Why This Diagnostic
Your free assessment showed you the gaps. This tells you why they exist and what to do about them.
The C6 Expert Diagnostic is a facilitated, expert-guided analysis of your Continuous Controls Monitoring maturity. Gerald West – with 27+ years of SAP security experience, managing, developing and advising on SAP security & controls at global organisations – personally reviews your responses, enriches them with industry benchmarking and pattern recognition, and delivers a prioritised report with a live review call.
This is not another questionnaire. It is a diagnostic consultation with a specialist who has managed the exact challenges you are facing.
What You Get
- Evidence-Based Maturity Scoring – Weighted, multi-dimensional scoring across your selected process area(s). A defensible maturity rating you can present to stakeholders.
- Root-Cause Gap Analysis – Identification of the specific capability gaps holding your maturity back, with analysis of why they exist, what is missing and what is causing it.
- Industry Benchmarking – Comparison of your maturity against organisations of similar size, sector, and complexity.
- Prioritised Roadmap – A sequenced set of recommendations ranked by impact and feasibility, so you know exactly what to tackle first.
- Investment Case for Stakeholders – A clear articulation of the business case for each recommendation – ready to present upward to secure budget.
- 60-Minute Expert Review Call – A live session to walk through findings, answer questions, and agree priorities.
How It Works
Step 1: Choose Your Scope Select a single process area (e.g., Monitor & Detect Issues) or the full CCM domain covering all five processes. Not sure which? Your free assessment results show your process-level scores – start with your lowest-scoring area.
Step 2: Complete the Enhanced Questionnaire You receive a structured, expert-level questionnaire that goes deeper than the free assessment. This takes 30–45 minutes for a single process, or 60–90 minutes for the full domain. Complete it in your own time.
Step 3: Expert Analysis & Report We analyse your responses using CaroKahn's proprietary Context Engineering methodology, enriching your data with industry benchmarking and 27+ years of pattern recognition. We may follow up with you on specific points if needed.
Step 4: Receive Your Diagnostic Report A branded PDF report (15–20 pages for a single process, 25–35 pages for full domain) as well as summary artefacts, delivered within 5–7 working days.
Step 5: Live Expert Review Call A 60-minute video call where Gerald walks through the findings, answers your questions, and discusses what to prioritise. Every call ends with clarity on your next move.
The only change from the AAG version is in Step 1 — "Review & Certify Access" becomes "Monitor & Detect Issues" and "AAG domain" becomes "CCM domain." The rest is already domain-agnostic.
Also — the infographic image on the left still says "full AAG domain" in step 1. You'll want to Replace that image with a CCM version at some point, but it's not a blocker for now. You can come back to it.
Once pasted, click ← Back and show me the next section down.
Please update the image to make it CCM
11:10
Verified domain terminology shift from AAG to CCM
Verified domain terminology shift from AAG to CCM
Download that and use the Replace button on the image in the Payhip section to swap it in. The only change from the AAG original is in Step 1 — "full CCM domain" instead of "full AAG domain." Everything else is domain-agnostic.
Once you've replaced the image, click ← Back and show me the next section down — that should be the one listing the specific process areas or the pricing tiers.
Ccm how it works flowchart
Image · PNG
SOpen in Photos
Choose Your Process Area
Each process area can be purchased individually (£1,500 + VAT) or as the full CCM Domain Diagnostic covering all five (£6,000 + VAT).
CCM-P1: Define & Document Controls – How you establish, maintain, and govern your control definitions. Covers control inventories, ownership assignment, regulatory mapping, and cross-domain dependencies.
CCM-P2: Test & Validate Controls – How you prove controls are working as intended. Covers testing methodologies, automation of validation, frequency and coverage, and evidence management.
CCM-P3: Monitor & Detect Issues – How you identify control exceptions and anomalies in real time. Covers alert design, false positive management, threshold calibration, and cross-system correlation.
CCM-P4: Investigate & Remediate – How you respond when exceptions are detected. Covers triage processes, root-cause analysis, remediation workflows, escalation paths, and closure tracking.
CCM-P5: Report & Govern – How you translate monitoring activity into strategic intelligence. Covers board-level reporting, compliance packs, KPI/KRI frameworks, and continuous improvement governance.
Not sure which to choose? Take a free C6 Maturity Assessment for CCM at carokahn.com/assessments – your process-level scores will show you exactly where your biggest gaps are.
Who This Is For
- Heads of Internal Audit and Compliance seeking assurance that controls are operating effectively — not just documented.
- SAP Security and GRC leads who know their monitoring generates noise but can't demonstrate value to stakeholders.
- Organisations preparing for SOX, JSOX, or UK Corporate Governance Code Provision 29 requirements around internal controls effectiveness.
- Teams planning or midway through S/4HANA migrations who need to redesign their controls monitoring architecture for the new platform.
- CISOs and IT Directors who want controls monitoring to be a strategic asset, not a compliance burden.
Frequently Asked Questions
How long does the whole process take?
From purchase to receiving your report: typically 2–3 weeks, depending on how quickly you complete the questionnaire. The expert review call is scheduled within 10 working days of report delivery.
I have already completed the free assessment. Do I need to answer questions again?
The Expert Diagnostic questionnaire is deeper and more detailed than the free assessment, but we use your free assessment results as a starting point so you are not repeating yourself. Think of the free assessment as the GP check-up and this as the specialist consultation.
Can I start with one process area and add more later?
Absolutely. Many clients start with their lowest-scoring process area from the free assessment, then expand to additional processes or the full domain. If you purchase additional process areas within 90 days, we credit the per-process price against the full domain price.
What format is the report?
A branded PDF document, professionally formatted and board-ready. Typically 15–20 pages for a single process area or 25–35 pages for the full domain. You own this document and can share it internally as needed.
Is this suitable for organisations currently migrating to S/4HANA?
Particularly so. The diagnostic assesses your current-state maturity and identifies specific access governance risks and opportunities relevant to your transformation. Many clients use the findings to shape their S/4HANA security workstream.
Can my organisation pay by invoice or purchase order?
Yes. For organisations that require a purchase order or prefer to pay by invoice rather than card payment, please email assessments@carokahn.com with your requirements. We will issue a formal quotation and can accommodate payment by bank transfer on standard net-30 terms. VAT-registered organisations will receive a proper VAT invoice.
Will I receive a VAT invoice?
Yes. All purchases include a VAT receipt. For card payments through the store, Payhip (as merchant of record) issues the VAT receipt automatically. For invoice payments arranged directly with CaroKahn, we issue a VAT invoice via QuickBooks.
What if I am not satisfied?
If the diagnostic does not meet your expectations, email assessments@carokahn.com within 7 days of receiving your report. We will discuss your concerns and offer a partial or full refund on a case-by-case basis.
Can I get a diagnostic for other domains (AAG, DPS, AIRC)?
Yes. The C6 Expert Diagnostic is available across all four C6 Maturity Model domains: AAG, CCM, DPS, and AIRC. Visit the Get Expert Guidance collection to explore all available diagnostics.