How should security teams embed ERP controls into business processes instead of retrofitting them after go-live?

Why This Matters for Security Teams

ERP controls fail most often when they are treated as a post-go-live checklist instead of part of the business process itself. At that point, the system may already be configured around speed, user convenience, or workarounds that weaken approval, segregation, and auditability. Control design needs to follow the actual transaction flow, not an assumed future-state process.

This is especially important in shared-service ERPs where finance, procurement, and operations all touch the same workflow. If ownership, approvals, and exception handling are unclear, teams end up relying on manual compensating controls that are hard to sustain. NIST guidance on control design in NIST SP 800-53 Rev 5 Security and Privacy Controls supports building controls into system and process requirements early, before exceptions become normal operating practice.

NHI Management Group’s Ultimate Guide to NHIs — Lifecycle Processes for Managing NHIs is useful here because ERP processes increasingly depend on service accounts, API keys, and automation identities that must be governed as part of the process itself. In practice, many security teams discover broken approvals and over-broad access only after the first audit or reconciliation failure, rather than during design.

How It Works in Practice

Embedding ERP controls means translating business policy into transaction-level controls before go-live. Start by mapping the process end to end: who creates the record, who approves it, what system validates it, where exceptions are handled, and what evidence proves the control ran. Then decide which controls should prevent an issue, which should detect it, and which should trigger review. That separation matters because not every control can be preventive without slowing the business.

For example, segregation of duties can be enforced through role design, approval thresholds, and workflow routing, while detective controls can flag unusual vendor setup changes, manual journal entries, or overrides above tolerance. For automated steps, NHIs must be treated as process actors too. Use least privilege, short-lived credentials where possible, and lifecycle controls for service accounts and API keys. The Ultimate Guide to NHIs — Standards helps anchor this approach in governance, visibility, and rotation expectations rather than informal ownership.

Teams should also align the design to control evidence. If a control cannot be tested from the ERP logs, approval history, or identity records, it will be difficult to operate consistently. In many implementations, the cleanest design is to place controls where data is first created, changed, or released, then supplement with periodic reconciliation for exceptions.

• Define process owners and control owners separately when accountability differs.
• Make approvals part of the workflow, not a downstream email or spreadsheet step.
• Use exception reporting for non-routine cases instead of disabling the control.
• Document the evidence source at design time so audit testing is repeatable.

These controls tend to break down when ERP customisation, third-party integrations, or emergency access paths bypass the normal workflow because the control no longer sits on the true transaction path.

Common Variations and Edge Cases

Tighter control design often increases implementation effort and can slow initial process rollout, so organisations must balance speed against durable compliance. Best practice is evolving on how much should be embedded in the ERP versus handled by adjacent tooling, especially when cloud ERPs, workflow engines, and integration platforms all share responsibility.

One common edge case is a fast-moving deployment where process owners ask security to “bolt on” controls after user acceptance testing. That approach can work for low-risk gaps, but it usually creates rework when the control conflicts with actual operations. Another edge case is M&A or reorganisation, where inherited roles, legacy approvals, and duplicate masters expose control gaps that did not exist in the original design. In those cases, controls should be revalidated against the new operating model rather than simply copied forward.

Where automated identities are involved, control ownership becomes even more important because an ERP process may depend on an NHI that outlives the team that created it. Current guidance suggests pairing business process controls with identity lifecycle controls so access, rotation, and offboarding remain tied to process ownership. That is where broader NHI governance from NHI Management Group is most practical: it makes the control durable when the process, the integration, or the responsible team changes.

Related resources from NHI Mgmt Group

• How should security teams design ERP cloud roles so users do not inherit unnecessary privilege at go-live?
• How should security teams implement cloud security controls in a live environment instead of treating them as compliance checklist items?
• How should security teams implement policy-based access controls for ERP systems that contain sensitive personal and financial data?
• How should security teams make NHI best practices usable across the business?