Most ERP platforms pass their annual audit and still carry superuser accounts nobody uses, integration accounts that can log on interactively and segregation of duties conflicts that were "mitigated" years ago by a control nobody runs. This health check is a recurring, measurable review of an ERP platform that is already in production: finance, procurement, payroll, inventory and the integrations around them. It turns the questions an internal auditor or security lead would ask into twelve metrics with formulas, thresholds and evidence, so the result can be compared quarter on quarter. It is written for ERP security leads, basis and platform administrators, internal audit and the CISO's office.
This page measures; it does not explain how to secure the platform. For hardening, tooling choices and control design, use the ERP security buyer's guide and the ERP platform integration security guide, and go back to them for every finding this review raises. The check is vendor-neutral: the same metrics apply to on-premises suites, hosted ERP and cloud ERP, though the data sources differ.
What this health check covers
The review covers the production ERP instance or tenant and the systems that feed it: integration middleware, scheduled jobs, the identity provider that authenticates users, and the change pipeline that moves code and configuration into production. It does not cover the business process controls that finance owns (for example three-way match), except where a security control protects them, such as independent approval of supplier bank detail changes.
- Who runs it: the ERP security lead or platform owner collects the data; internal audit or a second-line risk function reviews a sample; the ERP business owner (often the finance director or CFO's delegate) signs off.
- What it is not: a configuration baseline scan, a code review or a penetration test. Those produce inputs to some metrics here (patch level, custom code findings) but the health check is about whether controls are working over time.
- Scope by environment: production is mandatory. Include any non-production system that holds a copy of production data, since a full copy of payroll in a test system is a production data risk.
- Long-tail use: teams searching for an "ERP security audit checklist", "ERP access review KPIs" or "segregation of duties metrics" can use the metrics table as-is.
Key takeaways
- Measure access first. Superuser assignments, unmitigated segregation of duties conflicts and leaver accounts cause most ERP audit findings and most fraud exposure.
- Treat integration accounts as identities. Integration, batch and interface accounts often outnumber privileged humans; measure whether they can log on interactively and when their credentials last changed.
- Emergency access needs evidence, not just a process. Count emergency sessions and the share reviewed within five working days.
- Change control is a security control. Direct changes in production and transports without an approved change are where configuration drift and fraud both start.
- Track trends, not snapshots. Keep each quarter's figures; a red metric that is improving is a different conversation from an amber one that is getting worse.
How to use this template
Copy the metrics table and the findings log into your own tracker, then run this ERP platform health check at the cadence set out below. Collect each figure from the data sources described, score it against the green, amber and red thresholds, and record every amber or red result as a finding with an owner and a due date. Keep each completed review so you can compare results quarter on quarter: the trend matters as much as any single score.
Cadence and sign-off
| Review | Frequency | Owner | Approver | Evidence kept |
|---|---|---|---|---|
| Emergency access session review | Weekly | ERP security lead | Business process owner for the affected area | Session log extract, reviewer name, date, outcome |
| Leaver and transfer reconciliation | Monthly | Identity team | ERP security lead | HR leaver list joined to ERP user list, exceptions with tickets |
| Full metrics review (this page) | Quarterly | ERP security lead | ERP business owner and CISO | Metrics table with figures, data extracts, findings log |
| Segregation of duties ruleset review | Annually, and after major process change | Internal controls team | Head of internal audit | Ruleset version, change list, sign-off minutes |
| Independent sample test | Annually | Internal audit | Audit committee | Sample selection, test results, agreed actions |
Keep evidence for at least as long as your financial audit retention period. Where the ERP supports financial reporting under a statutory audit regime, align the quarterly review with the external auditor's IT general controls testing so the same evidence serves both.
