ERP security incidents rarely look like Hollywood hacks. They look like a well-meaning controller who still has vendor-master rights from the implementation, plus a shared “finance” login on the AP workstation. Segregation of duties (SoD) is how you make fraud and honest mistakes harder. Audit trails are how you prove it.
Role design principles
- Build roles from jobs, not from copying the last person who left.
- Separate master data, transactional posting, and period close where volume allows.
- Keep a tiny break-glass admin role with MFA, check-out, and 24-hour expiry.
- Review high-risk access every quarter with business owners, not only IT.
Classic SoD conflicts to test first
| Conflict | Why it matters | Compensating control if unavoidable |
|---|---|---|
| Vendor create + payment release | Fake vendor payouts | Out-of-band bank confirm + dual release |
| Customer credit + sales order approve | Channel stuffing / bad debt | Credit manager review of exceptions |
| Inventory adjust + count approve | Theft concealment | Camera + dual count on A items |
| GL post + bank rec approve | Covering misstatements | Controller review of rec package |
| User admin + finance post | Invisible override | Split between IT and finance |
Logging that auditors will accept
Turn on change logs for bank accounts, payment terms, item costs, and role assignments. Retain them beyond the fiscal year plus audit cycle. Export a monthly privileged-access report to a system administrators cannot quietly edit.
- SSO everywhere; disable local passwords except break-glass.
- SCIM or automated joiner-mover-leaver from HRIS.
- Alert on after-hours vendor bank changes.
- Document who reviewed SoD exceptions and why.
Conclusion
ERP security is mostly unglamorous hygiene: job-based roles, a short list of deadly SoD conflicts, monitored privileged access, and immutable logs. Run this checklist before year-end, not during fieldwork. Auditors notice the difference—and so do opportunistic insiders.