How should finance and IT teams implement application configuration monitoring across ERP systems?

Set the monitoring scope around the configurations that can change control behavior

Application configuration monitoring works best when finance and IT agree on which settings are control-relevant, not just which settings are “important.” For ERP platforms, that usually includes approval routing, posting tolerances, segregation of duties rules, payment controls, user entitlement logic, interface parameters, and database-level settings that can alter how transactions are validated or stored. A baseline should capture the approved state for each in a form that is comparable over time.

That baseline should be practical enough to support continuous comparison, not a one-time documentation exercise. Monitor application configuration, supporting database objects, and any integration points that can override or bypass intended behavior. In many environments, the right reference point is the combination of the business control owner’s approved setting and the technical state actually enforced in production.

When teams want a hardening baseline for ERP and adjacent platforms, CIS Benchmarks can help anchor the technical side of the configuration standard, while CISA Secure by Design reinforces the expectation that secure defaults and reduced-variance configurations should be the norm, not the exception.

Monitor for drift, not just for obvious tampering

The most useful monitoring model is baseline plus differential monitoring. That means tracking every meaningful change, classifying whether it was approved, and proving when it was introduced and by whom. Finance teams care because a small parameter change can alter posting behavior, controls around journal approval, or the way exception workflows are triggered. IT teams care because the same change may appear harmless at the application layer while creating a deeper control defect in the database or middleware layer.

Automation matters here because manual review tends to miss low-frequency, high-impact changes. Configure discovery to identify new or modified objects, then route only material deltas to review. Alerting should be severity-based, with the highest priority on changes to controls, approvals, SoD logic, and interfaces that feed financial reporting. Audit trails need to be complete enough to reconstruct what changed, when it changed, who approved it, and whether rollback was available.

For the monitoring and audit portions of the program, NIST SP 800-53 Rev 5 Security and Privacy Controls is useful because it directly aligns configuration management, auditability, and integrity monitoring. Where ERP settings affect financial operations, ISO/IEC 27002:2022 Information Security Controls provides a strong control-selection lens for governance, logging, and technical change control.

Make finance and IT jointly accountable for evidence and recovery

Monitoring only works if it produces evidence the business can use. Finance should own the definition of critical configurations and the acceptable-control outcome, while IT should own the tooling, alerting, and restoration process. The joint operating model should include review cadence, named approvers, documented exceptions, and a restoration path for reverting unsafe changes quickly. That makes the control more than surveillance, it becomes a live mechanism for preserving financial integrity.

Practically, teams should verify that the monitoring system can show the before-and-after state, preserve immutable logs, and support rollback testing in a nonproduction environment before relying on it in production. Where ERP configuration changes can create downstream reporting errors, that recovery capability is as important as detection. A monitoring program that cannot restore a stable baseline is only half a control.

Practitioner takeaway: Treat erp configuration monitoring as a financial control, not an IT hygiene task, and design it so that detection, accountability, and rollback all work together.

Related resources from NHI Mgmt Group

• How should security teams implement continuous transaction monitoring across business systems?
• How should teams implement segregation of duties in finance and ERP systems?
• How should SOC teams implement DORA-aligned monitoring and incident response across ICT systems?
• How should security teams implement DLP monitoring across cloud and SaaS environments?