Metrics
NHI Mgmt Group recommended thresholds; adjust to your risk appetite. "Active" means able to authenticate today; "privileged" means holding any role or profile on your critical authorisations list (full system access, user administration, role maintenance, direct table maintenance, debugging with change rights, payment run execution).
| ID | Metric | Formula | Data source type | Green | Amber | Red |
|---|---|---|---|---|---|---|
| ERP-01 | Standing superuser assignments | Active dialog users holding full-access profiles outside emergency access ÷ total active dialog users | ERP user and role assignment export | 0 | 1 to 2 named exceptions with expiry | Any without an exception record |
| ERP-02 | Unmitigated segregation of duties conflicts | Users with at least one high-risk conflict and no assigned mitigating control ÷ total active users | SoD analysis output against the approved ruleset | Below 1% | 1% to 3% | Above 3% |
| ERP-03 | Mitigating controls actually performed | Mitigating control instances evidenced this quarter ÷ instances due this quarter | Control register and evidence repository | 100% | 90% to below 100% | Below 90% |
| ERP-04 | Emergency access reviewed on time | Emergency sessions reviewed within 5 working days ÷ total emergency sessions | Emergency access session logs and review records | At least 95% | 80% to below 95% | Below 80% |
| ERP-05 | Leaver accounts still active | ERP accounts active more than 24 hours after HR termination date ÷ leavers in period | HR leaver feed joined to ERP user export | 0% | Above 0% to 2% | Above 2% |
| ERP-06 | Delivered and default accounts exposed | Delivered or default accounts that are unlocked, or still on an initial or default password ÷ delivered accounts present | ERP user export with lock status and password change date | 0 | Unlocked but password changed and owned | Any on initial or default password |
| ERP-07 | Integration accounts with interactive logon | Integration, batch and interface accounts able to log on interactively ÷ total such accounts | ERP user export filtered by user type | 0% | Above 0% to 5% with exception | Above 5% |
| ERP-08 | Stale integration credentials | Integration accounts whose password, key or certificate is older than policy ÷ total integration accounts | ERP user export, secrets store inventory, certificate inventory | Below 5% | 5% to 20% | Above 20% |
| ERP-09 | Security patch latency | Vendor security notes rated critical or high applied within 30 days of release ÷ applicable notes released in period | Patch level report and vendor advisory list | At least 90% | 70% to below 90% | Below 70%, or any note for a vulnerability in the CISA KEV catalogue outstanding |
| ERP-10 | Security audit logging coverage | Production instances and clients with security audit logging enabled and forwarded to the SIEM ÷ total production instances and clients | ERP logging configuration, SIEM source inventory | 100% | Logging on, forwarding gaps | Any production client without logging |
| ERP-11 | Changes made directly in production | Count of direct configuration, table or code changes in production outside the transport or deployment pipeline, per quarter | Change logs, table change logs, system changeability history | 0 outside emergency | 1 to 3 with retrospective approval | More than 3, or any without approval |
| ERP-12 | Supplier bank detail changes with independent approval | Supplier bank detail changes approved by a second person ÷ total bank detail changes | Supplier master change log | 100% | 95% to below 100% | Below 95% |
Two further measures are worth adding once the twelve are stable: open critical findings in custom code older than 90 days (from your code scanning tool) and the share of non-production systems holding unmasked production personal data.
How to collect the data
Pull every figure from a system export, not from a questionnaire. A metric that is self-reported by the team being measured is not evidence.
- Build the population lists first. Export all users with user type, lock status, last logon, valid-to date and last password change. Export role and profile assignments. Export the HR worker list with termination dates. These three files drive ERP-01, ERP-02 and ERP-05 to ERP-08.
- Agree the critical authorisations list. Write down, once, which roles, profiles and authorisations count as privileged. Version it. Without a fixed list, ERP-01 changes every time a different person runs the check.
- Run the segregation of duties analysis against the approved ruleset, not a vendor default left unedited. Join the output to the mitigating control register so you can separate mitigated from unmitigated conflicts.
- Classify integration accounts. Use the user type field where the platform has one; otherwise tag by naming convention and confirm with the integration owner. Join to the secrets store and certificate inventory to get credential age. The Service Account Inventory Template gives a usable column set.
- Collect emergency access logs from the emergency access tool or the session log, with reason code, start and end time and the transactions or functions used.
