This Part­ner Insight was authored by Joe Mark­graf, Founder of Mark­graf Consulting.

Trans­for­ma­tion was nev­er sup­posed to change who’s in con­trol of the tech­nol­o­gy. But over time, it often does.

A storm rolls through a utility’s ser­vice ter­ri­to­ry. Crews are staged, out­age tick­ets are queued, and the SAP plat­form behind the whole oper­a­tion is doing exact­ly what it was built to do. Cus­tomer records are accu­rate, billing is avail­able, and secu­ri­ty con­trols are hold­ing. Noth­ing is tech­ni­cal­ly broken.

Yet restor­ing ser­vice for a sin­gle house­hold stalls because cus­tomer oper­a­tions, infra­struc­ture, secu­ri­ty, and finance each have a legit­i­mate claim on who makes the call.

That gap already has an own­er on paper. It’s called the Roles and Respon­si­bil­i­ties doc­u­ment, or R&R, and it comes with every RISE with SAP con­tract. Most orga­ni­za­tions read it once, dur­ing sign­ing, and nev­er open it again.

Pre­cise on Day 1

The R&R is a for­mal con­trac­tu­al exhib­it, a task-by-task matrix that assigns every oper­a­tional respon­si­bil­i­ty in the envi­ron­ment — infra­struc­ture, secu­ri­ty, appli­ca­tion sup­port, cus­tom code, inte­gra­tion — to SAP, to the cus­tomer, or to both. Line by line, it answers the exact ques­tion that stalls a storm response: who owns this?

At SAP and SAP Nation­al Secu­ri­ty Ser­vices (SAP NS2), I helped design the cloud ref­er­ence archi­tec­ture that would lat­er become part of RISE with SAP, includ­ing the R&R frame­work itself. At sign­ing, the answer is pre­cise because orga­ni­za­tions nego­ti­ate this doc­u­ment hard. It’s worth mil­lions of dol­lars across the life of the contract.

The prob­lem begins the day after sign­ing. The R&R is frozen the moment it’s exe­cut­ed. The orga­ni­za­tion it describes is not.

Every finance team already under­stands amor­ti­za­tion — a contract’s record­ed val­ue declin­ing across its life on a fixed sched­ule, whether or not any­one updates the paper­work. Almost none apply that think­ing to what the con­tract says about who’s actu­al­ly in charge. We call this Own­er­ship Amor­ti­za­tion: the gov­er­nance val­ue of a doc­u­ment qui­et­ly declin­ing from the day it’s signed, even as the doc­u­ment itself nev­er changes.

Every acqui­si­tion, every AI ini­tia­tive, every secu­ri­ty pro­gram, every reg­u­la­to­ry change, and every retire­ment moves a deci­sion from one desk to anoth­er. None of this gets reflect­ed in the one doc­u­ment that’s sup­posed to say who owns what now.

RISE cus­tomers see this most clear­ly, because SAP put it in writ­ing. Util­i­ties run­ning through a hyper­scaler-host­ed man­aged ser­vices part­ner or their own pri­vate cloud know it under a dif­fer­ent name, whether a mas­ter ser­vices agree­ment (MSA), a RACI chart, or an inter­nal oper­at­ing agree­ment. What­ev­er it’s called, own­er­ship amor­tizes the same way.

Why Util­i­ties Feel This First

Util­i­ties feel this ear­li­er than most indus­tries because the peo­ple qui­et­ly hold­ing the real ver­sion of this doc­u­ment togeth­er are retir­ing. These are the ones who know the R&R says one thing while the actu­al process has moved elsewhere.

When they leave, the orga­ni­za­tion los­es the last per­son who could see how far own­er­ship had already amor­tized away from what the doc­u­ment still claims.

And a reg­u­la­tor review­ing an out­age, a secu­ri­ty inci­dent, or an audit find­ing will not accept ​“the con­tract says it was shared” as an answer. They will ask who was respon­si­ble and expect a name.

Get­ting ahead of that ques­tion, instead of dis­cov­er­ing it dur­ing an audit, depends on who’s actu­al­ly pay­ing atten­tion before any­thing breaks.

Where Most Advi­so­ry Work Stops Short

Tra­di­tion­al advi­so­ry mod­els rarely reward clos­ing this kind of gap quick­ly. The larg­er the firm, the more its busi­ness mod­el depends on ambi­gu­i­ty last­ing long enough to bill against — anoth­er change order, anoth­er year of man­aged ser­vices lay­ered on top of a doc­u­ment nobody wants to reopen. In that mod­el, speed and can­dor about the R&R are a threat.

We recent­ly scoped a mul­ti-month reme­di­a­tion engage­ment for a util­i­ty gov­er­nance, risk, and com­pli­ance (GRC) tool­ing and iden­ti­ty gov­er­nance tool­ing had drift­ed so far from how access was actu­al­ly being pro­vi­sioned that nobody could say with con­fi­dence who owned an unmit­i­gat­ed user until one sur­faced in an audit. Unwind­ing it took months and ran into six fig­ures. Nobody had kept the own­er­ship ques­tion cur­rent since the sys­tems went live.

A firm with that incen­tive struc­ture can afford to let the gap sit. We can’t, and we don’t want to. Being small enough to send the per­son who helped design the ref­er­ence archi­tec­ture, instead of a team assem­bled after the con­tract is signed, was nev­er a lim­i­ta­tion or a workaround. It is the entire point.

Own­er­ship Amor­ti­za­tion is a gov­er­nance prob­lem, and it’s the mech­a­nism behind a larg­er pat­tern: any doc­u­ment that once answered ​“who’s in charge” has stopped being true, whether that’s an R&R, an M&A inte­gra­tion plan, or an AI gov­er­nance char­ter. SAP is sim­ply where it’s eas­i­est to see and prove.

If any of this sounds famil­iar inside your own orga­ni­za­tion, that recog­ni­tion is exact­ly what an Exec­u­tive Oper­at­ing Mod­el Assess­ment is built to test: gov­er­nance, account­abil­i­ty, and deci­sion rights, exam­ined against the orga­ni­za­tion you have today, rather than the one described in the agree­ment you signed.

Joe Mark­graf is the Founder of Mark­graf Con­sult­ing, an advi­so­ry prac­tice focused on SAP secu­ri­ty, gov­er­nance, and oper­a­tional resilience.