SM20 transaction times executions don't give you exact performance - you don't know how long he was there. More such data you can take from ST03N - steps, utilizations, times.
The have clear hands you need to have appropriate corporate policy to collect and permission from authorized unit to process.
In every moment you can face challenges like: someone did processing as absent user.
Without wide logging you know nothing.
