Companies worldwide use SAP, but SAP by itself does not resolve all of an organizations issues. As a result, a number of organizations need to customize SAP applications to suit their purposes, but this has met with mixed results.
CAST today released the results of the 2014-2015 CRASH Report for SAP, which revealed more than half of those organizations opting to customize SAP applications have encountered increased application risk, additional software risk management costs and disruption of critical business processes.
In examining almost 50 million lines of customized applications written in ABAP, SAP’s programming language, the CRASH report revealed that more than half of all instances contained significant flaws, driving down business performance and increasing risk, while simultaneously incurring additional costs to companies’ bottom lines. This news comes at a time when SAP is making a renewed push to simplify the use of its enterprise software.
“Enterprise-level SAP customizations are far from simple,” said Dr. Bill Curtis, Chief Scientist at CAST. “Some require millions of lines of code and grow extremely complex. The more complex the code, the costlier it is to maintain and the longer it takes to add new functionality. That puts the business at a competitive disadvantage.”
The research reveals a number of applications are highly vulnerable, with companies exposing themselves to operational problems such as outages, performance degradation, unauthorized access or data corruption. Some of the other specific findings include:
- Basic software engineering errors account for more than half of all violations. Many of the mistakes suggest that junior or inexperienced programmers are completing the work.
- SAP customizations have more complexity issues than equivalent applications written in Java or C.
- Overall, developers complied with ABAP coding rules only one-third of the time.
Curtis is quick to emphasize that the software quality of custom SAP applications can be improved without abandoning ABAP.
“The agility of any business is directly tied to the quality of their code,” Curtis said. “Structural quality is often sacrificed for speed to deployment. Yet structural weaknesses are root causes of security breaches, outages, and other business risks. Businesses can improve their competitive agility and reduce costs by managing the quality of their SAP customizations.”
A copy of the CAST CRASH report for SAP can be downloaded at http://goo.gl/lgamMs.