- Get patch status from the platform's patch level or support package report and compare it with the vendor's security advisory list for the period. Check each applied or missing note against the CISA Known Exploited Vulnerabilities catalogue.
- Confirm logging by reading the logging configuration per instance and client, then checking the SIEM for events received from each in the last seven days. Configuration alone does not prove forwarding.
- Extract change evidence from the transport or deployment log, the table change log and the system changeability history, and join each production change to a change ticket.
- Pull supplier master changes filtered to bank account fields, with the creator and approver user IDs.
Store the raw extracts with the quarter's results. When a figure is challenged, you need the population, not just the percentage.
Red flags that need action now
- A dialog user, other than a documented emergency account, holds full system access in production.
- A delivered or default account is unlocked with its initial or default password.
- An integration account with broad finance or payroll authorisations can log on interactively.
- Emergency access was used and nobody reviewed the session log.
- A security note for a vulnerability listed in the CISA KEV catalogue is not applied and has no compensating control.
- Security audit logging is switched off in a production client, or the SIEM has received nothing from it for a week.
- The same user created a supplier bank detail change and released a payment to that supplier.
- Production was opened for direct changes and left open past the approved window.
Where a red flag suggests misuse rather than misconfiguration, move to the ERP compromise response playbook before you remediate, so evidence is preserved.
Findings log
| ID | Finding | Metric | Severity | Owner | Due date | Status |
|---|---|---|---|---|---|---|
| HC-ERP-01 | [Description, population and figure] | ERP-01 | [Critical / High / Medium / Low] | [Role] | [Date] | [Open / In progress / Closed / Risk accepted] |
| HC-ERP-02 | [Description] | ERP-02 | [Severity] | [Role] | [Date] | [Status] |
| HC-ERP-03 | [Description] | [Metric ID] | [Severity] | [Role] | [Date] | [Status] |
Suggested due dates: red flags within 7 days, red metrics within 30 days, amber metrics within 90 days. Risk acceptance needs the ERP business owner's signature and an expiry date, never an open-ended waiver.
Remediation map
| Finding type | Where to fix it |
|---|---|
| Superuser and privileged role assignments (ERP-01) | Privileged Access Management Guide |
| Segregation of duties conflicts and mitigating controls (ERP-02, ERP-03) | Segregation of Duties Guide and the Segregation of Duties Matrix Template |
| Emergency access without review (ERP-04) | Break-Glass Account Guide |
| Leaver accounts (ERP-05) | Access Reviews Guide |
| Integration account logon type and credential age (ERP-07, ERP-08) | ERP platform integration security guide and Service Account Security Guide |
| Patch latency, default accounts, logging and change control (ERP-06, ERP-09 to ERP-11) | ERP security buyer's guide (capability areas for patch, transport and threat detection) |
| Supplier bank detail changes (ERP-12) | Payment Verification Policy Template |
Related guides
- ERP security buyer's guide: capability areas and evaluation questions for ERP security tooling.
- ERP platform integration security guide: securing the interfaces and accounts that ERP-07 and ERP-08 measure.
- ERP compromise response playbook: what to do when a red flag looks like an attack.
- Data Security Maturity Model: where this review sits in a wider data security programme.
- CRM platform health check: the same approach for the customer-facing system of record.
References
- NIST: SP 800-53 Rev. 5 (AC-2 Account Management, AC-5 Separation of Duties, AC-6(7) Review of User Privileges, AU-6, CM-3 Configuration Change Control, SI-2 Flaw Remediation)
- NIST: Cybersecurity Framework 2.0 (PR.AA-05 access permissions, PR.PS-01 configuration management, DE.CM-03 personnel activity monitoring)
- CIS: Critical Security Controls v8.1 (Control 5 Account Management, Control 6 Access Control Management, Control 7 Continuous Vulnerability Management, Control 8 Audit Log Management)
- CISA: Known Exploited Vulnerabilities Catalog
Related NHI Mgmt Group resources: Segregation of Duties Guide, Service Account Security Guide, Data Security Guide, Identity governance and administration (IGA) platform health check.