SAP Enterprise Cloud Services SOC 1 Audit Report 2026 Q2/2026 H1
To accommodate the diverse financial reporting periods of our global customer base, this product follows a quarterly rolling audit cycle rather than a standard half-year cycle. Each SOC 1 audit report covers a six-month period, but reports are issued every quarter on a rolling basis, ensuring continuous coverage throughout the year. As a result, you will notice that some reports are labelled by half-year (e.g., H1 2026, covering 1 October 2025 - 31 March 2026) while others are labelled by quarter (e.g., Q2 2026, covering 1 January 2026 - 30 June 2026). This naming convention reflects the quarter in which the report is issued, not the length of the coverage period—each report consistently covers six months. This approach ensures that regardless of when your fiscal year begins or ends, a current audit report aligning with your reporting needs is always available.
SAP Enterprise Cloud Services (ECS) includes the following Active Offerings area:
The following Data Centres are used by SAP Enterprise Cloud Services:
SOC 1 reports are prepared in accordance with AT-C section 320, Reporting on an Examination of Controls at a Service Organisation Relevant to User Entities’ Internal Control Over Financial Reporting, under Statement on Standards for Attestation Engagements (SSAE) No. 18, Attestation Standards: Clarification and Recodification. SOC 1 reports are specifically intended to meet the needs of the entities that use service organisations (user entities) and the CPAs that audit the user entities’ financial statements (user auditors). Please note that this examination's scope does not include the controls and related control objectives of any subservice organisations. SOC 1 Type 1 report on the fairness of the presentation of management’s description of the service organisation’s system and the suitability of the design of controls to achieve the related control objectives as of a specified date, whereas a SOC 1 Type 2 also includes the operating effectiveness of controls to achieve the related control objectives throughout a specified period.
SAP Enterprise Cloud Services has prepared SOC 1 Type 2 audit reports by an independent 3rd party accountant. This version of the report covers the audit period 1 January 2026 to 30 June 2026.
The use of these reports is restricted to the management of the service organisation, user entities and user auditors. A copy of this report is available for all SAP Enterprise Cloud Services customers who had productive and had financially-relevant systems during the audit period covered by the report.