purchase order?
Yes. For organisations that require a purchase order or prefer to pay by invoice rather than card payment, please email assessments@carokahn.com with your requirements. We will issue a formal quotation and can accommodate payment by bank transfer on standard net-30 terms. VAT-registered organisations will receive a proper VAT invoice.
Will I receive a VAT invoice?
Yes. All purchases include a VAT receipt. For card payments through the store, Payhip (as merchant of record) issues the VAT receipt automatically. For invoice payments arranged directly with CaroKahn, we issue a VAT invoice via QuickBooks.
What if I am not satisfied?
If the diagnostic does not meet your expectations, email assessments@carokahn.com within 7 days of receiving your report. We will discuss your concerns and offer a partial or full refund on a case-by-case basis.
Can I get a diagnostic for other domains (CCM, DPS, AIRC)?
The C6 Expert Diagnostic will be available across all four C6 Maturity Model domains. AAG is the first to launch. Contact assessments@carokahn.com to register your interest for another domain.