How do we audit our SAP system?

I still am surprised by the methods in which audits of SAP systems take place.