If you're evaluating an AP add-on for SAP, the question “how do you post invoices” matters more than the demo. The answer determines what your audit trail looks like, what your IT team has to maintain, and whether your add-on survives a SAP migration.

Most cloud AP tools post invoices into SAP through middleware. From SAP's perspective, every invoice posts under one anonymous service account. Fin4Sight does it differently. Here's the flow, what can go wrong, and how the audit trail comes together.

The flow, end to end

An invoice arrives by email or upload in Fin4Sight. AI extracts the data — header, line items, tax codes, PO references. Your configured approval workflow routes the invoice through the right people. SLAs track delays. Once the last approver signs off, Fin4Sight posts the invoice into SAP through SAP's standard posting interface — the same interface your AP team would use through SAP GUI.

The posting happens under the actual approver's SAP user, not a generic service account. Your auditor opens the SAP audit log and sees who posted what, exactly as if the approver had posted it themselves.

What can go wrong, and how Fin4Sight handles it

Common posting failures and how the platform handles them:

• Vendor not found. SAP returns an error referencing the missing vendor. Fin4Sight surfaces it as an exception in the AP queue with the vendor reference for cleanup.
• Tax code mismatch. Fin4Sight's tax-code determination ran on intake; SAP's tax configuration disagrees. The exception goes back into the queue with the tax-code reasoning visible.
• 3-way match failure. If the PO or goods receipt don't agree, the platform's pre-posting validation usually catches this; if SAP catches it instead, the rejection routes back into the queue with the discrepancy detail.
• Authorization missing. The SAP user lacks an authorization the posting needs. Fin4Sight surfaces the missing authorization object so your team can adjust the role.
• Network or transient error. The platform retries safely without creating duplicate postings — each invoice has a unique key that SAP uses to dedupe.

Every failure is logged with timestamp and the underlying message. The Fin4Sight audit log retains the failed attempts alongside the successful posting for 10 years.

The audit trail across two systems

Inside Fin4Sight: a complete record per invoice from intake to posting. User, timestamp, IP, and prior state on every transition. Invoice PDFs locked at intake — auditors can prove the document was never tampered with. SOX-friendly PDF report exportable on demand.

Inside SAP: a standard AP posting under the actual approver, in the standard SAP audit log, with a standard SAP document number.

Reconciliation between the two systems is one field per invoice — the SAP document number stored on the Fin4Sight side. Two complete trails, one join key. No middleware to explain.

Why this matters for SOX-aligned controls

Auditors care about three things in priority order: a single source of truth, a continuous audit trail, and permissions enforcement. The Fin4Sight model gives you all three.

The Fin4Sight side holds the invoice, AI-extracted data, approval chain, and document hashes — the source of truth for what the AP team did. The SAP side holds the document number and the standard audit log — the source of truth for what posted to the books. Permissions are enforced on both sides: Fin4Sight's role model on the workflow side, SAP's authorization model on the posting side.

It's not a single audit trail in the literal sense — it's two, with one join. But it's reconciled at the invoice level, every time, automatically. That's what passes audit.

When to ask harder questions

If an AP add-on tells you it posts to SAP but won't say under whose SAP user, ask. The good answers reference the actual approver. The bad answers reference a service account, middleware tools running between the cloud and SAP, or custom code installed in SAP. Each one of those is a separate audit conversation you'll have to win.

In practice

Fin4Sight runs in the cloud, alongside SAP. The intake, AI extraction, approvals, and audit log all live there. The posting goes into SAP through standard interfaces, under the actual approver. Your team controls the SAP authorization on the user. The standard SAP audit log captures every posting.

If you want to see this on your own SAP system, ask for a demo on a non-production system. Bring an invoice, watch it post.