SAP Enterprise Cloud Services SOC 1 Audit Report 2026 Q1 / 2026 H1
To accommodate the diverse financial reporting periods of our global customer base, this product follows a quarterly rolling audit cycle rather than a standard half-year cycle. Each SOC 1 audit report covers a six-month period, but reports are issued every quarter on a rolling basis, ensuring continuous coverage throughout the year. As a result, you will notice that some reports are labeled by half-year (e.g., H1 2026, covering October 1, 2025 – March 31, 2026) while others are labeled by quarter (e.g., Q2 2026, covering January 1, 2026 – June 30, 2026). This naming convention reflects the quarter in which the report is issued, not the length of the coverage period—each report consistently covers six months. This approach ensures that regardless of when your fiscal year begins or ends, a current audit report aligning with your reporting needs is always available.
SAP Enterprise Cloud Services (ECS) includes the following Active Offerings area:
The following Data Centers are used by SAP Enterprise Cloud Services:
SOC 1 reports are prepared in accordance with AT-C section 320, Reporting on an Examination of Controls at a Service Organization Relevant to User Entities’ Internal Control Over Financial Reporting, under Statement on Standards for Attestation Engagements (SSAE) No. 18, Attestation Standards: Clarification and Recodification. SOC 1 reports are specifically intended to meet the needs of the entities that use service organizations (user entities) and the CPAs that audit the user entities’ financial statements (user auditors). Please note that this examination's scope does not include the controls and related control objectives of any subservice organizations. SOC 1 Type 1 report on the fairness of the presentation of management’s description of the service organization’s system and the suitability of the design of controls to achieve the related control objectives as of a specified date, whereas a SOC 1 Type 2 also includes the operating effectiveness of controls to achieve the related control objectives throughout a specified period.
SAP Enterprise Cloud Services has prepared SOC 1 Type 2 audit reports by an independent 3rd party accountant. This version of the report covers the audit period October 1, 2025 to March 31, 2026.
The use of these reports is restricted to the management of the service organization, user entities, and user auditors. A copy of this report is available for all SAP Enterprise Cloud Services customers who had productive and had financially-relevant systems during the audit period covered by the report.